SMARTSTRUCTS PRIVACY POLICY[cite: 2]

smartstructs.org[cite: 2]

Plain-language summary: SmartStructs is an AI-powered structural analysis platform.[cite: 2] We upload your blueprints to a secure cloud environment to generate reports, delete the source files automatically within 48 hours, and store only your email, filenames, and analysis reports in our database.[cite: 2] We never use your data to train AI models, and we never see or store your payment card details.[cite: 2] This policy explains everything in full.[cite: 2]

1. INTRODUCTION[cite: 2]

SmartStructs ("Company," "we," "us," or "our") operates the AI-driven structural engineering analysis platform accessible at smartstructs.org (the "Platform" or "Service").[cite: 2] This Privacy Policy describes how we collect, use, store, process, protect, and delete personal data and technical data submitted by users ("you") of our Platform.[cite: 2]

This Policy applies to all users worldwide and has been drafted to be compliant with applicable global privacy regulations, including but not limited to: the European Union General Data Protection Regulation (GDPR), the United Kingdom GDPR (UK GDPR), the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable national and regional data protection laws.[cite: 2]

By accessing or using the Platform, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy.[cite: 2] If you do not agree, you must immediately cease use of the Platform.[cite: 2]

Data Controller: SmartStructs, reachable at support@smartstructs.org.[cite: 2]

2. DATA WE COLLECT[cite: 2]

We collect the minimum data necessary to provide a functional, secure, and personalised engineering analysis service.[cite: 2] The categories of data we process are as follows:[cite: 2]

2.1 Account & Identity Data[cite: 2]

• Email Address: Used for account creation, authentication, and service communications.[cite: 2] Stored persistently in our primary database.[cite: 2]
• Authentication Credentials: Passwords are stored exclusively as salted, irreversible cryptographic hashes.[cite: 2] We never store plaintext passwords.[cite: 2]
• Token Balance & History: Records of your token purchases and consumption for dashboard and billing support purposes.[cite: 2]

2.2 Project & Technical Data[cite: 2]

• Uploaded Filenames: The string filename (e.g., site-plan-v3.pdf) is stored persistently to populate your project dashboard history.[cite: 2]
• Analysis Reports: Structured output reports generated by our AI pipeline are stored persistently in your account so you can access them at any time.[cite: 2]
• Source PDF Files: Uploaded PDF blueprints and structural plans.[cite: 2] These are processed and permanently deleted within 48 hours.[cite: 2] See Section 3.[cite: 2]

2.3 Technical & Usage Data[cite: 2]

• IP address and approximate geographic region (for security and fraud prevention purposes only)[cite: 2]
• Browser type, operating system, and device type (for compatibility and error diagnostics)[cite: 2]
• Session logs and access timestamps (for security audit trails and rate-limiting)[cite: 2]
• Error logs and diagnostic data related to platform failures (not linked to uploaded file content)[cite: 2]

2.4 Data We Do Not Collect[cite: 2]

We do not collect, store, or process: credit or debit card numbers, bank account details, government identification numbers, biometric data, or sensitive personal data beyond what is explicitly listed above.[cite: 2] All payment data is handled exclusively by our Merchant of Record, Paddle.com — see Section 7.[cite: 2]

3. DATA PROCESSING LIFECYCLE[cite: 2]

Transparency is a core principle of our platform.[cite: 2] Below is a precise, technical description of every stage through which your uploaded structural files and blueprints travel from the moment you submit them to the moment they are permanently deleted.[cite: 2] This lifecycle applies to every project you process on SmartStructs.[cite: 2]

3.1 Stage 1: Data Ingestion[cite: 2]

When you upload a structural PDF or blueprint to the Platform, the file is received over an encrypted HTTPS connection and written to an isolated, sandboxed temporary directory on our server execution environment.[cite: 2] This directory is purpose-built for transit only and is not integrated with any persistent storage or database system.[cite: 2] No other process or user can access this temporary directory.[cite: 2]

