Privacy Policy

Version 2026-11-02. Plumbline Studios ("we") runs Plumbline Studio. This policy explains what personal data we collect, why, who we share it with and your choices. By using the Service you agree to it.

1. What we collect

• Account data: name, company, email address, password (stored only as a salted hash), sign-in times, terms acceptance and security settings (for example two-factor sign-in).
• Content you give us: briefs, uploaded drawings and images, comments, firm profile details, project data, and the drawing sets, models and reports generated from them. These can include personal data of other people (for example client names and site addresses).
• Usage and technical data: the drawings you run, features and exports you use, usage measures that apply plan limits, IP address, browser and device details, request and error logs, and security events.
• Usage analytics (signed-in users): which pages, sheets and screens you spend time on, which buttons and features you use, and which part of the screen your mouse is over. We record names and counts only, with one exception: for the change requests you type into the drawing chat we keep a short written summary of what you asked for and whether you had to rephrase (not your exact words, not drawing content), in the same customer contact system. We never record form fields or file names. We use it to improve Plumbline Studio, to understand which features matter, and to decide when to offer help or contact you about Plumbline Studio. This is kept in our own customer contact system, is not sold or shared with advertisers, and you can switch it off any time under Account > Privacy, or by emailing [email protected]. The usage analytics above is not collected for visitors who are not signed in.
• Where you came from (all visitors): we count visits to our public pages (home, sign-up, sign-in, password reset, contact, terms, privacy and acceptable-use) anonymously, by day and by the link or site that sent you (for example a tagged link or linkedin.com). Links in our emails carry a campaign tag and a short one-way code for the recipient (never your name or address), so that we can tell which email a visit or sign-up came from and report it per email template. On those pages we also record, in aggregate and without identifying anyone, how long each section is on screen, which sample sheets are opened, zoomed and for how long, which part the mouse rests on, which buttons are clicked and how far down the page people scroll. We also count, in the same anonymous way, the country the visit came from, the device type and the time of day. Unique visitors are counted per day from a one-way code that is deleted overnight. No cookie is used and no IP address or other personal data is stored for these counts. Your browser remembers that source for up to 60 days so that, if you sign up, we can keep it with your account to learn which channels work. Clear your browser data to remove it.
• Free try (no account): if you use the free try we keep (a) one small functional cookie with a random code and a signature, for 30 days, only to remember that this browser has used its free try; (b) for up to one day, a one-way code made from your network address and browser type (neither is stored in readable form) so that one person gets one free try; and (c) the building description you typed, kept for up to 7 days so a repeated description is not drawn again, with the drawing. This is necessary for the free try to work fairly. The drawing carries a watermark.
• Billing data: invoices, subscription status and payment method type. Card details go straight to Stripe; we never see or store full card numbers.
• Communications: messages you send us, review requests, and share-link comments. If someone comments through a share link, we store the name and text they enter.
• Customer record: we keep your name, company, email, plan and how far you have got (sign-up, trial use, upgrade, payment status) in our own contact system so we can follow up, offer help and tell you about Plumbline Studio. It is run by us and used only for that. You can opt out of contact at any time by replying "stop" to any message or emailing [email protected].
• Cookies: one essential session cookie to keep you signed in. Our public pages (home, sign-up, free tools, contact and legal pages) also load Google's advertising tag so that we can measure whether our Google ads lead to sign-ups. It may set Google cookies and tell Google that you visited or signed up. In the UK, the European Economic Area and Switzerland it is switched off by default, and we do not currently ask for consent, so it stays off there. It is never loaded on signed-in pages, so your drawings and projects never touch it. You can block it with your browser's tracking settings or Google's ad settings. We use no other advertising cookies or third-party trackers.

2. Why we use it

To provide, secure and support the Service; to create your drawings and reports; to apply trial and fair-use limits; to bill you and keep tax records; to prevent fraud, abuse and misuse; to communicate with you about your account, reviews and changes, and to contact you about Plumbline Studio (you can opt out at any time); to meet legal duties; and, in aggregated or de-identified form, to measure reliability and improve the Service. We do not sell your personal data, we do not use your drawings for advertising, and we do not ourselves use Your Content to train AI models.

3. Who we share it with

• Our own team and administrators: no one. Your briefs and drawings are private to your account. Our staff and admin accounts cannot open, list or download them in the product. The only exception is an engineer review that you request yourself: while that review is open, the reviewing admin can read (not change) that one drawing, and the access ends when the review is approved or declined. Your files are stored on our servers, so we may have to disclose them if the law requires.
• AI providers: your brief and uploaded drawings are sent to frontier AI models run by third-party providers to produce the plan. They process them under their own terms and privacy commitments, which are outside our control. We may change providers and will update this page if we do.
• Stripe: payments, invoices and receipts.
• Google: if you come from or visit our public pages, Google's advertising tag (see Cookies above) receives the page you visited and whether you signed up.
• Email provider: account, billing and notification emails.
• Hosting, network and security providers: the Service is delivered through infrastructure partners that handle traffic and data on our behalf.
• People you choose: anyone you give a share link to can see the sheets you share and the comments on them; a reviewing engineer you request can open that drawing; your own team members if you share credentials (which our terms do not allow).
• Professional advisers and authorities: our accountants, lawyers and insurers where needed, and authorities where the law requires or to protect rights, safety or the Service.
• Successors: if we sell or restructure the business, data may transfer to the new owner under the same protections.

4. Where data goes

Our providers may process data in countries other than yours, including outside Singapore. We take reasonable steps so that your data receives protection comparable to this policy when it is transferred, for example through our providers' contractual terms.

5. How long we keep it

We keep account data while your account is open, drawing projects until you delete them or close your account, and invoices and tax records as long as the law requires. When you close your account we remove your personal details from our database promptly, and hold your projects for up to 30 days before deleting them. Routine backups and logs may retain copies for a limited further period. Anonymised or aggregated data that cannot identify you may be kept.

6. Your rights and choices

You can access, correct and download your data in your account (Account > Download my data), close your account (Account > Close account), and withdraw consent to optional processing. Under data-protection laws that apply to you (for example Singapore's Personal Data Protection Act or Malaysia's Personal Data Protection Act) you may have rights to access, correct, port or erase your data, and to withdraw consent, and to complain to the data-protection authority. Write to [email protected] and we will respond within a reasonable time. Withdrawing consent or erasing data may mean we cannot continue to provide the Service. Our contact for data protection matters is [email protected].

7. Security

Passwords are hashed, sessions use HttpOnly cookies over HTTPS, optional two-factor sign-in is available, projects are visible only to their owner (plus anyone you share them with or request to review them), and uploads are processed in isolated project folders. No system is perfectly secure. If we learn of a data breach likely to harm you we will notify you and the authorities as the law requires. Please tell us at [email protected] if you suspect a problem.

8. Content you upload about other people

If your drawings or comments contain personal data about other people, you must have the right and, where required, their consent to give it to us for these purposes. Do not upload sensitive personal data (such as identity numbers or health data) unless it is necessary.

9. Children

The Service is for adults and businesses. We do not knowingly collect data from anyone under 18.

10. Changes and contact

We may update this policy and will tell you about material changes. Plumbline Studios. Email [email protected].