AsDrawn Privacy Policy

This Privacy Policy describes how AsDrawn LLC, a Missouri limited liability company ("AsDrawn," "we," "us," or "our"), collects, uses, and discloses personal information when you visit https://asdrawn.net (the "Site") or use our practice management software for architecture and engineering firms (the "Service"). We refer to visitors and customers collectively as "you" or "Users."

Important: This Policy Does Not Cover Your Firm's Project Data

This Privacy Policy does not apply to the data your firm submits to the Service — project records, fees and budgets, timesheets, staffing allocations, invoices, client information, or personnel data (collectively, "Customer Data").

We process Customer Data only on behalf of the firm that submitted it, under that firm's instructions and under our Terms of Service and Data Processing Addendum — not under this Policy. Your firm, not AsDrawn, decides how that data is collected, used, retained, and shared, and your firm's own privacy policy governs it.

If you are an employee, contractor, or client of a firm that uses AsDrawn and you have questions about data your firm has entered into the Service, please contact your firm directly. We will refer such requests to your firm.

Two commitments in our Terms of Service are worth repeating here, because they are unusual and because they apply to Customer Data:

• We do not use Customer Data to train machine learning or artificial intelligence models.
• We do not use Customer Data to build benchmarking, industry, or comparative data products, and we do not sell, rent, or license it to anyone.

Those commitments are contractual, they bind any future acquirer of AsDrawn, and we have agreed not to weaken them by amendment. See Section 7.3 of our Terms of Service.

This Policy covers the information we collect and control ourselves: information from Site visitors, and account and billing information for the individuals who administer a customer account.

1. Information We Collect

Information You Provide Directly

• Account information. Name, email address, job title, firm name, and password when an account is created. Passwords are stored in hashed form and are not recoverable by us in readable form.
• Billing information. Billing contact name, billing address, and payment card details. We do not store or process full payment card numbers. Card data is collected and stored directly by Stripe, Inc., our payment processor, under Stripe's own privacy policy.
• Demo requests and contact forms. Name, email address, firm name, firm size, and any message you submit through a form on the Site or by emailing us.
• Correspondence. The content of emails, support requests, and other communications you send us, along with your contact details.

Information Collected Automatically

• Device and connection data. IP address, browser type and version, operating system, device type, and referring page.
• Usage data. Pages visited, links clicked, dates and times of access, and approximate location derived from IP address.
• Application logs. Server and application logs generated in the ordinary course of operating the Service, which may include IP addresses, timestamps, and account identifiers.

Information from Third Parties

We do not purchase personal information from data brokers, and we do not enrich or append third-party data to our records. We may receive information from our service providers in the ordinary course of their work for us — for example, delivery and bounce information from our email provider, or transaction status from our payment processor.

2. How We Use Personal Information

We use the personal information described above to:

• Create, authenticate, and administer accounts, including password resets and user invitations
• Provide, maintain, secure, and support the Service
• Process payments, manage subscriptions, issue invoices, and collect amounts owed
• Respond to demo requests, questions, and support inquiries
• Send service and transactional messages, including billing notices, security notices, subscription renewal reminders, and notices of changes to our legal terms
• Send marketing communications about AsDrawn, where permitted by law and subject to your right to opt out at any time
• Understand how the Site and Service are used, diagnose technical problems, and improve performance and usability
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Comply with legal obligations and enforce our agreements

We do not use personal information for automated decision-making that produces legal or similarly significant effects, and we do not engage in profiling for targeted advertising.

3. How We Disclose Personal Information

We disclose personal information only in the circumstances described below.

Service Providers

We share personal information with vendors who perform services for us, under contracts that limit their use of the information to providing those services. Our current service providers are:

We do not currently use any artificial intelligence provider to process Customer Data or personal information. We use AI-assisted tools internally in developing the Service, and we do not provide Customer Data or personal information to those tools. If we introduce an AI-assisted feature in the future, we will engage providers only under commercial terms that prohibit them from using data we send them to train or improve their models, and we will update this Policy and our subprocessor list with at least thirty (30) days' notice beforehand.

A current list of the subprocessors that handle Customer Data, including any optional integrations you enable such as QuickBooks Online, is maintained in our Data Processing Addendum. We provide at least thirty (30) days' notice before adding or replacing a subprocessor.

Legal and Protective Disclosures

We may disclose personal information where we believe in good faith it is necessary to comply with applicable law, regulation, subpoena, or other valid legal process; to enforce our Terms of Service; to investigate suspected fraud or violations; or to protect the rights, property, or safety of AsDrawn, our customers, or the public. Where we receive a legal request for Customer Data, we will, to the extent legally permitted, notify the affected firm and direct the requesting party to that firm.

Business Transfers

If AsDrawn is involved in a merger, acquisition, financing, reorganization, or sale of all or substantially all of its assets, personal information may be transferred as part of that transaction. Any acquirer remains bound by our commitments regarding Customer Data described above and in Section 7.3 of our Terms of Service. We will notify affected customers before any such transfer results in a material change to how their information is handled.

With Your Direction

We share information as you direct — for example, when you enable an optional integration with a third-party service.