3.2 Stage 2: Local File Deletion[cite: 2]

Immediately upon successful and verified upload of your file to our secure cloud destination, the local temporary copy of your file is programmatically and permanently deleted from our server as part of the same execution block that handles the upload.[cite: 2] This deletion is not deferred, scheduled, or conditional — it is an automatic and immediate operation.[cite: 2] After this point, your source PDF file does not exist on our local server infrastructure under any circumstances.[cite: 2]

3.3 Stage 3: Third-Party AI Pipeline (Google Cloud)[cite: 2]

We utilise secure, enterprise-grade cloud infrastructure provided by Google LLC — specifically, Google Cloud Platform (GCP) and the Google GenAI API — to execute our automated structural data extraction and hazard analysis models.[cite: 2] Key security properties of this stage include:[cite: 2]

• All data transmissions between our servers and Google's infrastructure occur exclusively over encrypted HTTPS/TLS protocols.[cite: 2]
• Processing occurs within dedicated, isolated cloud environments.[cite: 2] Your data is not co-mingled with data from other users.[cite: 2]
• Google's infrastructure is subject to Google's Data Processing Agreement and applicable data protection regulations, including GDPR Standard Contractual Clauses where applicable.[cite: 2]
• Our use of Google's AI APIs is governed by enterprise-grade terms that expressly prohibit the use of submitted data to improve Google's foundational or public models.[cite: 2]

3.4 Stage 4: Automated 48-Hour Deletion from Cloud[cite: 2]

Uploaded source PDF files — your blueprints, structural plans, and technical drawings — are subject to an automatic, hard-coded deletion schedule within Google Cloud infrastructure.[cite: 2] Your source file is permanently and irrevocably deleted within exactly 48 hours of the time of upload.[cite: 2] This is not a manual process; it is an automated system-level operation.[cite: 2] After this 48-hour window, no copy of your source PDF exists in any cloud environment operated by or on behalf of SmartStructs.[cite: 2]

Important: Because source PDFs are permanently deleted from cloud infrastructure within 48 hours, we are unable to recover or re-supply your original uploaded file after that window.[cite: 2] Please retain your own copy of all submitted documents.[cite: 2]

3.5 Stage 5: Report Generation & Persistent Storage[cite: 2]

The structured analysis report generated by our AI pipeline is the output product of the Service.[cite: 2] This Report — not your source file — is stored persistently in our primary application database, linked to your account, and made accessible via your dashboard.[cite: 2] In addition to the Report itself, we store only the filename string of your original upload (e.g., building-A-foundations.pdf) and your account email as metadata associated with each project.[cite: 2]

4. DATA RETENTION[cite: 2]

We retain different categories of data for different periods, based on operational necessity, legal obligation, and your explicit data rights:[cite: 2]

• Uploaded Source PDF (local server): Retained in temp server directory.[cite: 2] Deletion is immediate upon programmatic upload confirmation.[cite: 2]
• Uploaded Source PDF (cloud): Retained on Google Cloud Platform for a maximum of 48 hours before automated scheduled purge.[cite: 2]
• Account Email Address: Retained in primary database for account lifetime; deleted upon account deletion request.[cite: 2]
• Uploaded Filename Strings: Retained in primary database for account lifetime; deleted upon account deletion request.[cite: 2]
• Generated Analysis Reports: Retained in primary database for account lifetime; deleted upon account deletion request or user-initiated deletion.[cite: 2]
• Token Purchase Records: Retained in primary database for up to 7 years for tax and legal compliance; anonymised after account deletion.[cite: 2]
• Server Access & Security Logs: Retained in secure log storage for 90 days before automatic log rotation and purge.[cite: 2]

Where applicable law requires us to retain certain data for longer periods (e.g., financial records for tax compliance), we will retain the minimum necessary data for the legally required duration, and will delete or anonymise all other data according to the schedule above.[cite: 2]

