US State Privacy Notice

1. Who this notice applies to and how it relates to our Privacy Policy

This US State Privacy Notice supplements and forms part of our Privacy Policy. It applies to residents of US states that have enacted comprehensive consumer-privacy laws and gives you the additional disclosures and rights those laws require.

The Service is provided by ZeroEnd Technology AB (Sweden), doing business as QuantCAD. We are the entity that determines the purposes and means of processing your personal information; under US state laws we are the "business" (California), "controller" (most other states), or equivalent.

Current availability. New account creation and self-serve purchases are not currently available to visitors located in the United States. US visitors who attempt to sign up are redirected to our waitlist. This notice therefore applies today primarily to public-site, cookie, waitlist, contact, marketing, legal-notice, and any existing-account interactions, and it is also prepared for a future US launch.

Some US state privacy laws apply only if a business meets statutory thresholds (for example revenue, number of residents whose personal information is processed, or percentage of revenue from selling personal information). This notice is not an admission that every listed statute applies to us in every circumstance. Where a statute does not legally apply, we may still choose to honor a request voluntarily, but doing so does not waive any legal position, defense, or exception.

If you are a resident of a state listed below, the rights described in Section 5 apply to you to the extent your state's law applies to us and to your personal information. If you are in a state not listed below, you may still exercise the general rights described in Privacy Policy §12.

States covered by this notice (as of the Last Updated date), and the underlying statute:

State	Statute (commonly cited)
California	California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA"), Cal. Civ. Code §§ 1798.100 et seq.
Virginia	Virginia Consumer Data Protection Act ("VCDPA"), Va. Code § 59.1-575 et seq.
Colorado	Colorado Privacy Act ("CPA"), C.R.S. § 6-1-1301 et seq.
Connecticut	Connecticut Data Privacy Act ("CTDPA"), Conn. Gen. Stat. § 42-515 et seq.
Utah	Utah Consumer Privacy Act ("UCPA"), Utah Code § 13-61-101 et seq.
Texas	Texas Data Privacy and Security Act ("TDPSA"), Tex. Bus. & Com. Code § 541.001 et seq.
Oregon	Oregon Consumer Privacy Act ("OCPA")
Montana	Montana Consumer Data Privacy Act ("MCDPA-MT")
Iowa	Iowa Consumer Data Protection Act ("Iowa CDPA")
Tennessee	Tennessee Information Protection Act ("TIPA")
Indiana	Indiana Consumer Data Protection Act ("Indiana CDPA")
Florida	Florida Digital Bill of Rights ("FDBR") (note: applies primarily to large in-state controllers)
Delaware	Delaware Personal Data Privacy Act ("DPDPA")
New Hampshire	New Hampshire Privacy Act / Expectation of Privacy Act ("NHPA")
New Jersey	New Jersey Data Privacy Act ("NJDPA")
Maryland	Maryland Online Data Privacy Act ("MODPA")
Minnesota	Minnesota Consumer Data Privacy Act ("MCDPA-MN")
Rhode Island	Rhode Island Data Transparency and Privacy Protection Act ("RIDTPPA")
Nebraska	Nebraska Data Privacy Act ("NDPA")
Kentucky	Kentucky Consumer Data Protection Act ("KCDPA")

If your state enacts a comprehensive consumer-privacy law that comes into effect after the Last Updated date, this notice will be updated to reflect that. We aim to treat requests consistently with the most protective applicable requirements where the law applies and where doing so is operationally feasible.

