Privacy Policy

1. Who we are (controller) and scope

This Privacy Policy explains how ZeroEnd Technology AB (Sweden), doing business under the brand QuantCAD (“we”, “us”, “our”), collects, uses, shares, and protects personal data when you use our website at www.quantcad.ai and related services (the “Service”).

ZeroEnd Technology AB is the controller of personal data described in this Policy.

Registered address: Järpvägen 41B, 75653, Uppsala, Uppland, Sweden

Organization number (Bolagsverket): 559540-1224

VAT number (Skatteverket): SE559540122401

Brand notice: “QuantCAD” is a brand used by ZeroEnd Technology AB. It is not currently registered as a separate business name (bifirma) with the Swedish Companies Registration Office.

Privacy contact: for any privacy or data-protection question, or to exercise your rights, submit a Support Ticket and select Privacy & Compliance. We will route your message to the right team and respond within the timeframes described in Section 12.

We have not appointed a Data Protection Officer (DPO) because our processing does not currently meet the thresholds in Article 37(1) GDPR. Our Privacy Contact above is responsible for handling privacy matters.

Geographic scope: we currently provide the authenticated Service only to users who create accounts while located in the European Economic Area (EEA) or the United Kingdom (UK). New account creation and self-serve purchases are not currently available to visitors located in the United States (US) or Canada; US and Canadian visitors are redirected to our waitlist until remaining launch prerequisites are complete. The Service is also not offered to users located in Belarus, Russia, or Ukraine, or to any persons or entities subject to applicable EU, UK, US (including OFAC SDN), Canadian, or international sanctions. Our Enterprise offering remains EEA/UK-only at this time. See Terms of Service §1.

Region-specific notices. This Policy is the master privacy notice for the entire Service. Region-specific rights and disclosures are set out in supplementary notices that form part of this Policy:

• US visitors / waitlist users — see the US State Privacy Notice for CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA, TDPSA, and other state-law disclosures, including categories of personal information collected, your rights, GPC honoring, and the "Do Not Sell or Share My Personal Information" statement.
• Canadian visitors / waitlist users — see the Canadian Privacy Notice for PIPEDA, Quebec Law 25, Alberta PIPA, British Columbia PIPA, and CASL disclosures, including the designation of our privacy officer for Quebec, French-language rights, and cross-border transfer information.

In the event of a direct conflict between this main Policy and a regional notice on a region-specific point, the regional notice controls for users in that region.

Representatives: because ZeroEnd Technology AB is established in Sweden, we are not required to appoint an EU representative under Article 27 GDPR. We have not currently appointed a separate UK or Swiss representative. Based on our current assessment, we rely on the applicable representative exemptions for UK/Swiss processing where available; we will reassess and appoint a representative if our processing, user volume, or risk profile requires it.

Privacy Officer for Quebec (Canada): as required by section 3.1 of the Act respecting the protection of personal information in the private sector (CQLR c P-39.1, as amended by Law 25), we have designated our Privacy Contact (above) as the person responsible for the protection of personal information of Quebec residents. Contact via Support Ticket → Privacy & Compliance.

2. Definitions

• Personal data: any information relating to an identified or identifiable natural person (Article 4(1) GDPR).
• Processing: any operation performed on personal data (Article 4(2) GDPR).
• Controller: the entity that determines the purposes and means of processing.
• Processor: a third party that processes personal data on the controller’s behalf.
• Sub-processor: a processor engaged by another processor.
• Special category data: the categories of personal data listed in Article 9 GDPR (health, biometric, genetic, racial/ethnic origin, political opinions, religious beliefs, trade-union membership, sex life or sexual orientation).
• Service: the QuantCAD website and the AI-powered CAD generation, exports, dashboards, APIs, and related services.
• You / User: a natural person using the Service.

3. Summary (at a glance)

• What we collect. Depending on how you interact with us, we may collect account identifiers, billing identifiers, the content you submit (prompts, messages, project data, CAD files), public-site analytics (including cookieless Vercel Web Analytics), waitlist/contact information, and basic usage and security telemetry. US and Canadian visitors who cannot create accounts are generally limited to public-site, cookie, waitlist, contact, and marketing data unless they already have a valid account from a supported region.
• What we do with it. Provide the Service, secure it, support you, bill you, handle waitlist and contact requests, measure marketing-site usage (including cookieless Vercel Web Analytics and consent-based analytics where applicable), and improve the Service (including by sending prompts/outputs to third-party AI providers and, in some cases, fine-tuning third-party models on user content for safety, evaluation, and quality — see Section 8).
• What we do not do. We do not sell or share personal data. We do not use your data for behavioral advertising. We do not train our own large language models on your data (we do not own LLM models).
• Where we host data. Our primary data stores are in the EU: managed PostgreSQL (EU region), object storage (EU — Frankfurt), event analytics (PostHog Cloud, EU). Our application, public site, CDN/edge routing, and Vercel Web Analytics may be processed through Vercel infrastructure in the United States, the EU, and global edge locations depending on deployment and routing. Some service providers are in the United States or other third countries and are governed by SCCs, the EU-US/UK-US Data Privacy Framework where applicable, and (for Canadian transfers) PIPEDA-compliant safeguards. Sub-processor categories and selected named providers are published in Section 6 and Annex 3 of our Data Processing Agreement; a full named vendor list is available to enterprise prospects/customers during due diligence.
• Cross-border (US and Canada). If you are in the US or Canada and interact with our public site, waitlist, contact forms, cookies, or marketing emails, your personal data may be processed in the EU and the US. If you are in Canada, see Canadian Privacy Notice for the cross-border-transfer disclosure required by PIPEDA and Quebec Law 25.
• Free-tier public showcasing. On the free tier, your generated 3D Outputs and the project name may be displayed publicly in our catalog. We never publish your name, email, or other personal data. If you upgrade to a paid plan, public showcasing stops and your previously showcased Outputs are removed from public view (see Section 14).
• Beta Service. QuantCAD is currently in Beta. We may use feedback, bug reports, reliability data, support messages, and usage telemetry to test, fix, maintain, and improve the Service, as described in this Policy and the Terms of Service.
• Your choices. You can object to our use of your content for AI improvement and fine-tuning as described in Section 8; you can opt out of (or withdraw consent to) marketing emails — including direct marketing sent to existing paying customers under the EU soft-opt-in exemption (US: CAN-SPAM unsubscribe; Canada: CASL unsubscribe); you can withdraw consent to analytics cookies/technologies where consent is required; and you can request access, deletion, or portability — see Section 12. US visitors / waitlist users can also exercise CCPA/CPRA and equivalent rights via the US State Privacy Notice. Canadian visitors / waitlist users can exercise PIPEDA, Quebec Law 25, and provincial rights via the Canadian Privacy Notice.