5. DATA ISOLATION & NO AI TRAINING USE[cite: 2]

Absolute Commitment: Your uploaded blueprints, structural plans, technical drawings, and any other data inputs you submit to SmartStructs are NEVER used to train, fine-tune, benchmark, or improve any public, shared, or foundational machine learning model — whether operated by SmartStructs or any third party.[cite: 2]

We make the following express and unconditional commitments regarding data isolation and AI training use:[cite: 2]

• No public model training: Your Uploaded Materials are never used as training data for any publicly accessible or commercially distributed AI or machine learning model.[cite: 2]
• No foundational model training: Your data is never contributed to the training or fine-tuning of any large language model (LLM), vision model, or other foundational AI model, including those operated by Google or any other third party.[cite: 2]
• No inter-user data use: Your Uploaded Materials are never used in connection with processing, benchmarking, or improving results for any other user of the Platform.[cite: 2]
• Complete user data isolation: Each project submission is processed in a fully isolated computational environment.[cite: 2] Your data does not interact with any other user's data at any stage of the pipeline.[cite: 2]
• Third-party contractual restrictions: Our contractual agreements with Google and other sub-processors expressly prohibit the use of data processed on our behalf for the improvement of their own models or services beyond the scope of fulfilling our service requests.[cite: 2]

6. THIRD-PARTY SUB-PROCESSORS[cite: 2]

We engage a limited number of carefully selected third-party sub-processors to provide specific technical functions necessary for the operation of the Platform.[cite: 2] All sub-processors are bound by contractual obligations to process your data only in accordance with our instructions, to maintain appropriate security standards, and to comply with applicable data protection laws.[cite: 2]

• Google LLC (Google Cloud Platform & Google GenAI API): Executes our AI pipeline, automated data extraction, and hazard analysis processing.[cite: 2] Google acts as a data sub-processor and processes your uploaded files solely to execute our analysis requests.[cite: 2] Google is subject to our Data Processing Agreement and is prohibited from using your data for its own model training purposes.[cite: 2]
• Paddle.com Market Limited: Exclusive Merchant of Record for all Token purchase transactions.[cite: 2] Paddle processes payment card data, issues invoices, handles tax compliance, and manages billing support entirely on their own infrastructure.[cite: 2]
• Authentication & Infrastructure Provider(s): Handle secure user authentication, session management, and core application hosting infrastructure.[cite: 2] These providers process account credentials and session data solely for the purpose of operating the Platform securely.[cite: 2]

7. PAYMENT DATA & PADDLE.COM[cite: 2]

SmartStructs never sees, handles, stores, or processes your credit card, debit card, or bank account information.[cite: 2] All payment data flows exclusively through Paddle.com's infrastructure.[cite: 2] All financial transactions on the Platform — including the purchase of Token bundles — are processed exclusively by Paddle.com Market Limited ("Paddle"), which serves as the Company's designated Merchant of Record.[cite: 2]

• No card data on our servers: Your credit card number, card expiry date, CVV/CVC, bank account number, or any other financial instrument details never touch SmartStructs' own servers or databases at any point in the checkout process.[cite: 2]
• Paddle's checkout environment: When you make a Token purchase, you are directed through Paddle's hosted, PCI-DSS compliant checkout interface.[cite: 2] All payment data entry, validation, encryption, and processing occurs within Paddle's infrastructure.[cite: 2]
• What we receive from Paddle: Upon a successful transaction, Paddle provides SmartStructs only with a non-sensitive transaction confirmation (e.g., a transaction ID, the Token bundle purchased, the amount, and currency) sufficient to credit your account with the correct number of Tokens.[cite: 2] No payment card data is included in this confirmation.[cite: 2]
• Billing disputes and financial inquiries: Any disputes, queries, or concerns regarding payment charges, tax invoices, or refund requests in relation to the checkout process should be directed to Paddle's customer support in the first instance, as Paddle is the Merchant of Record and sole party with access to your payment data.[cite: 2]