4. We Do Not Sell or Share Personal Information

We do not sell, rent, trade, or lease personal information to third parties. We do not share personal information for cross-context behavioral advertising or targeted advertising, and we do not run advertising pixels or retargeting tags on the Site. We have not sold or shared personal information in the preceding twelve (12) months.

We do not disclose personal information to third-party advertising networks, data brokers, or marketing partners for their own purposes.

5. Cookies, Analytics, and Tracking

We use a small number of cookies and similar technologies:

• Strictly necessary cookies, which are required to keep you signed in, maintain your session, and protect against fraud and abuse. These cannot be disabled without breaking the Service.
• Preference cookies, which remember settings such as your display preferences.

We use privacy-preserving, cookieless analytics provided by Vercel to understand aggregate Site and application usage — for example, page views, referral sources, and performance metrics. This analytics data is aggregated and is not used to build individual profiles or to track you across other websites.

Most browsers let you refuse or delete cookies through their settings. Disabling strictly necessary cookies will prevent you from signing in.

Do Not Track. There is no common industry standard for interpreting browser "Do Not Track" signals, and we do not currently respond to them.

Global Privacy Control. We honor Global Privacy Control (GPC) and other recognized universal opt-out signals. Because we do not sell or share personal information, a GPC signal does not change our practices, but we will continue to honor it if our practices ever change.

6. How Long We Keep Information

• Account information: for the duration of the account relationship, and for a reasonable period afterward to resolve disputes and enforce our agreements.
• Our own billing and financial records — invoices we issue, payment transaction records, and tax documentation: seven (7) years, as required for tax, accounting, and audit purposes. This applies only to our own financial records of the business relationship. It does not mean we retain your firm's project, client, or personnel data for seven years — that data is deleted on the schedule below.
• Customer Data: governed by our Terms of Service and Data Processing Addendum, not this Policy. Customers may export data at any time during a subscription and for sixty (60) days after termination, after which it is deleted from active systems and removed from backups in the ordinary course of backup rotation.
• Demo requests, contact form submissions, and marketing contacts from people who do not become customers: twenty-four (24) months, after which we delete them.
• Application and server logs: retained for a limited operational period consistent with our hosting providers' standard configurations, and used only for security, debugging, and performance purposes.

We may retain information longer where required by law or where reasonably necessary to resolve a dispute or enforce an agreement.

7. Security

We maintain commercially reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption of data in transit using TLS, encryption at rest as provided by our hosting and database providers, role-based access controls limiting internal access to personnel with a business need, unique credentials for anyone with access to production systems, and periodic review of our practices and those of our vendors. Our technical and organizational measures are described in more detail in our Data Processing Addendum.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at info@asdrawn.net.

8. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights with respect to personal information we hold about you as a controller:

• Know and access — request confirmation of whether we process your personal information, and obtain a copy of it
• Correct — request correction of inaccurate personal information
• Delete — request deletion of your personal information, subject to legal and contractual retention requirements
• Portability — receive a copy in a portable, machine-readable format
• Opt out of sale, sharing, and targeted advertising — we do not engage in these activities, but the right is available to you
• Non-discrimination — we will not deny service, charge different prices, or provide a different level of quality because you exercised a privacy right
• Appeal — if we decline a request, you may appeal by replying to our response, and we will respond to the appeal in writing

How to exercise these rights. Email info@asdrawn.net with the subject line "Privacy Request," or write to us at the address in Section 12. We will verify your identity before responding, typically by confirming control of the email address associated with your account, and we will respond within forty-five (45) days, or notify you if we need additional time as permitted by law. You may use an authorized agent, subject to proof of authorization.

If your request concerns data your firm entered into the Service, we act as a processor and will refer your request to your firm, which is responsible for responding.

California residents additionally have the right to request the categories of personal information we collected, the sources, the business purposes for collecting it, and the categories of third parties to whom it was disclosed. Those categories are described in Sections 1 through 3 above. California residents may also designate an authorized agent and, under California Civil Code § 1798.83, request information about disclosures to third parties for direct marketing purposes — we make no such disclosures.

Marketing opt-out. You can unsubscribe from marketing emails using the link in any such message or by emailing info@asdrawn.net. Transactional and service messages — billing notices, security alerts, renewal reminders, and legal notices — will continue while your account is active.

9. Children

The Service is intended for business use by professionals. It is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected such information, we will delete it. If you believe a minor has provided us personal information, contact info@asdrawn.net.

10. International Users

AsDrawn is operated from the United States and is currently offered to customers established in the United States. All personal information we collect is processed and stored in the United States, which may have data protection laws different from those of your country. If you access the Site or Service from outside the United States, you consent to the transfer, processing, and storage of your information in the United States.

If your firm becomes subject to the GDPR, UK GDPR, or Swiss data protection law, please contact us so we can put appropriate transfer safeguards in place as described in our Data Processing Addendum.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will (1) update the "Last Updated" date above, (2) send an email notice to all active account holders, and (3) display a notice within the Service. Where required by law, we will obtain your consent before applying material changes to information already collected. We encourage you to review this Policy periodically.

12. Contact Us

Questions, requests, or complaints about this Privacy Policy or our handling of personal information:

AsDrawn LLC
117 S Lexington Street, Suite 100
Harrisonville, MO 64701, USA
info@asdrawn.net