4. Personal data we process

What we process depends on how you use the Service.

4.1 Account and authentication data

• Identifiers: your user ID and related account identifiers provided by Clerk (our authentication provider).
• Contact details: email address and/or username.
• Security/authentication metadata: session and sign-in events (timestamps, device/session identifiers, IP at sign-in for security).

We do not store your password. Authentication is handled by Clerk.

4.2 Billing and subscription data

• Billing identifiers: Stripe customer ID, subscription ID, price/plan identifiers, billing period timestamps.
• Invoices and payment status: limited billing details needed to show status and invoice links.

Payment card details are processed by Stripe as an independent controller for payment processing and fraud-prevention purposes. We do not store full card numbers or CVV. See stripe.com/privacy.

4.3 Projects, prompts, and generated content

When you use the Service to create or edit products/projects, we process and store:

• Project records: project names, revision metadata, lifecycle fields, timestamps.
• Messages: the text you submit (prompts/instructions) and AI responses.
• Generated artifacts and exports: generated code, structured files (for example recipe data), and export outputs (STL/STEP). Export artifacts are stored in private object storage (EU — Frankfurt) and delivered to you via time-limited signed links.

If you include personal data in prompts, messages, attachments, or project names/descriptions, we will process that data as part of providing the Service.

Please do not submit special-category data (Article 9 GDPR — health, biometric, genetic, racial/ethnic origin, political opinions, religious beliefs, trade-union membership, sex life/orientation) or other highly sensitive information. The Service is not designed to process this data and we have no lawful basis to do so.

By default your projects are private to you and users you authorize. The free-tier public-showcasing exception is described in Section 14.

4.4 Support, contact requests, waitlist, careers, and feedback

If you contact us we may process:

• Sales inquiries: name, email, company, phone (optional), message.
• Support tickets: name, email, category/priority, subject, description, optional file attachments.
• Careers inquiries: name, email, phone, LinkedIn/portfolio URLs where provided, and message.
• Waitlist requests: email address, coarse country/region inferred from request headers, waitlist bucket, signup timestamp, and related email-delivery metadata.
• Feedback and Beta reports: rating, written feedback, optional feature requests, bug reports, reliability reports, contact details, and your preference on whether we may contact you.

These submissions may be delivered to our team mailbox via our transactional email-delivery provider or synced to our marketing/waitlist email provider where that is the purpose of the submission.

4.5 Usage data, logs, and telemetry

• Public-site analytics: page views, referrers, approximate country, browser/OS/device information, page paths/URLs, and limited custom events on public/marketing pages. This may include Vercel Web Analytics, which Vercel describes as cookieless and aggregated/anonymized, plus Google Analytics and PostHog where enabled with consent.
• Usage and credit events: records of product creation, messages sent, credits consumed/awarded (with timestamps and limited metadata).
• Operational telemetry: quality/reliability metrics, error codes and truncated error messages, and internal identifiers used to diagnose failures.
• Security signals: IP address and request metadata for rate limiting, fraud/abuse prevention, and protecting the Service.
• Local preferences: browser local storage/session storage may store UI preferences such as theme, product-view appearance, layout sizes, ask/build mode preference, and one-time checkout/onboarding state.

Our telemetry is designed to reduce exposure of personal data: we hash certain inputs (for example, request fingerprints) and redact common sensitive fields in logs. We do not capture user passwords, payment-card data, or full request bodies in our logs.

4.6 Referrals

• Referral code data: a referral code associated with your account.
• Redemption status: whether referred users qualified for or received credits.
• Activity events: link creation/clicks and timestamps (we avoid storing unnecessary personal data about the referred person).

4.7 Marketing communications

We may send marketing newsletters under different rules depending on your region:

• EEA / UK — existing paying customers (Pro, Business, and other paid plans). Once you become a paying customer, we may send you marketing newsletters about our own similar products, features, and offers. This is permitted under the "soft opt-in" exemption in Article 13(2) of the ePrivacy Directive 2002/58/EC (as implemented in Sweden by §19 of the Marketing Act / marknadsföringslagen 2008:486), and is conducted on the legal basis of our legitimate interests (Article 6(1)(f) GDPR) in informing existing customers about closely related products. We give you a clear and easy opportunity to object — both at the point of collection (when you upgrade) and via a one-click unsubscribe in every marketing email.
• EEA / UK — free-tier and other non-paying users. We send marketing newsletters to non-paying users only if you have explicitly opted in, on the legal basis of your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.
• United States. Marketing emails to US recipients are sent in compliance with the CAN-SPAM Act of 2003 (15 U.S.C. §§ 7701–7713). Every marketing email contains a clear and conspicuous identification that it is an advertisement, our valid postal address, and a functioning unsubscribe mechanism that we honor within 10 business days. We send marketing emails to US users (a) with your express opt-in, or (b) where you are an existing paying customer, on the basis of our legitimate interests in informing you about similar products, with a clear opt-out provided at the point of collection and in every marketing email.
• Canada — CASL. Commercial electronic messages ("CEMs") to electronic addresses in Canada are sent only with the consent required by Canada's Anti-Spam Legislation (S.C. 2010, c. 23):
  • Express consent (most users): you have ticked an opt-in box at signup, in account settings, or in a similar clear affirmative action.
  • Implied consent (limited cases under §10(9) CASL): for 24 months following a purchase from us; or where you have conspicuously published a business email address without a notice that you do not wish to receive CEMs.
  • Every CEM identifies QuantCAD/ZeroEnd Technology AB, includes our mailing address, and provides an unsubscribe mechanism that takes effect without delay and in any event within 10 business days (§6 CASL). We will not send CEMs to a Canadian electronic address where consent has been withdrawn.