8. YOUR DATA RIGHTS[cite: 2]

Subject to applicable law, you have the following rights with respect to the personal data we hold about you.[cite: 2] To exercise any of the rights below, contact us at support@smartstructs.org:[cite: 2]

• Right of Access: You may request a copy of all personal data we hold about you, including your account information, project history, and report data.[cite: 2] We will respond within 30 days.[cite: 2]
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data we hold about you.[cite: 2]
• Right to Erasure: You may request deletion of your account and all associated personal data.[cite: 2] We will delete your data within 30 days, subject to legal retention obligations.[cite: 2]
• Right to Portability: You may request a machine-readable export of your personal data and generated analysis reports in a structured, commonly used format.[cite: 2]
• Right to Object: You may object to the processing of your personal data for specific purposes, including any future direct marketing communications.[cite: 2]
• Right to Restrict: You may request that we restrict the processing of your personal data in certain circumstances.[cite: 2]

8.1 CCPA / CPRA Rights (California Residents)[cite: 2]

California residents have the right to: (a) know what personal information is collected about them;[cite: 2] (b) know whether their personal information is sold or disclosed and to whom;[cite: 2] (c) opt out of the sale or sharing of their personal information;[cite: 2] (d) access their personal information;[cite: 2] (e) request deletion of their personal information;[cite: 2] and (f) equal service and price regardless of whether they exercise their privacy rights.[cite: 2] We do not sell or share personal data as those terms are defined under California law.[cite: 2] To exercise your California rights, contact support@smartstructs.org.[cite: 2]

9. SECURITY[cite: 2]

We implement technical and organisational security measures appropriate to the sensitivity of the data we process:[cite: 2]

• Encryption in transit: All data transmissions between your browser, our servers, and Google Cloud infrastructure are encrypted using industry-standard TLS/HTTPS protocols.[cite: 2]
• Encryption at rest: Persistent data stored in our primary database is encrypted at rest using AES-256 or equivalent encryption standards.[cite: 2]
• Temporary file isolation: Uploaded files are confined to isolated, sandboxed temporary directories with strict access controls and no persistent storage integration.[cite: 2]
• Immediate local deletion: The automated deletion of local temporary files upon cloud upload confirmation eliminates residual data exposure on our primary infrastructure.[cite: 2]
• Access controls: Access to production systems and databases is restricted to authorised personnel on a least-privilege, need-to-know basis, with multi-factor authentication required.[cite: 2]
• Credential hashing: All user passwords are stored exclusively as salted cryptographic hashes using industry-standard algorithms.[cite: 2] Plaintext passwords are never stored.[cite: 2]
• Security monitoring: Our infrastructure is subject to ongoing security monitoring, logging, and anomaly detection to identify and respond to threats in a timely manner.[cite: 2]

10. INTERNATIONAL DATA TRANSFERS[cite: 2]

SmartStructs operates globally, and your data may be processed in countries outside your country of residence, including the United States.[cite: 2] When we transfer personal data from the European Economic Area (EEA), United Kingdom, or other regions with data transfer restrictions, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs), Adequacy decisions, and Google Cloud data residency commitments.[cite: 2]

11. CHILDREN'S PRIVACY[cite: 2]

The Platform is intended exclusively for professional use by individuals aged 18 years or older.[cite: 2] We do not knowingly collect, process, or store personal data from children under the age of 13 (or the applicable minimum age in the relevant jurisdiction).[cite: 2] If you are under the applicable minimum age, you must not use the Platform.[cite: 2]

12. CHANGES TO THIS POLICY[cite: 2]

We may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the features and operation of the Platform.[cite: 2] Your continued use of the Platform following the effective date of any revised Policy constitutes your acceptance of the changes.[cite: 2]

13. CONTACT US[cite: 2]

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your personal data — including requests to exercise your data rights — please contact us through our primary support channel: support@smartstructs.org.[cite: 2]

We aim to respond to all privacy-related enquiries within 5 business days, and to fully resolve data rights requests within 30 calendar days.[cite: 2]