Privacy Policy

What we collect

We collect the minimum data necessary to operate Fabdose:

• Account data: email address (required), display name (optional), avatar URL if you sign in with Google.
• Usage logs: action type, cost estimate, latency, defect count.
• Payment data: email, card brand, last four digits, and payment timestamp — provided by Lemon Squeezy after a successful charge. We never receive or store full card numbers.
• Referral data: referral code and IP hash (SHA-256 with a separately-stored salt) used solely to detect abuse in the referral programme.

What we do NOT collect

Your STP/STEP CAD files never leave your computer.

Fabdose analysis runs locally on your desktop. Your reports and analysis history are saved in local storage on your computer. Fabdose does not currently sync reports to your account or show them on other devices. STP/STEP files, CAD geometry, and design drawings are never transmitted to our servers, and file names are not sent to our servers either. When you use report translation or AI chat, the analysis results (such as material, process, and issue text) and the questions you type in chat are sent to a server. Usage logs (token counts, response time, user_id) and account and usage-limit information are kept on our servers as described in the other sections of this policy. This works the same on Free and Pro. You can verify in real time that CAD files are not transmitted by using your operating system's network monitor.

Where data is processed

Fabdose uses the following third-party processors, all of which are covered by an adequacy decision or Standard Contractual Clauses:

• Supabase (US-East, AWS us-east-1): account data, usage logs, analysis metadata. Data Processing Agreement in place.
• Anthropic (United States): used to generate DFM analysis result text (defect descriptions). STP files are never transmitted. Data Processing Agreement in place.
• Lemon Squeezy (Singapore / United States): acts as Merchant of Record for all payments. Processes billing information and issues receipts independently.
• Sentry (United States): error monitoring and session replay. Text inputs are masked and media is blocked. Only 10% of sessions are sampled; sessions that encounter errors are recorded in full.
• Google Analytics 4, Google Tag Manager, and Microsoft Clarity: website (fabdose.app) traffic measurement and behavioural analytics. IP anonymisation is enabled. Not applied to the desktop application.

How long we keep data

• Account and usage data: retained while your account is active, then hard-deleted within 5 business days of a verified account-deletion request. Soft deletion (logical delete flags) is not used.
• Payment records: retained for 5 years to satisfy tax and accounting obligations under Korean law. Records are pseudonymised after the statutory period.
• Anonymised aggregate statistics: retained indefinitely for service-improvement purposes. These records contain no data that can identify an individual.

Your rights

Under PIPA and GDPR you have the following rights:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate data.
• Deletion: request deletion of your account and all associated personal data. We will complete hard deletion within 5 business days.
• Portability: receive your account and usage data in a structured, portable format.

You can initiate account deletion from Settings > Delete account. After deletion, you may register again with the same email address; however, previous data will not be restored.

Cross-border data transfers

Your data may be transferred to and processed in the United States, Singapore, and other countries. These transfers are made under one or more of the following mechanisms:

• Korea-EU Adequacy Decision (December 2021): covers transfers between the Republic of Korea and the European Economic Area.
• Standard Contractual Clauses (GDPR Module 2): used for transfers to Supabase and Anthropic in the United States.
• PIPA Article 28-8 paragraph 1 item 3 (processing entrustment): covers transfers to overseas sub-processors (Supabase, Anthropic) for the purpose of providing the Fabdose service.

Cookies

The Fabdose website (fabdose.app) uses the following cookies and tracking technologies. (1) Strictly necessary: a Supabase session cookie to keep you signed in, and a referral cookie (fabdose_ref). (2) Analytics: Google Analytics 4, Google Tag Manager, and Microsoft Clarity for anonymised traffic measurement and behavioural analysis. (3) Error monitoring: Sentry, with session replay that masks text input and blocks media. We do not use advertising cookies or third-party ad-tracking pixels. Analytics and session-replay tools are not applied to the desktop application.

Contact

For privacy questions, data-access requests, or deletion requests, contact us at support@fabdose.app. We will respond within 5 business days.