In all cases, we process your email address and basic engagement metadata (open/click events, suppression status) and send via our marketing-email service provider. You can unsubscribe at any time using the link in every marketing email — this also removes you from our active marketing list. Service / transactional emails (security alerts, billing notices, system messages) are separate and are sent on the basis of contract; you cannot unsubscribe from these while you have an account. (CASL: transactional and account-administration messages are excluded CEMs under §6(6) CASL.)

4.8 Promotional drawings (giveaways)

If you are subscribed to our marketing newsletter and are eligible under the Giveaway Terms, you may also be entered automatically into our recurring promotional drawings ("giveaways"). Giveaways are currently limited to eligible EEA/UK residents and are not open to US or Canadian residents. For each drawing we process your email address, your QuantCAD user identifier (used to credit any prize won), your subscription status, and basic eligibility data. We do not collect any additional personal data for the giveaway beyond what we already process for the marketing newsletter. The legal bases are the same as in Section 4.7 (consent for non-paying users; soft-opt-in legitimate interests for existing paying customers). Full eligibility, prize, and drawing rules are published in our Giveaway Terms. You can withdraw at any time by unsubscribing from the marketing newsletter.

5. How we use personal data — and on what legal basis

We map each purpose to a lawful basis under Articles 6 (and where relevant 9) GDPR / UK GDPR.

Purpose	Legal basis
Create/manage your account, store projects and messages, generate outputs, provide exports, operate the credit system	Contract — Art. 6(1)(b)
Process subscriptions, manage billing, issue invoices and receipts	Contract — Art. 6(1)(b) and Legal obligation — Art. 6(1)(c) (Swedish Bookkeeping Act / VAT records)
Detect and prevent abuse, enforce our Terms and acceptable-use rules, run automated prompt/content safety checks, maintain Service security	Legitimate interests — Art. 6(1)(f) (protecting the Service, our users, and third parties)
Provide customer support, respond to sales/support/legal inquiries, and handle attachments you submit	Contract — Art. 6(1)(b) and Legitimate interests — Art. 6(1)(f)
Handle waitlist submissions for unsupported regions and notify you when availability changes	Consent — Art. 6(1)(a) where required for email notifications; otherwise Legitimate interests — Art. 6(1)(f) in managing regional rollout and responding to your request
Process careers inquiries	Legitimate interests — Art. 6(1)(f) in recruiting and responding to applicants; Consent where required for optional future contact or retention beyond the current inquiry
Send service / transactional emails (security alerts, invoice notices, system notifications)	Contract — Art. 6(1)(b)
Send marketing newsletters to existing paying customers about our similar products, features, and offers	Legitimate interests — Art. 6(1)(f), under the soft-opt-in exemption in Art. 13(2) ePrivacy Directive / §19 marknadsföringslagen 2008:486. You have an absolute right to object — clear opt-out provided at the point of collection and in every marketing email.
Send marketing newsletters to free-tier and other non-paying users	Consent — Art. 6(1)(a) (you can withdraw at any time)
Run promotional drawings ("giveaways") for marketing-newsletter subscribers and notify winners	Same legal basis as the underlying newsletter subscription: Consent — Art. 6(1)(a) for non-paying users; Legitimate interests — Art. 6(1)(f) under the soft-opt-in exemption (Art. 13(2) ePrivacy / §19 marknadsföringslagen) for existing paying customers. See Giveaway Terms.
Future B2B sales outreach to business email addresses	Legitimate interests — Art. 6(1)(f) (with right to object — never personal/consumer addresses)
Marketing-site analytics: Vercel Web Analytics (cookieless, aggregated/anonymized), Google Analytics, PostHog	Legitimate interests — Art. 6(1)(f) for cookieless, aggregated/anonymized analytics where permitted; Consent — Art. 6(1)(a) for analytics cookies/local-storage analytics and where required by law (collected through CookieYes).
Improve and maintain the Beta Service: monitor performance, fix bugs, investigate downtime or unexpected behavior, evaluate quality, run human feedback / RLHF on our own UI behavior, and, for self-serve plans where permitted by law and not opted out, fine-tune third-party AI models for safety, accuracy, and quality	Legitimate interests — Art. 6(1)(f). You may object under Art. 21 — see Section 8.
Free-tier public showcasing of generated Outputs and project names	Contract — Art. 6(1)(b) (the free tier is offered on these terms) and Legitimate interests — Art. 6(1)(f) (to demonstrate Service capabilities). You can stop showcasing at any time by upgrading or by request — see Section 14. Avoid using project names that contain personal data.
Comply with applicable laws and respond to lawful requests	Legal obligation — Art. 6(1)(c)

We do not rely on Article 9 GDPR to process special-category data — please do not submit it.

6. How we share personal data

6.1 Service providers, sub-processors, and independent controllers

We use the following categories of vendors to operate the Service. Section 6 and Annex 3 of our Data Processing Agreement identify sub-processor categories and selected named providers; a complete named list is available to enterprise prospects/customers during vendor due diligence and is updated as it changes.