2. Categories of personal information we collect (CCPA notice at collection)

In the 12 months preceding the date of this notice, we collected (or may have collected) the following categories of personal information about US residents, in line with the categories enumerated in Cal. Civ. Code § 1798.140(v):

Category (CCPA)	Examples we collect	Sources	Business / commercial purpose
A. Identifiers	Name (where you provide it), username, account ID (where applicable), email address, IP address, online identifiers, device identifiers	You; Clerk (auth provider, where applicable); your browser/device	Waitlist/contact handling, account creation where available, authentication, security, communications, billing where applicable
B. Customer-record information (Cal. Civ. Code § 1798.80(e))	Name, email, payment-card-related identifiers (we never store full card numbers)	You; Stripe (independent controller for payments)	Billing, subscription management
C. Protected classifications	None — we do not collect	—	—
D. Commercial information	Subscription plan, billing history, credit balance, transactional records	Stripe; our systems	Billing, subscription management, support
E. Biometric information	None	—	—
F. Internet / electronic-network activity	Pages viewed on the marketing site; referrers; approximate country; browser/OS/device information; engagement events; session/sign-in metadata; error/usage telemetry	You; your browser; Vercel Web Analytics; PostHog (EU); Google Analytics (with consent)	Site analytics on the marketing site only; security; reliability engineering
G. Geolocation	Coarse country-level location only (from request headers / IP) for the geo-eligibility gate at sign-up	Your browser; CDN edge headers (e.g., x-vercel-ip-country)	Enforce geographic availability of the Service
H. Sensory information	None	—	—
I. Professional / employment	Optional company name in support submissions	You	Support and sales
J. Education information	None	—	—
K. Inferences	Limited security/abuse signals (e.g., anomalous request patterns)	Our systems	Security, abuse prevention
L. Sensitive personal information	Limited SPI may be processed only where necessary to provide and secure the Service, such as account log-in credentials handled by Clerk, coarse country/region signals for geo-eligibility, and any SPI you choose to include in prompts, messages, project names, support tickets, or attachments. We do not intentionally request health, biometric, racial/ethnic, precise geolocation, government ID, financial account access, union, religious, sexual-orientation, or similar SPI.	You; Clerk; your browser/device	Authentication, security, compliance, and providing the Service only

Inputs you submit (prompts, messages, project content, attachments). Because you control what you put into the Service, your Inputs may incidentally contain personal information, including SPI. Please do not submit SPI or special-category data to the Service (Privacy Policy §4.3).

Retention at collection. We retain each category only for as long as reasonably necessary for the disclosed purpose, subject to legal, security, billing, and dispute-resolution requirements. The category-specific retention criteria are in Privacy Policy §11. In summary: account data is kept while your account is active; billing records are generally kept for 7 years; support correspondence for 24 months after closure; operational logs/security telemetry for up to 90 days; backups for up to 30 days; marketing records until unsubscribe plus suppression records as needed; and AI service-improvement datasets for up to 24 months where permitted and not opted out.

No sale/share at collection. We do not sell these categories of personal information, share them for cross-context behavioral advertising, or process them for targeted advertising.

3. Purposes — why we use your personal information

We use the categories above for the business and commercial purposes described in Privacy Policy §5, including:

• providing, maintaining, and securing the Service;
• account creation, authentication, and management;
• generating CAD outputs based on your inputs (which involves sending inputs to AI providers — see Privacy Policy §8);
• billing, subscription management, and tax compliance;
• support and communications;
• service improvement, including human review and fine-tuning of third-party AI models as described in Privacy Policy §8.3 (you may opt out — see Section 5(c) below and Privacy Policy §8.4);
• security, fraud, and abuse prevention;
• complying with applicable laws and responding to lawful requests; and
• conducting marketing — see Section 7 below.

We do not use personal information for purposes that are materially different from, or unrelated or incompatible with, the purposes for which we collected it without first providing you notice and (where required) obtaining your consent.

4. Disclosures of personal information

In the 12 months preceding the date of this notice, we disclosed personal information to the categories of recipients listed in Privacy Policy §6.1 (sub-processors and independent controllers such as Stripe). Each recipient is bound by either a written processing agreement, an independent-controller agreement (Stripe for payments and fraud), or our standard service contracts containing confidentiality obligations.

