Privacy & Data Retention Policy

This policy explains what personal data GoModl (“GoModl”, “we”, “us”) collects through the gomodl website and application, why, who we share it with, how long we keep it, and your rights. We are the controller of that data under the UK General Data Protection Regulation, the Data Protection Act 2018 and, where it applies to you, the EU GDPR. You agree to this policy when you create an account.

Contact for anything in this policy, including requests to use your rights: hello@gomodl.com.

1. What we collect

Your account

• Email address and screen name.
• Your password, stored only as a one-way bcrypt hash — we never see or store the password itself.
• When you signed up and last signed in, whether your email is verified, and whether you hold a modelling seat.
• When you agreed to these documents, and which version.

Settings you enter

• Company and drawing-office details printed on your sheets — company name, address, phone, email, website, social profile links, logo, default “drawn by” name and drawing notes.
• Display preferences such as theme, paper size and plot style.
• AI provider API keys, only if you choose to save them to your account. They are encrypted (AES-256-GCM) before they are stored and are never sent back in ordinary settings requests.

Your projects

• Models (stored as IFC files), project names, descriptions, site names and author names.
• Issued freezes: revision, purpose, notes, “revised by” name, preview images and share cards.
• Your libraries: bolts, welds, copes, wall build-ups, custom sections and connection configurations.
• Drawing sets you upload to the Drawing Library (PDF or DXF) and the images and text extracted from them.

Models and drawings can contain other people’s personal data — for example names in title blocks, RFIs or notes. You are responsible for having a lawful basis to put it there.

The interest form on this website

• Name, work email, company, role, the plan you are interested in, and any notes you add.

Technical data

• Server logs of requests to the application, which include your IP address, the time, the address requested and the response. These are used to keep the Service running and secure.
• Visit statistics for this website and the application, collected by our own self-hosted analytics (Umami): the page visited, the referring page, browser, operating system, device type, screen size, language, and the country, region and city worked out from your IP address. Your IP address itself is not stored, no cookies are set, and the figures are only ever viewed in total.

We do not use advertising or analytics cookies, and we do not track you across other websites.

2. Why we use it, and our lawful basis

3. What becomes public

A freeze you issue as Public is visible to anyone and listed in the public gallery, searchable by project, contract, client and company, with its preview images, model and drawings. An Unlisted freeze is visible to anyone with its link, and a password freeze to anyone with its link and password. Downloading files from any freeze needs a free account. Once someone has downloaded a file we cannot recall it.

Your working models, and freezes you have not shared, stay private to you. A project’s name, description, site, author and preview image can be read by anyone who has that project’s link (an unguessable identifier), so that shared freezes can display them — do not put anything in those fields you would not want someone with the link to see.

4. The AI assistant

The AI assistant is optional. When you use it, your message, a summary of the open model (members, sections, grids, levels, selections and connection settings) and any files you attach are sent to the AI provider you have chosen, using the API key you supplied, and handled under that provider’s own terms and privacy policy. Requests to hosted providers pass through our server so your key is not exposed to the page; we do not keep the messages or attachments. Requests to a model running on your own machine or network go directly from your browser and never reach us. Your chat history is stored in your own browser, not on our servers.

5. Who we share it with

We do not sell your personal data. We share it only with:

• Service providers who process it for us — the providers of the servers, storage and database that host the Service, and the email delivery service that sends account emails. They act on our instructions under contract.
• Google Fonts — this website loads its typefaces from Google, which receives your IP address when a page loads.
• The AI provider you choose, as described in section 4, and only when you use the assistant.
• Anyone you share a freeze with, as described in section 3.
• Authorities or others where the law requires it, or to protect our rights or the safety of others, and a buyer of the Service if the business is transferred.

6. International transfers

Some providers, including AI providers and Google, may process data outside the UK and the European Economic Area. Where we transfer personal data, we rely on UK adequacy regulations or on the standard contractual clauses (with the UK addendum) as appropriate. Transfers to an AI provider you choose happen at your request and under your own agreement with that provider.

7. Storage on your device

The website and application use your browser’s local storage, not tracking cookies, for things that make them work: keeping you signed in, your theme and display preferences, your AI chat history and (if you choose) AI keys on that device, and a copy of anything you submit through the interest form. These are strictly necessary for features you use, so we do not ask for separate consent. Clearing your browser’s site data removes them.

8. How long we keep it

Where data is held in backups, deleted data is removed as those backups are replaced in the normal cycle and is not restored into the live Service. There is no service level agreement for the Service (see the Terms and Conditions), so please keep your own copies of anything you need — deletion is permanent.

9. Security

Connections to the Service are encrypted in transit. Passwords are hashed, AI keys saved to your account are encrypted, and access to your models is checked on every request. No system is perfectly secure; if a breach affects your personal data in a way that is likely to put your rights at risk, we will tell you and the regulator as the law requires.

10. Your rights

Under the UK GDPR (and the EU GDPR where it applies) you have the right to:

• access the personal data we hold about you;
• correct it if it is wrong (you can change your screen name and settings yourself);
• erase it, including closing your account;
• restrict or object to how we use it, including where we rely on legitimate interests;
• portability — you can download your models as IFC files at any time, and we will send your account data in a machine-readable format on request;
• withdraw consent to product updates at any time, without affecting anything before;
• complain to the Information Commissioner’s Office (ico.org.uk) or, in the EU, your local data protection authority. We would appreciate the chance to put things right first.

Email hello@gomodl.com from the address on your account. We will reply within one month, and may need to confirm your identity first.

11. Children

The Service is for professional use by adults. We do not knowingly collect data from anyone under 18.

12. Changes to this policy

We will update this policy when what we do changes. Each version is dated at the top of this page, and we will tell you by email or in the application about material changes before they take effect.