Category	Vendor	Role	Processing location
Authentication	Clerk	Identity & sign-in	United States
Payments	Stripe	Payment processing (Stripe is an independent controller for payments/fraud)	EU (Stripe Payments Europe Ltd., Ireland) and United States
Database	Managed PostgreSQL provider	Primary application database	EU
Private object storage	Object-storage provider	Storage of generated artifacts (STL/STEP, recipes)	EU (Frankfurt)
Workflow orchestration	Inngest / workflow-orchestration provider	Background jobs / event orchestration	United States
Isolated compute	E2B / sandbox-compute provider	Sandbox execution for builds	United States
Rate limiting / gates	Managed Redis / rate-limit provider	Abuse prevention and gating	EU
Application hosting / CDN / edge platform	Vercel	Hosts and routes the public site and application; edge middleware; deployment and request metadata	United States, EU, and global edge locations depending on deployment/routing
Marketing-site analytics	Vercel Web Analytics, Google Analytics, PostHog	Visitor analytics on public/marketing pages only. Vercel Web Analytics is cookieless and aggregated/anonymized by design; Google Analytics and PostHog are consent-based where required.	Vercel: United States, EU, and global infrastructure; Google: United States; PostHog: EU (PostHog Cloud EU)
Cookie consent	CookieYes	Consent management and proof-of-consent	India / United States
Email delivery (transactional)	Resend / transactional email provider	Sends service emails, support replies, form submissions	United States
Email delivery (marketing/waitlist)	Loops / marketing-email provider	Marketing newsletters, waitlist notifications, consent/suppression records	United States
Error monitoring	Sentry / error-monitoring provider (where configured)	Error and performance monitoring	EU or United States, depending on account region/configuration
AI processing	OpenAI, Anthropic	Inference for generation, evaluation, and safety; fine-tuning of third-party models for self-serve plans where permitted by law and not opted out (see Section 8)	United States

For enterprise due diligence, request the full named vendor list (with company names and processing locations) via Support Ticket → Privacy & Compliance.

These vendors process personal data on our written instructions under data processing terms appropriate to their role (or, where they act as independent controllers, under their own privacy notices and our contracts with them).

6.2 Legal and safety disclosures

We may disclose information if we reasonably believe it is necessary to:

• comply with applicable law, lawful requests, or legal process;
• protect the rights, property, or safety of us, our users, or others; or
• investigate fraud, security, or technical issues.

6.3 Business transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal data may be transferred as part of that transaction. We will provide notice of any change in controllership and ensure appropriate safeguards remain in place.

6.4 No sale, no targeted advertising — "Do Not Sell or Share My Personal Information"

We do not sell personal data and do not share personal data for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA, Cal. Civ. Code §§ 1798.100 et seq.), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Texas Data Privacy and Security Act (TDPSA), and the comprehensive consumer-privacy laws of other US states. We do not use personal data for targeted advertising or for advertising profiling, and we do not engage in the sale of sensitive personal information. Because we do not engage in any of these activities, you have nothing to opt out of with respect to "sale," "sharing," or targeted advertising — but we honor any opt-out request, including any Global Privacy Control (GPC) signal, as a binding instruction not to engage in those activities going forward. See the US State Privacy Notice for details and how to submit a request.

7. International data transfers

Our primary infrastructure is in the EU. Some of our sub-processors are located in the United States or other third countries.

7.1 Transfers from the EEA / UK / Switzerland

Where personal data is transferred outside the EEA / UK / Switzerland to a country without an adequacy decision, we rely on the following safeguards:

• The EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller-to-processor) or Module 3 (processor-to-processor), as applicable;
• The UK International Data Transfer Addendum (or the UK IDTA) for transfers from the UK;
• The Swiss Addendum for transfers from Switzerland;
• Where the recipient is certified under the EU-US Data Privacy Framework (and the UK Extension), reliance on that adequacy decision in addition to SCCs as a backup; and
• Supplementary measures where required following our transfer impact assessment (for example encryption in transit and at rest, access controls, data minimization, and contractual restrictions on government access requests).

7.2 Transfers from the United States

Personal data of US visitors and waitlist users may be processed in the United States (where many of our service providers are located) and in the European Union (where our primary infrastructure is hosted). US privacy law generally permits these transfers; we apply the same security safeguards described in Section 15 to all transfers regardless of origin. This does not mean the authenticated Service is currently available for US sign-up.

7.3 Transfers from Canada (PIPEDA + Quebec Law 25)

If you are in Canada, your personal data from public-site, cookie, waitlist, contact, legal-notice, or marketing interactions may be transferred to and processed in the European Union (our primary infrastructure) and the United States (certain service providers — see Annex 3 of the DPA and Section 6.1 below). We disclose this expressly here and in the Canadian Privacy Notice so that you can make an informed decision before submitting personal data, in accordance with PIPEDA Principle 4.8 (Openness) and section 17 of Quebec Law 25. This does not mean the authenticated Service is currently available for Canadian sign-up.

We rely on the following safeguards for cross-border transfers from Canada:

• Contractual safeguards with each sub-processor that bind them to a level of protection comparable to PIPEDA and Quebec Law 25, including security obligations, confidentiality, breach notification, and limits on secondary use.
• Technical safeguards including encryption in transit (TLS) and at rest where supported, least-privilege access controls, and logging.
• Quebec Law 25 — assessment of privacy-related factors. For transfers of personal information of Quebec residents to a third country (including the EU and the US), we conduct an assessment of the privacy-related factors as required by section 17 of Law 25, taking into account the sensitivity of the information, the purpose of the transfer, the safeguards in place, and the legal regime applicable in the recipient country. Summary of that assessment is available on request via the Privacy Contact (Section 1).

7.4 More information

You can request more information about the safeguards we use for a specific transfer by contacting our Privacy Contact (Section 1).

8. Use of AI providers, fine-tuning, and your right to object

8.1 We do not own or train our own LLMs

We do not build or train our own large language models. We use third-party AI providers (currently OpenAI and Anthropic) for inference and certain related functions.

8.2 What we send to AI providers and why

To generate CAD outputs, we send your prompts, messages, and limited project context to AI providers via their APIs. The default API terms of OpenAI and Anthropic state that data sent through the API is not used to train their general models.