We do not "sell" or "share" personal information. As described in Section 6 below and Privacy Policy §6.4, we do not engage in any activity that constitutes a "sale" or "sharing for cross-context behavioral advertising" under CCPA/CPRA, "sale" or "targeted advertising" under VCDPA/CPA/CTDPA/UCPA/TDPSA/OCPA/MCDPA/Iowa CDPA/TIPA/FDBR/DPDPA/NHPA/NJDPA/MODPA/MCDPA-MN/RIDTPPA/Nebraska NDPA/KCDPA/Indiana CDPA, or analogous concepts under any other applicable state law. We also do not disclose sensitive personal information for purposes that would require a separate California "Limit the Use of My Sensitive Personal Information" link.

We disclose for a business purpose to the categories of service providers and contractors listed in Privacy Policy §6.1.

5. Your rights

Subject to verification (Section 9) and the limited exceptions in your state's law, you have the rights below. Where the same right exists under multiple statutes with different names (e.g., "right to delete" under CCPA and "right to deletion" under VCDPA), we treat them as a single right and respond consistently.

(a) Right to know / access. You may request that we disclose to you (i) the categories of personal information we collected about you, (ii) the categories of sources, (iii) the business or commercial purposes for collection, (iv) the categories of third parties to whom we disclosed it, and (v) the specific pieces of personal information we have about you. (Specific-pieces disclosures are limited to information collected within the 12 months before the request, except for California residents, who may request disclosures beyond 12 months under § 1798.130(a)(2)(B), subject to feasibility.)

(b) Right to delete. You may request deletion of personal information we collected from you, subject to statutory exceptions (e.g., legal-compliance records, completion of a transaction, security, fraud prevention).

(c) Right to correct. You may request correction of inaccurate personal information. Where we cannot independently verify the accuracy of the data, we will document your assertion and treat your version as authoritative going forward to the extent reasonable.

(d) Right to data portability. You may request a copy of your personal information in a portable, structured, commonly used, and machine-readable format.

(e) Right to opt out of "sale" and "sharing" / targeted advertising. We do not sell or share personal information for cross-context behavioral advertising and we do not engage in targeted advertising. Even though there is nothing to opt out of today, we honor any opt-out request as a binding instruction not to engage in those activities going forward, including any Global Privacy Control (GPC) signal sent by your browser. See Section 6.

(f) Right to opt out of profiling that produces legal or similarly significant effects. We do not engage in such profiling.

(g) Right to limit use of sensitive personal information. We do not use SPI beyond purposes permitted under Cal. Civ. Code § 1798.121(a) (e.g., to perform the Services you requested, to detect security incidents, to ensure short-term transient interactions). You may nonetheless ask us to limit, and we will treat any such request as a binding restriction.

(h) Right to non-discrimination. We will not deny you the Service, charge different prices, or provide a different level or quality of service because you exercised any of these rights. The free-tier showcasing described in Privacy Policy §14 is a disclosed feature of a separate free product tier. Any product-tier difference is intended to be reasonably related to the value of the tier and the operational cost of providing it, and you can stop showcasing by upgrading or requesting removal as described in Section 8.3.

(i) Right to designate an authorized agent. You may designate an authorized agent to make a request on your behalf. We will require (i) written, signed permission from you, (ii) verification of the agent's identity, and (iii) verification of your identity (Section 9), unless you have provided your agent with a power of attorney sufficient under your state's law.

(j) Right to appeal. Residents of states whose statute provides an appeal right (Virginia, Colorado, Connecticut, Texas, Montana, Tennessee, and others) may appeal a denial of a request by responding to our denial within 45 days via Support Ticket → Privacy & Compliance, with subject line "Privacy Right Appeal". We will respond within 45–60 days depending on your state. If your appeal is denied, we will provide you with a written explanation and information about how to contact your state Attorney General to file a complaint.

6. "Do Not Sell or Share My Personal Information" / Global Privacy Control (GPC)

We do not sell or share personal information. Notwithstanding that, this section serves as our "Do Not Sell or Share My Personal Information" notice as required by Cal. Civ. Code § 1798.135 and the equivalents in other states.

