Privacy Policy

1. Who we are and how to reach us

1.1 The controller for the personal data described in this policy is detumble.ai LLC, a limited liability company registered in the Arab Republic of Egypt ("detumble", "we", "us").

1.2 Privacy requests and questions: support@detumble.ai with the subject line "Privacy".

1.3 Data protection officer. Egypt's Law No. 151 of 2020 and its Executive Regulations (Prime Ministerial Decree No. 816 of 2025) require legal entities that process personal data to appoint and register a data protection officer with the Personal Data Protection Centre.

1.4 Representatives. If we are required to appoint a representative in the European Union (GDPR Article 27) or the United Kingdom (UK GDPR Article 27) because we offer the Service to people there without an establishment there, their details will appear here.

2. Scope and roles

2.1 This policy covers the detumble website, web application, API and MCP endpoints, e-mails we send, and support conversations (together, the "Service").

2.2 Where we are the controller. We decide why and how to process personal data for: your account, your sign-in, billing and credits, usage and security logs, support, marketing to people who have opted in, and our own legal obligations. This policy governs that processing.

2.3 Where we are a processor. The drawings, schedules, notes and files you upload ("Customer Content") and the outputs we compute from them ("Outputs") may contain personal data: names of engineers and draughtsmen in title blocks, client names, site addresses, signatures, contact details on cover sheets, and occasionally more. For that data, you (or your client) are the controller and we are your processor. We process it only to provide the Service to you, on the instructions set out in the Terms of Service and the Data Processing Addendum. If you are an individual whose data appears in a customer's drawings, please contact that customer first; we will help them respond.

2.4 Team accounts. On Enterprise plans, the organisation that opens the team account controls who is admitted and what they can see. If your employer gave you access, your employer is the controller for your membership data and can see your activity in its projects.

3. Personal data we collect

We collect only what the Service needs. The table lists each category, where it comes from and why.

We do not knowingly collect special categories of personal data (health, biometrics, religion, political opinions and similar), criminal records data, or data about children. Do not upload such data to the Service; if it appears in a drawing set (for example, a hospital plan naming patients), remove it first.

What we remember about you. If you ask us to, detumble keeps a short list of your own preferences and notes (for example "quantities in m3 to one decimal" or "I sign the RFIs as the QS lead"), so that its answers and your tasks fit the way you work. Nothing is saved unless you type it under Account, What I remember about you, or ask for it in your own words in a conversation; we never draw it out of your messages on our own. Each account you belong to keeps its own list (your personal account and a team account keep separate ones), it is read only in your own conversations and tasks, never in another member's, and it reaches our AI provider only as part of your own requests. You can read, change, pause or forget any of it, or all of it, at any time; it is part of your export and it is deleted when you close your account.

4. How we use personal data and on what legal basis

4.1 Where the GDPR, the UK GDPR or a similar law applies, we rely on the following legal bases. Egypt's Law No. 151 of 2020 requires consent or another lawful ground for processing; we treat the bases below as those grounds and will adjust the wording on our lawyer's advice.

4.2 No automated decisions with legal effect. The Service makes automated computations about drawings, not about people. We do not make decisions producing legal or similarly significant effects on you by solely automated means. Credit reservations and caps are applied automatically but are explained before every Run and can be reviewed by a human on request.

4.3 No sale, no advertising. We do not sell personal data, share it for cross-context behavioural advertising, or use advertising trackers.

4.4 AI models and your data. The models that read drawings and answer chat are provided by Anthropic through its API. We send them the text and geometry extracted from your drawings, your chat messages and the context needed to answer. Our contract with Anthropic prohibits it from training models on that data. Anthropic's published API retention policy deletes inputs and outputs after a short period (currently described by Anthropic as 30 days by default, with shorter or zero-retention arrangements available), except where content is flagged for a usage-policy violation. We will not use your Customer Content or Outputs to train, fine-tune or evaluate any AI model, ours or anyone else's, without your prior written consent that you may withdraw at any time. De-identified statistics about how the engine performs (Section 5.4 of the Terms) are not Customer Content.

5. Who we share personal data with

5.1 Subprocessors. We use the following providers to run the Service. Each is bound by a written contract that limits what it may do with the data. The authoritative list, with notification of changes, is Annex 3 of the Data Processing Addendum, also published at detumble.ai/legal/subprocessors.

5.2 Professional advisers and authorities. We may share data with our lawyers, accountants, auditors and insurers under a duty of confidence, and with courts, regulators and law enforcement where the law requires. Where the law allows, we will tell you before we disclose your data in response to a legal request and give you the chance to object.

5.3 Other members of your Projects and team. People you invite to a Project see what their role allows. Members of a team account can see each other's activity in shared Projects. A person who is not a member of a Project cannot see that it exists.

5.4 Business transfers. If detumble is involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of that transaction under confidentiality, and this policy will continue to apply until you are told otherwise.

6. International transfers

6.1 Storage in the EU. Customer Content, Outputs, account data, run data and backups are stored in Amazon Web Services region eu-north-1 (Stockholm, Sweden) and do not leave the EU for storage.

6.2 Transfers we make. Some processing takes place outside the EU and outside Egypt:

• Anthropic (United States) processes extracted drawing data and chat messages. The transfer from the EU is covered by Anthropic's Data Processing Addendum incorporating the European Commission's Standard Contractual Clauses (2021/914) and, where applicable, the UK International Data Transfer Addendum.
• Polar (United States) processes billing data as merchant of record under its own privacy policy and transfer mechanisms.
• Google processes sign-in data worldwide under Google's terms.
• detumble's founders (Egypt) access account, run and billing data from Egypt to operate the Service. Access to Customer Content from Egypt occurs only for support you request, incident response, or abuse and billing investigations, and is logged.