8.3 Use of user content for Service improvement and fine-tuning

For self-serve plans where permitted by law and not opted out, we use prompts/messages, generated outputs, and certain project metadata to:

• evaluate and improve our system prompts, planners, and recipes;
• improve safety classifiers and abuse-prevention rules;
• run reliability/quality engineering, including diagnosing bugs;
• conduct human feedback / RLHF-style review of how the Service responds; and
• fine-tune third-party AI models (currently OpenAI and Anthropic) to improve accuracy, safety, and quality of CAD-related outputs.

Although third-party providers state that API data is not used to train their general models, fine-tuning models we deploy through their platforms does incorporate user-derived data into the fine-tuned weights that are used to serve our users. We rely on legitimate interests (Article 6(1)(f) GDPR) for these activities where that basis is available. Enterprise Customer Personal Data is not used for AI training or fine-tuning unless the customer expressly opts in in writing under an enterprise agreement or DPA.

Human review is limited to personnel, contractors, or authorized service providers who need access for support, safety, quality, or legal reasons and who are subject to confidentiality obligations. We do not intentionally use special-category data, children's data, payment-card data, or credentials for AI improvement or fine-tuning.

8.4 Your right to object (Article 21 GDPR)

You have the right to object, on grounds relating to your particular situation, to our use of your personal data for the activities in Section 8.3 where we rely on legitimate interests. To object, contact our Privacy Contact (Section 1) or submit a Support Ticket and select Privacy & Compliance. Once you object, we will stop processing your personal data for those purposes unless applicable law permits continued processing based on compelling legitimate grounds or for the establishment, exercise, or defense of legal claims. In practice, we will:

• exclude your future content from any further evaluation, fine-tuning, or improvement datasets; and
• where reasonably feasible, exclude your historical content from datasets that have not yet been used.

Important technical limitation: information that has already been incorporated into a fine-tuned model’s weights cannot be removed retroactively. Where required by law, we will take reasonable steps to mitigate this (for example, by retraining without the affected data at the next training cycle).

We are exploring an in-product opt-out toggle to make this even easier — until that is shipped, please use the contact channels above.

8.5 Automated decisions and human review (Article 22 GDPR)

The Service uses automated systems to:

• generate CAD outputs from your inputs; and
• apply safety, abuse-prevention, and rate-limiting rules (for example temporarily restricting an account where suspicious behavior is detected).

Material decisions that affect your account (for example a permanent suspension or termination, or removal of your content) are subject to human review before they take effect. Automated rate-limiting or temporary throttling is performed without human review but is reversible and time-limited.

You have the right to obtain human intervention, to express your point of view, and to contest any decision based solely on automated processing that has a legal or similarly significant effect on you. Contact us via the channels in Section 1.

9. Cookies and similar technologies

We use a small number of strictly necessary cookies (for example to keep you signed in and to remember your consent choices). We also use Vercel Web Analytics for cookieless, aggregated/anonymized analytics on the public/marketing pages only. With your consent (collected via CookieYes on the marketing site), we may also use Google Analytics and PostHog for analytics on the public/marketing pages. We do not run marketing analytics on the authenticated dashboard/app.

Vercel states that Web Analytics does not use cookies, does not collect personal identifiers that track end users across different apps or websites, uses a request-derived hash that resets daily, and stores aggregated/anonymized analytics such as page views, referrers, approximate country, browser/OS/device information, and custom events. We do not intentionally send personal data, credentials, tokens, email addresses, project identifiers, or sensitive URL parameters to Vercel Web Analytics, and we will use redaction or event-filtering controls where needed.

PostHog is currently configured for event analytics only (no session replay, no autocapture, no surveys) on PostHog Cloud (EU). Google Analytics is used for measurement only; we do not use Google Analytics for behavioral advertising, retargeting, Google Signals, or ads personalization unless we update this Policy and obtain any consent required by law.

The authenticated app may use browser local storage/session storage for strictly functional UI preferences and workflow state (for example theme, view settings, layout sizes, and ask/build mode). These local preferences are not used for behavioral advertising.

Global Privacy Control (GPC). Where your browser sends a GPC signal (Sec-GPC: 1), our consent management platform (CookieYes) treats that signal as an instruction to withhold consent for non-essential cookies (analytics) on the marketing site, and we do not load those scripts. We treat GPC as a valid opt-out signal under the California Consumer Privacy Act / CPRA for any "sale" or "share" of personal information — although we do not sell or share personal information for cross-context behavioral advertising in any case. For US users: see the US State Privacy Notice for further detail on GPC and your right to opt out.

For more detail, including a representative cookie list, see the Cookie Policy. You can change or withdraw consent at any time via the Cookie Settings link in the footer.