To exercise the right to opt out of "sale" or "sharing" / targeted advertising:

• Submit a request via Support Ticket → Privacy & Compliance, with subject line "Do Not Sell or Share", or
• Send a Global Privacy Control (GPC) signal from your browser. We honor GPC signals as a valid opt-out at the cookie/script-loading layer through our consent-management platform (CookieYes); see Cookie Policy §4.1. Because we do not engage in "sale," "sharing," or targeted advertising in the first place, GPC compliance is limited to preventing non-essential analytics scripts from loading and recording your opt-out instruction for future sale/share/targeted-advertising processing.

We will treat any opt-out request as binding for as long as you remain opted out, and we will not "sell" or "share" your personal information after the request unless you affirmatively re-opt-in. Where required, we will provide a way to confirm that an opt-out request or opt-out preference signal has been honored (for example through the consent interface, privacy settings, or a response to your Support Ticket). This confirmation mechanism must be verified in the live CookieYes/account configuration before any California launch that relies on automated GPC handling.

7. Marketing communications (US)

We send marketing emails to US recipients in compliance with the CAN-SPAM Act of 2003 (15 U.S.C. §§ 7701–7713). Every marketing email contains a clear-and-conspicuous identification that it is an advertisement, our valid postal address, and a functioning unsubscribe mechanism that we honor within 10 business days. See Privacy Policy §4.7 and §10.

We do not engage in cross-context behavioral advertising; we do not retarget you on third-party ad networks; and we do not provide your email address to third parties for their own marketing. See Section 8 for California "Shine the Light".

8. California-specific disclosures

8.1 California "Shine the Light" (Cal. Civ. Code § 1798.83)

California residents may request, once per calendar year, information about the categories of personal information we have shared with third parties for those third parties' own direct-marketing purposes during the preceding calendar year, and the names and addresses of those third parties.

Our disclosure: in the preceding calendar year and on a continuing basis, we have not shared personal information with third parties for those third parties' own direct-marketing purposes. We do not anticipate doing so. To submit a Shine the Light request, contact us via Support Ticket → Privacy & Compliance, with subject line "California Shine the Light Request".

8.2 Notice of Right to Limit Use of Sensitive Personal Information

We do not use SPI for purposes beyond providing the Service and short-term operational uses permitted by Cal. Civ. Code § 1798.121(a). You can nonetheless submit a request to limit our use of SPI via the contact channel in Section 11.

8.3 Notice of Financial Incentive (Cal. Civ. Code § 1798.125(b))

Our free tier could be characterized as a "financial incentive," "price or service difference," or similar program to the extent it is provided in exchange for the limited public showcasing of free-tier 3D Outputs and project names described in Privacy Policy §14. We do not sell or share personal information in connection with this program. To the extent the CCPA/CPRA or another state law treats the free tier as a financial incentive or price/service difference:

• Material terms: we offer a free tier that lets you generate CAD outputs at no monetary cost. In exchange, we may publicly display Outputs and project names generated through the free tier in our public catalog. We will not intentionally publish your name, email, IP, billing details, prompts/messages, support correspondence, or other account personal data. Because project names are published, avoid using project names that contain personal data, confidential information, trade secrets, or third-party proprietary information. You may opt out at any time by upgrading to a paid plan or by contacting us under Privacy Policy §14.
• How to opt in: the free tier is opt-in (you choose to use it after reviewing the applicable notices). We should not default a California consumer into a financial-incentive program where a separate opt-in is required by applicable law.
• How to withdraw: upgrade to any paid plan, or request removal as described in Privacy Policy §14.
• Good-faith estimate of value and method. The personal information we expect to receive for public showcasing is limited to a project name (which we ask you to keep generic) and the associated Output. We estimate the value of that personal information to us based on the marginal marketing/reputational value of publicly demonstrating Service capabilities, less the operational cost of providing free generations and hosting the showcased content. We do not currently have a reliable individualized dollar value for any one project name or Output; we believe the value to us is low and not reasonably capable of precise calculation. We provide this notice for transparency and to allow you to choose a paid plan or request removal if you do not want free-tier Outputs showcased.

