Privacy policy
This policy explains how we process personal data on cadtab.com (including the CadTab waitlist and the free DWG/DXF viewer) and in the CadTab app at app.cadtab.com (your CadTab account and drawings). The English, Polish and German versions have the same content.
1. Who is responsible for your data
The controller of your personal data is Qstal sp. z o.o., ul. Poligonowa 22, 18-400 Łomża, Poland, entered in the National Court Register (KRS) under no. 0000827105, NIP (tax ID) 7182154013, REGON 385461760.
For anything related to your data, write to hello@cadtab.com or by post to the address above. We have not appointed a data protection officer.
2. What we process, why and for how long
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Email address and the language of the page you signed up on | Keeping you on the waitlist and emailing you when the free beta opens (an invitation and news about the launch of CadTab) | Your consent: Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law | Until you unsubscribe or we close the waitlist, and no longer than 24 months from sign-up |
| Date and time of sign-up, IP address at sign-up, version of the consent text, where you came from (e.g. a link parameter) | Being able to show that you gave consent, and preventing abuse of the form | Our legitimate interest: Art. 6(1)(f) GDPR, in connection with Art. 7(1) GDPR | As long as your waitlist entry exists |
| CadTab account (app.cadtab.com): email address, name, password (we store only a one-way hash), language, plan, the invitation you used, date, time and IP address of sign-up and the versions of the terms and privacy policy you accepted | Creating and running your account, logging you in, confirming your email address, sending service emails (confirmation, password reset, important changes to the service) | Performance of the contract (beta terms): Art. 6(1)(b) GDPR; proof of acceptance: our legitimate interest, Art. 6(1)(f) GDPR | Until you delete your account. Accounts whose email address is not confirmed within 7 days are deleted automatically |
| Your drawings and the files you upload or save in CadTab (including any personal data they contain, e.g. names in title blocks) | Storing, displaying, converting, printing and exporting them for you. We do not look at your drawings, except at your request (support) or when strictly necessary to fix a technical or security problem | Performance of the contract: Art. 6(1)(b) GDPR | Until you delete them or your account. Deleted drawings stay in the bin for 30 days unless you empty it |
| Login and security data: time of the last login, temporary counters of failed logins (15 minutes) | Protecting accounts against password guessing and abuse | Our legitimate interest: Art. 6(1)(f) GDPR | Counters: 15 minutes; last login time: as long as the account exists |
| Backup copies of the app database and drawings | Restoring the service after a failure or mistake | Our legitimate interest: Art. 6(1)(f) GDPR | 14 days, after which they are overwritten |
| Messages you send to hello@cadtab.com, with your name and email address | Replying to you | Our legitimate interest in answering enquiries: Art. 6(1)(f) GDPR | Up to 2 years after the conversation ends, longer only if needed to establish or defend legal claims |
| Files you open in the free viewer on cadtab.com (DWG/DXF; they may contain personal data, e.g. names in title blocks) and the IP address of the request | Converting the file and showing you the drawing in your browser; a daily limit of previews that protects the service against abuse | Providing the service you ask for: Art. 6(1)(b) GDPR; request limits: our legitimate interest, Art. 6(1)(f) GDPR | The file is deleted right after the preview is ready, usually within seconds and at the latest after about 2 minutes (also when the conversion fails). It is not stored, not backed up and not used for anything else. For the daily limit we keep only a scrambled (hashed) form of your IP address, in the server's memory, for up to 24 hours |
| Server logs: IP address, date and time, requested address, browser identifier | Security of the website and preventing abuse | Our legitimate interest: Art. 6(1)(f) GDPR | 14 days |
Free DWG/DXF viewer. When you open a file in the viewer on cadtab.com, it is sent over an encrypted connection to our server in Germany, converted in an isolated environment without internet access and sent back to your browser as a drawing. We don't save the file in an account or anywhere else, we don't look at it, we don't use it to train any AI model and we don't pass it on to anyone. The file name never leaves your device, and our logs record only the size and type of the file and how long it took to process, not its name or content. The drawing stays in your browser tab until you close it. The viewer needs no account and sets no cookies.
Right after you join the waitlist we send you one email confirming it. Apart from that we only email you about the CadTab beta and launch. When you unsubscribe, your waitlist entry is deleted straight away.
You can delete your CadTab account yourself at any time (app.cadtab.com → Account → Delete account). Your account and all your drawings are deleted immediately; backup copies are overwritten within 14 days. Before deleting, you can export your drawings as DXF files.
3. Who receives your data
- netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, which hosts our website, the waitlist, the free DWG/DXF viewer, the CadTab app with your account and drawings, and our mail server in Germany. It acts as our processor under a data processing agreement (Art. 28 GDPR).
- cyber_Folks S.A., ul. Wierzbięcice 1B, 61-569 Poznań, Poland, on whose server we keep a backup copy of the waitlist and of the account database (without drawings). It also acts as our processor.
- Google: messages sent to hello@cadtab.com are also delivered to our Gmail mailbox. Google may process them outside the European Economic Area; Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision.
- Public authorities, only when the law requires it.
We do not sell your data and we do not use newsletter services, analytics or advertising tools. All our emails (waitlist and app) are sent from our own mail server. Your account and drawings are stored only in the European Union (Germany).
4. Your rights
You have the right to access your data, have it corrected or erased, restrict its processing, receive it in a portable format (you can also export your drawings as DXF files at any time), and object to processing based on our legitimate interest. You can withdraw your consent at any time with the link in every email we send or by writing to hello@cadtab.com. Withdrawal does not affect processing that took place before it.
You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You can also contact the authority in the EU country where you live or work.
5. Do you have to give us your data?
No, it is voluntary. Without an email address we cannot put you on the waitlist, and without an email address, a name and a password we cannot create a CadTab account for you. To show you a preview in the free viewer, we need the file you open.
6. Automated decisions
We do not make automated decisions about you and we do not profile you.
7. Cookies and storage in your browser
cadtab.com (this website, the free DWG/DXF viewer and the waitlist) does not use cookies, analytics or advertising trackers, does not store anything in your browser's storage and does not load fonts or scripts from other companies.
app.cadtab.com (the CadTab app) uses only what is strictly necessary to provide the service you ask for, so it does not need your consent (Art. 5(3) of the ePrivacy Directive, Art. 399 of the Polish Electronic Communications Law):
- one cookie,
cadtab_session, which keeps you logged in. It is not readable by scripts on the page (HttpOnly), is sent only over HTTPS to app.cadtab.com and expires after 14 days or when you log out; - your browser's local storage, used by the editor on your device only: a recovery copy of an unsaved drawing, the clipboard between drawings and display settings (for example the background colour). It is not sent to us unless you save a drawing.
The app does not use analytics, advertising or social media trackers and does not load fonts or scripts from other companies.
8. Changes to this policy
When we change this policy we publish the new version here with a new date. If a change affects the waitlist or your CadTab account, we will also let you know by email.