10. Marketing communications

• Service / transactional emails (e.g., billing, security alerts, system notices) are sent on the basis of contract — you cannot unsubscribe from these while you have an account. (Excluded CEMs under §6(6) CASL; transactional under CAN-SPAM.)
• EEA / UK — Marketing newsletters — existing paying customers. Once you become a paying customer, we may send you marketing newsletters about our similar products, features, and offers under the soft-opt-in exemption in Art. 13(2) of the ePrivacy Directive 2002/58/EC (as implemented in Sweden by §19 marknadsföringslagen 2008:486), on the basis of our legitimate interests under Art. 6(1)(f) GDPR. You can opt out at any time — at the point of collection (when you upgrade), or via the one-click unsubscribe link included in every marketing email. We honor opt-outs promptly. To object outside of an unsubscribe link, contact our Privacy Contact (Section 1).
• EEA / UK — Marketing newsletters — free-tier and other non-paying users. We send marketing newsletters to non-paying users only if you have explicitly opted in, on the basis of your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time.
• United States — CAN-SPAM. Marketing emails to US recipients identify themselves as advertising, include our valid postal address, and provide a working unsubscribe mechanism honored within 10 business days in compliance with the CAN-SPAM Act (15 U.S.C. §§ 7701–7713). We rely on your express opt-in or, for existing paying customers, on legitimate interests in informing you of similar products with a clear opt-out at signup and in every email.
• Canada — CASL. CEMs to Canadian electronic addresses are sent only with the consent required by Canada's Anti-Spam Legislation (S.C. 2010, c. 23) — typically express consent that you provide at signup or in your account settings, or limited implied consent under §10(9) CASL (e.g., 24 months after a purchase from us, or for conspicuously published business addresses). Every CEM contains the sender identification, mailing address, and an unsubscribe mechanism that takes effect without delay and within 10 business days. We will not send CEMs to a Canadian address where consent has been withdrawn.
• Common to all flows. Marketing emails are sent via our marketing-email service provider. Every marketing email contains a one-click unsubscribe, and we keep a minimal suppression record (hashed email + opt-out timestamp) to prevent re-mailing.
• Promotional drawings (giveaways). Subscribers to the marketing newsletter in the EEA or UK may also be entered automatically into our recurring promotional drawings — a promotional lottery under §6 of Spellagen 2018:1138 and a marketing activity under marknadsföringslagen 2008:486. No purchase or payment is required to enter, and no purchase increases the chance of winning. Users in the United States and Canada are not currently eligible for the giveaway; see the Giveaway Terms for full eligibility rules. You can withdraw from any future drawing at any time by unsubscribing from the marketing newsletter.
• Future B2B outreach. We may, in the future, conduct limited B2B outreach to business email addresses on the basis of legitimate interests, in compliance with Swedish marketing rules, the ePrivacy Directive, CAN-SPAM (US), and CASL (Canada). We will only contact business addresses for products relevant to the recipient's role, and every message will include an opt-out.

11. Data retention

We keep personal data only for as long as needed for the purpose it was collected, plus any period required by law. The table below summarizes our retention practice.

Category	Retention
Account data (profile, identifiers)	While your account is active. After a verified deletion request or account-deletion event, we delete or anonymize active-system account records within 30 days where technically available, subject to legal, billing, security, and fraud-prevention retention. Residual backup copies are removed through routine backup rotation, typically within a further 30 days.
Projects, messages, prompts, generated outputs	While your account or project is active. After a project deletion or verified account-deletion request, we delete or anonymize active-system project records and private artifacts within 30 days where technically available, subject to legal, security, backup, and dispute-resolution limits.
Free-tier public showcase entries	Until you upgrade to a paid plan, request removal, or delete the project — whichever is first. After that, removed from public view promptly (typically within 7 days).
Billing records (invoices, transaction logs)	7 years after the end of the relevant accounting period (Swedish Bokföringslagen 1999:1078, Chapter 7 §2).
Support tickets and email correspondence	24 months after closure.
Operational logs and security telemetry	Up to 90 days.
Public-site analytics, including Vercel Web Analytics	Aggregated/anonymized analytics may be retained according to the provider dashboard, plan, and settings. We do not use Vercel Web Analytics to build user-level profiles or track visitors across sites.
Backups	Routine backup rotation, up to 30 days.
Marketing email subscription / suppression list	Until you unsubscribe; suppression record kept indefinitely (minimal: hashed email + opt-out timestamp) to prevent re-mailing.
Waitlist records	Until you unsubscribe, ask us to delete the record, or the regional-availability purpose has expired; suppression records may be kept as needed to avoid re-contacting you after opt-out.
Careers inquiries	Generally 24 months after the recruiting process for the relevant role closes, unless a longer period is required by law or you consent to longer retention.
Error monitoring (Sentry, where configured)	Up to 90 days unless a longer period is needed to investigate a security, legal, or reliability incident.
Aggregated/anonymous usage statistics	Indefinitely (no longer personal data once truly anonymized).
Datasets used for AI Service improvement / fine-tuning	Up to 24 months, then deleted or replaced at the next training cycle. Note the technical limitation described in Section 8.4.

We may retain personal data for longer if required to comply with a legal obligation, exercise or defend legal claims, or where retention is necessary for security or fraud prevention.

12. Your rights and how to exercise them

12.1 EEA / UK / Switzerland (GDPR / UK GDPR / Swiss FADP)

If you are in the EEA, the UK, or Switzerland, you have the following rights, subject to applicable conditions and exceptions:

• Right of access (Art. 15) — get a copy of your personal data.
• Right to rectification (Art. 16) — correct inaccurate or incomplete data.
• Right to erasure (Art. 17) — request deletion (subject to legal/contractual limits, including the technical limitation in Section 8.4).
• Right to restriction (Art. 18) — limit how we process your data.
• Right to data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interests, including for AI Service improvement and fine-tuning (Section 8) and for direct marketing (Section 10). For direct marketing, the right is absolute.
• Right to withdraw consent (Art. 7(3)) — for any consent-based processing (analytics cookies, marketing emails). Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Right not to be subject to a decision based solely on automated processing (Art. 22) — see Section 8.5.

12.2 United States — state-law rights (summary)

If you are a resident of a US state with a comprehensive consumer privacy law — currently including (without limitation) California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa (ICDPA), Tennessee (TIPA), Indiana (CDPA), Florida (FDBR), Delaware (DPDPA), New Hampshire (NHPA), New Jersey (NJDPA), Maryland (MODPA), Minnesota (MCDPA), Rhode Island, Nebraska, and Kentucky (and others as they come into effect) — you have rights that may include:

• Right to know / access the categories and specific pieces of personal information we have collected about you;
• Right to delete personal information we hold about you;
• Right to correct inaccurate personal information;
• Right to data portability;
• Right to opt out of "sale" or "sharing" of your personal information (we do not sell or share for cross-context behavioral advertising — see Section 6.4);
• Right to opt out of targeted advertising (we do not engage in targeted advertising);
• Right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects;
• Right to limit the use of sensitive personal information (we do not collect sensitive PI for purposes beyond providing the Service);
• Right to non-discrimination for exercising your rights;
• Right to designate an authorized agent to make requests on your behalf.