8.4 California 2026 regulations — risk assessments, cybersecurity audits, and ADMT

California regulations effective in 2026 impose additional obligations for covered businesses engaging in certain higher-risk processing, including risk assessments, cybersecurity audits, and automated decision-making technology ("ADMT") disclosures or opt-outs in specified contexts. Based on the Service as described in the Privacy Policy, we do not currently use ADMT to make employment, housing, credit, education, healthcare, or similar significant decisions about California consumers. Before introducing any covered ADMT, sale/sharing, targeted advertising, or sensitive-data processing that triggers these obligations, we will complete the required assessment and update this notice and any point-of-collection notices.

8.5 California minors

Although the Service is not available to users under 18, if a California user under 18 has nevertheless publicly posted content through the Service, they may, in accordance with Cal. Bus. & Prof. Code § 22581, request removal of that content. Submit such requests via Support Ticket → Privacy & Compliance, identifying yourself as a California minor and identifying the content.

8.6 Annual metrics (Cal. Civ. Code § 1798.130(a)(5)(B))

We are not currently required to publish annual privacy-request metrics under California law because we do not buy, sell, or share the personal information of 10,000,000 or more California residents in a calendar year. We will publish such metrics here if and when we cross that threshold.

9. Identity verification and how to submit a request

How to submit a request. Use Support Ticket → Privacy & Compliance, with subject line indicating the right you are exercising (e.g., "CCPA Right to Know", "CCPA Right to Delete", "Do Not Sell or Share", "California Shine the Light", "Privacy Right Appeal"). You may also write to us by mail at the address in Legal Notices.

Identity verification. To protect your data, we may need to verify (a) your identity, and (b) where applicable, the authority of an agent acting on your behalf. We will not require more information than is reasonably necessary to verify, in line with the verification regulations of your state (e.g., 11 C.C.R. § 7060 et seq. for California). Typical verification: we will ask you to confirm information you previously provided to us (such as the email address on your account) and may send a confirmation link to that address.

Response time. We respond within 45 days of a verifiable request (California, Virginia, Colorado, Connecticut, Texas, and others), extendable by up to 45 additional days with notice if reasonably necessary, in compliance with each state's deadlines. Opt-out requests that do not require identity verification are processed as soon as reasonably practicable and within the shorter statutory deadline that applies to the state and request type.

Fees. We do not charge a fee for reasonable requests. We may charge a reasonable fee or refuse to act on a manifestly unfounded, excessive, or repetitive request, in which case we will explain why.

10. Categories of "third parties" and "service providers" / "contractors"

For the purposes of CCPA/CPRA terminology:

• "Third parties" to whom we sell or share personal information: none.
• "Service providers" and "contractors": the sub-processors and vendors listed in Privacy Policy §6.1 and Annex 3 of the Data Processing Agreement (categories: application hosting/CDN/edge platform, authentication, payments (Stripe is an independent controller for payments and fraud, not a service provider for those purposes), database, object storage, workflow orchestration, sandbox compute, rate limiting, marketing-site analytics including Vercel Web Analytics, cookie consent, transactional and marketing/waitlist email delivery, error monitoring where configured, AI processing).

11. Contact

For privacy questions, requests, and complaints under any US state law, contact:

• Privacy Contact: Support Ticket → Privacy & Compliance (preferred).
• Mail: ZeroEnd Technology AB, Privacy Contact, Järpvägen 41B, 75653 Uppsala, Sweden.
• California Attorney General: oag.ca.gov/privacy.
• California Privacy Protection Agency (CPPA): cppa.ca.gov.
• Other state Attorneys General: see your state's official site.

12. Changes to this notice

We may update this notice from time to time. Material changes will be announced on this page with a new "Last updated" date and version number. Past versions are retained internally and are available on request via Support Ticket → Privacy & Compliance.