6.3 Egyptian customers. Data of Egyptian residents is stored in the EU and processed by the providers above. Egypt's Law No. 151 of 2020 restricts cross-border transfer of personal data to countries with an adequate level of protection or with a licence from the Personal Data Protection Centre and, in some cases, the data subject's explicit consent.

6.4 Gulf customers. Some Gulf jurisdictions have data-residency expectations for certain sectors and public projects. We do not currently offer in-region hosting or in-region AI inference. Do not upload data that must stay in your country until we confirm a residency option in writing.

7. Retention

7.1 We keep personal data only for as long as needed for the purpose it was collected for, and then delete or de-identify it. The schedule below is what the Service does today.

7.2 Legal holds. Where the law requires, or where data is needed to establish, exercise or defend a legal claim, we may keep specific data for longer and will limit its use to that purpose.

7.3 De-identified data. We may keep de-identified statistics about how the engine performs indefinitely; they cannot be linked back to you or to any drawing.

8. Your rights

8.1 Depending on where you live, you have the following rights, which we honour for everyone regardless of location as far as the Service allows:

• Access: a copy of the personal data we hold about you and information about how we use it.
• Rectification: correction of inaccurate or incomplete data. You can change your display name, mobile number and company in your account (Account, Profile); write to support@detumble.ai to change your e-mail.
• Erasure: deletion of your data. Deleting a Project from the app removes its Customer Content and Outputs; closing your account (write to support@detumble.ai from the account's e-mail address) deletes your account data and the Projects only you own at once, on the schedule in Section 7, and replaces your name on anything shared with other members by an anonymous marker. Some data must be kept under Section 7.1 (for example ledger records, which are kept without your name).
• Portability: your Customer Content, Outputs and ledger in machine-readable formats (the original files, IFC, DXF, CSV, JSON), which you can download from the app at any time, and an export of your account as one JSON document (your accounts and their ledger, your Projects with members, files, runs, artefact links and chat threads), sent to you on request from the account's e-mail address.
• Restriction and objection: you can ask us to restrict processing while a dispute is resolved and can object to processing based on legitimate interests; we will stop unless we have compelling grounds.
• Withdraw consent: for anything based on consent (marketing e-mail, any AI-training consent you have given), at any time, without affecting earlier processing.
• Not to be subject to solely automated decisions with legal or similarly significant effects; we make none.
• Complain: to a supervisory authority. In Egypt, the Personal Data Protection Centre (PDPC). In the EU, the authority of the member state where you live or work; in the UK, the Information Commissioner's Office. We would appreciate the chance to answer your concern first.

8.2 How to exercise. Use the account and Project controls in the app, or e-mail support@detumble.ai with the subject line "Privacy". We will verify that you are the account holder (usually by replying to your account e-mail) and respond within one month under the GDPR, or within the shorter period Egypt's Executive Regulations require. We do not charge for requests unless they are manifestly unfounded or excessive.

8.3 Data in a customer's drawings. If your personal data appears in a customer's Customer Content, we will pass your request to that customer and help them respond, as required by the Data Processing Addendum.

9. Security

9.1 We protect personal data with technical and organisational measures appropriate to the risk, including:

• encryption in transit (TLS 1.2 or higher) and at rest (AWS-managed keys for the database, object storage, queues and backups);
• per-Project isolation: each Project is its own database schema, its own object-storage prefix and its own graph namespace, and a non-member receives a "not found" response rather than an access-denied response;
• least-privilege access: production secrets live in AWS Secrets Manager and never on laptops; production data never flows to development or staging environments; founder access to Customer Content is exceptional and logged;
• an egress guard on every engine Run that prevents the model from calling anything other than the tools we allow;
• financial safeguards: per-run budgets, account caps, a company-wide daily cap and a kill switch, with every ledger write idempotent so that a duplicate event cannot charge twice;
• three-stage deployment (development, pre-release, production) with automated tests, isolation checks and money checks on every release;
• vulnerability management, dependency scanning and prompt security review of engine changes;
• staff confidentiality obligations and security training.

9.2 No system is perfectly secure. If you find a vulnerability, please tell us at support@detumble.ai; we will acknowledge you and will not pursue good-faith researchers who respect the Acceptable Use Policy.

9.3 Breach notification. If a personal data breach occurs, we will assess it immediately, contain it, and notify the competent supervisory authority within 72 hours where the breach is likely to result in a risk to individuals (GDPR Article 33; Egypt's Executive Regulations require notification to the PDPC within 72 hours and to affected individuals within three days after that). We will notify affected customers without undue delay with what we know, what we are doing and what they can do.

10. Cookies and similar technologies

The Service uses only strictly necessary cookies (session and CSRF protection) and cookieless analytics. There is no advertising, no cross-site tracking and no consent banner for analytics. The full list is in the Cookie Policy.

11. Children

The Service is for professionals and businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, contact us and we will delete it.

12. Marketing

We send product news only to people who opt in. Every marketing e-mail has an unsubscribe link. Service messages (sign-in links, receipts, security alerts, changes to the Terms) are not marketing and cannot be opted out of while you hold an account.

13. Do Not Track and similar signals

Because we do not track you across sites, there is nothing for a Do Not Track or Global Privacy Control signal to switch off; we treat those signals as an objection to any future non-essential processing.

14. Changes to this policy

We will post changes on this page with a new "last updated" date. For material changes, we will e-mail account holders at least 30 days before the change takes effect, or sooner where a change is required by law or by a provider we depend on. Earlier versions are available on request.

15. Contact

detumble.ai LLC, Arab Republic of Egypt.

Privacy requests and general questions: support@detumble.ai (subject "Privacy")

Parts of this policy are adapted from the 37signals Privacy Policy by 37signals, licensed under CC BY 4.0, and changed for detumble.ai.