We honor Global Privacy Control (GPC) signals as a valid opt-out signal under CCPA/CPRA — see Section 9.

For the full US state-law disclosures, the categories of personal information collected/disclosed (CCPA notice at collection), the "Do Not Sell or Share My Personal Information" statement, the Notice of Right to Limit Use of Sensitive Personal Information, the Notice of Financial Incentive analysis (free tier), Shine the Light disclosures, and instructions for submitting requests including authorized-agent requests, see the US State Privacy Notice.

12.3 Canada — PIPEDA, Quebec Law 25, AB/BC PIPA (summary)

If you are in Canada, you have rights that may include:

• Right of access to your personal information and to know how it has been used and disclosed (PIPEDA Principle 4.9; Law 25 art. 27).
• Right to correction of inaccurate personal information (PIPEDA Principle 4.9.5).
• Right to withdraw consent (PIPEDA Principle 4.3.8).
• Right to data portability (Quebec Law 25 art. 27, in force since September 2024) — the right to receive your computerized personal information in a structured, commonly used technological format.
• Right to cessation of dissemination, de-indexing, and re-indexing of personal information in certain circumstances (Quebec Law 25 art. 28.1).
• Right to be informed and to object to automated decision-making that produces legal or similarly significant effects (Quebec Law 25 art. 12.1).
• Right to know the names and locations of the persons (including subprocessors) that process or have access to your personal information (Quebec Law 25 art. 8).
• Right to lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca, the Commission d'accès à l'information du Québec (CAI) at cai.gouv.qc.ca, the Alberta Office of the Information and Privacy Commissioner at oipc.ab.ca, or the British Columbia Office of the Information and Privacy Commissioner at oipc.bc.ca, as applicable.

For the full Canadian disclosures including PIPEDA's ten Fair Information Principles, Quebec Law 25 specifics, the cross-border transfer notice required by section 17 of Law 25, and the French-language commitment, see the Canadian Privacy Notice.

12.4 How to exercise any of these rights

Submit a request via Support Ticket → Privacy & Compliance. You can also write to us by mail at the address in Section 1.

Identity verification. To protect your data, we may need to verify your identity (or your authority to act on someone else's behalf) before fulfilling certain requests, in line with Article 12(6) GDPR, CCPA Regulation §7060, and equivalent provisions in other US states' regulations. We will not require more information than is reasonably necessary.

Response time.

Region	Standard response	Maximum extension
EEA / UK / Switzerland (GDPR)	1 month	+ 2 months for complex/numerous requests
US — California (CCPA/CPRA)	45 days	+ 45 days with notice
US — Virginia, Colorado, Connecticut, Utah, Texas, and other states	45 days	+ 45 or 60 days depending on state
Canada — PIPEDA	30 days	+ 30 days with notice
Canada — Quebec (Law 25)	30 days	as required by section 32

There is no fee for reasonable requests; we may charge or refuse for manifestly unfounded, excessive, or repetitive requests, or requests that are technically infeasible (in which case we will explain why).

Non-discrimination. We will not deny you the Service, charge you a different price, or provide you with a different level or quality of service because you exercised a privacy right.

Right to lodge a complaint. Without prejudice to any other right, you can complain to your local supervisory or data-protection authority:

• EEA: your national supervisory authority — list at edpb.europa.eu/about-edpb/about-edpb/members. Our lead supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten / IMY) — imy.se.
• UK: Information Commissioner's Office (ICO) — ico.org.uk.
• United States: your state Attorney General; California residents may also contact the California Privacy Protection Agency (CPPA) at cppa.ca.gov.
• Canada: Office of the Privacy Commissioner of Canada — priv.gc.ca; Quebec residents may contact the Commission d'accès à l'information du Québec — cai.gouv.qc.ca; residents of Alberta and BC may contact their respective provincial commissioners.

13. Profiling

We do not engage in profiling for behavioral advertising. We do perform limited profiling for security and abuse-prevention (for example, identifying anomalous request patterns) on the basis of legitimate interests. You can object to processing based on legitimate interests under Article 21 GDPR; see Section 12.

14. Free-tier public showcasing

We offer a free tier of the Service that is supported, in part, by allowing us to publicly display some of the 3D Outputs generated through the free tier (along with the project name) in our public catalog and other marketing materials. We do this:

• to demonstrate the Service’s capabilities;
• to grow the catalog of available reference designs; and
• to support continued availability of the free tier.

What we publish: the generated 3D model and renders, and the project name.

What we will not intentionally publish: your name, email address, profile photo, IP address, billing details, support correspondence, prompts/messages, or other account personal data.

Your control:

• Upgrade to remove. When you upgrade to a paid plan, we stop publicly displaying any of your Outputs and remove previously showcased entries from public view promptly (typically within 7 days).
• Request removal at any time. You can request removal of any specific showcased entry by contacting our Privacy Contact (Section 1), even if you remain on the free tier.
• Avoid identifying project names. Because the project name is published, please avoid using project names that contain personal data (your name, an individual’s name, an email, etc.).

We treat free-tier showcasing as part of the bargain you accept by choosing the free tier. If you do not want any of your Outputs to be public, please use a paid plan.

15. Security

We use administrative, technical, and organizational measures designed to protect personal data, including:

• least-privilege access controls and multi-factor authentication for administrative access;
• encryption in transit (TLS) and encryption at rest where supported by underlying storage;
• monitoring for security events and incident response procedures;
• vulnerability management and dependency review;
• routine backups and disaster-recovery practices;
• vendor due diligence and contractual safeguards.

No method of transmission or storage is fully secure. If a personal data breach affects you, we will notify you without undue delay as required by applicable law:

• EEA / UK / Switzerland: where the breach is likely to result in a high risk to your rights and freedoms, in accordance with Article 34 GDPR.
• United States: in accordance with applicable state breach-notification statutes (for example California Civil Code §1798.82, New York SHIELD Act, Texas Business & Commerce Code §521.053, and equivalents in all 50 US states), within the timeframes those statutes require, and where applicable to the state Attorneys General, the California Privacy Protection Agency, and consumer-reporting agencies as required.
• Canada: where there is a real risk of significant harm, in accordance with PIPEDA's Breach of Security Safeguards Regulations (SOR/2018-64) (notice to affected individuals, the Office of the Privacy Commissioner of Canada, and any third party that may be able to mitigate harm); and for Quebec residents, in accordance with section 3.5 of Law 25 (notice to the Commission d'accès à l'information du Québec and to affected persons where a "confidentiality incident" presents a risk of serious injury).

We maintain a written incident-response plan and a record of every breach as required by these laws.

We do not currently hold third-party security certifications such as ISO 27001 or SOC 2. We carry general business insurance with If P&C Insurance (IF) in Sweden. We are evaluating a US-coverage cyber-liability and Tech E&O policy in connection with our US/Canada launch. This is not a substitute for compliance with applicable law and does not modify our liability under the Terms of Service.

16. Children

The Service is not directed to children or minors. You must be at least 18 years old to use the Service, regardless of any lower digital-consent age in your country. If we become aware that we have collected personal data from a person under 18, we will delete that data without undue delay, subject to legal retention obligations.

United States — COPPA. The Service is not directed to children under 13 and we do not knowingly collect personal information from children under 13 in violation of the Children's Online Privacy Protection Act of 1998 (15 U.S.C. §§ 6501–6506) and its implementing regulations (16 C.F.R. Part 312). If we learn that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will delete that information promptly. If you believe a child under 13 may have provided us with personal information, please contact us via Support Ticket → Privacy & Compliance.

United States — California minors. Although the Service is not available to users under 18, if a California user under 18 has nevertheless publicly posted content through the Service, they may, in accordance with California Business and Professions Code §22581, request removal of that content via the Privacy Contact (Section 1).

Canada. Personal information of minors is treated as sensitive under Canadian privacy law. Quebec Law 25 article 4.1 applies special protections to personal information of minors under 14. We do not knowingly collect personal information from minors under 18.

17. EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) — transparency

17.1 Our role under the AI Act

ZeroEnd Technology AB is a provider of an AI system within the meaning of Article 3(3) of the AI Act: we place the QuantCAD AI system on the market and put it into service under our own name and brand. We are separately a deployer of third-party general-purpose AI models (currently OpenAI and Anthropic), which we access through their APIs and whose documentation we rely on for the underlying models.

We do not develop, own, or train our own general-purpose AI models. Our fine-tuning of third-party models (Section 8) is performed through those providers' platforms and is far below the computational threshold at which a downstream modifier becomes a provider of a general-purpose AI model. We are therefore not a provider of a general-purpose AI model under Chapter V of the AI Act.

17.2 Interaction transparency (Art. 50(1))

QuantCAD is designed and developed so that you are informed that you are interacting with an AI system. A persistent notice is displayed together with the prompt input on both the product-creation screen and the project workspace, and the prompt input itself identifies the AI. This information is presented in plain text at the point of first interaction.

17.3 Synthetic-output marking (Art. 50(2))

Article 50(2) applies to AI systems generating synthetic audio, image, video, or text content. Having regard to the European Commission's Guidelines on the transparency obligations under Article 50 of the AI Act (adopted 20 July 2026), we assess our principal Outputs as falling outside the marking and detection obligation:

• CAD geometry (STEP, STL, and related model data) is not audio, image, video, or text content; and
• generated code and machine-readable configuration (for example replicad/JavaScript build code, recipe data, and schemas) is excluded as source code.

We do not rely on the narrow business-to-business / industrial carve-out described in those Guidelines, because QuantCAD is a publicly available, self-serve Service and Outputs are intended to be exported and used outside your organization.

Where the Service produces free-form explanatory text in the assistant conversation, we keep this assessment under active review and will implement machine-readable marking and a means of detection if and to the extent required. We maintain a documented record of this assessment and make it available to competent authorities on request.

17.4 Emotion recognition, biometric categorisation, and deepfakes (Art. 50(3)–(4))

The Service does not perform emotion recognition or biometric categorisation, and is neither designed nor intended to generate deepfakes. Where we publish AI-assisted text on our public pages, it is subject to human review and editorial responsibility.

17.5 Prohibited practices (Art. 5)

Our Terms of Service prohibit use of the Service for any practice prohibited under Article 5 of the AI Act, as amended. We operate automated safety screening on submitted prompts which is configured to fail closed, and we apply further controls — including content filters and rate limits — before Outputs are returned to you.

17.6 AI literacy (Art. 4)

We take measures to support the development of AI literacy among our staff and other persons operating the Service on our behalf, taking into account their role, technical knowledge, and the context in which the Service is used.

18. Anonymized and aggregated data

We may create aggregated, de-identified, or fully anonymized data from the personal data we hold (for example, total request counts, error-rate statistics, usage trends). Once data is truly anonymized (such that you can no longer be identified, directly or indirectly, by us or anyone else taking reasonable steps), it is no longer personal data and falls outside the scope of GDPR.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new “Last updated” date and version number. For material changes, we will give reasonable advance notice where practicable (for example, by email to account holders or through an in-product notice) before the change takes effect. Where a change requires consent or another specific legal basis, we will obtain it before relying on that processing.

Past versions of this Policy are retained internally and are available on request via Support Ticket — select Privacy & Compliance.

20. Contact and complaints

• Privacy and data-protection questions: Support Ticket → Privacy & Compliance.
• General inquiries / sales / support: Support Ticket.
• Lead supervisory authority: Integritetsskyddsmyndigheten (IMY), Sweden — imy.se.
• All EEA supervisory authorities: edpb.europa.eu/about-edpb/about-edpb/members.
• UK supervisory authority: Information Commissioner’s Office (ICO) — ico.org.uk.