Privacy Policy

1. Important notice and scope

Drawings that you open locally and do not upload are processed on your device. Files or necessary data are sent to our servers only when you actively use cloud drawings, upload, sync, share, collaborate, convert, online diagnostics or other online features.

CAD drawings may contain personal information, trade secrets, engineering information, surveying results or other regulated data. Before uploading or sharing, you must ensure that you have lawful authorization and have fulfilled any notice, consent, approval, declassification and security obligations.

If you provide us with personal information of your employees, customers or partners on behalf of an organization, you warrant that you have a lawful basis to do so.

3. Where your data is stored and international transfer

XCubeCAD and our Chinese-market brand share one service platform. Your account data, cloud drawings and related records are stored and processed on servers located in mainland China, operated by us or by our hosting providers.

If you use the Services from outside mainland China, your personal information is transferred to and processed in China, where data protection laws may differ from those of your country. This transfer is necessary to perform our contract with you, because the Services you request are provided from servers in China. You acknowledge that your information is transferred to and processed in China as described in this policy. Where the law of your country requires additional safeguards, we apply them.

5. System permissions

• Files and storage: used to select, open, save, import and export CAD, PDF, image and other engineering files. On Android, the app may request “All files access” so that you can browse and open drawings in any folder; if you refuse, some local file management features will not be available.
• Camera: requested only when you scan a QR code to join a share or take watermark photos.
• Microphone: requested only when you use voice in shared viewing sessions.
• Location: requested only when you use location watermarks or site records, and may include precise or approximate location.
• Bluetooth and nearby devices: used only when connecting audio devices or when related hardware features require it.
• Other permissions are requested only when the related feature is used. Refusing an optional permission does not stop unrelated features from working, unless the law requires otherwise.

6. Third-party services and SDKs

• Apple App Store and Google Play: subscriptions are sold and charged by Apple or Google under their privacy policies. To link a subscription to your XCubeCAD account, we generate a random account-bound identifier submitted with the purchase, and receive transaction identifiers, product identifiers, purchase and expiry times, environment, subscription status and refund or revocation notifications, used for activation, renewal, restore and reconciliation.
• Cloud infrastructure, object storage, email delivery, content delivery and website hosting providers (our website is served through Cloudflare) process data as necessary for hosting, backup, file transfer, email verification and security protection.
• Umeng+ analytics SDK (Zhejiang Lianxin Technology Co., Ltd., an Alibaba Group company) and Tencent Bugly crash-reporting SDK (Shenzhen Tencent Computer Systems Co., Ltd.): used only if you join “Help improve XCubeCAD”, to process the usage statistics, crash reports and device information described in Section 4. These providers process data on servers in mainland China under their own privacy policies (https://www.umeng.com/page/policy and https://privacy.qq.com/document/preview/fc748b3d96224fdb825ea79e132c1a56). They are not initialized if you do not join, and they stop collecting after you turn the program off (Bugly stops from the next app launch). We do not use them for advertising or cross-app tracking.
• Components for voice, QR scanning, sharing, device information and secure storage work locally or through system capabilities.
• We require third parties by contract, configuration and access control to process information only for agreed purposes. Where a third party provides services to you directly as an independent controller, its processing is also governed by its own privacy policy.

10. Retention and account deletion

• Account and membership data are kept while your account is active and thereafter for the shortest period needed for the purposes of processing. Orders, payment and transaction records are kept as required for tax, accounting and dispute purposes.
• Network, security and sign-in logs are kept for at least six months, as required by the cybersecurity laws of the People’s Republic of China, and then deleted or anonymized unless needed to investigate an incident or resolve a dispute.
• When you delete your account, it is deactivated immediately: you can no longer sign in, active share links you created stop working, and we remove your email address, phone number, password and profile picture from the account and replace your name with an anonymous label. Drawings, annotations and other files you stored in the cloud are retained in deactivated form so that records shared with other users, projects, purchases and audit logs remain consistent; they are no longer accessible through your account. If you want your cloud drawings erased as well, delete them in the app before deleting your account, or email us and we will erase them unless we must keep them to comply with legal, tax or accounting obligations, for security or to resolve disputes.
• To prevent repeated trial claims after account deletion and to handle fraud, security incidents and disputes, hashed identifiers, IP or network segment hashes, claim times and handling results in our trial records may be retained after account deletion for as long as reasonably necessary for these purposes. These records are separated from the deleted account and protected by access controls.
• Residual copies in backup systems are deleted or isolated within the backup rotation cycle.

15. Additional information for users in Brazil (LGPD)

This section applies to the processing of personal data of data subjects located in Brazil and supplements the rest of this Privacy Policy as required by the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, Law No. 13,709/2018, the “LGPD”). If there is any conflict, this section prevails for such processing.

• Controller: the controller (controlador) of your personal data is Guangzhou Tucexin Technology Co., Ltd., Unit D16, Room 680, 6th Floor, Building 2, No. 96 Banhe Road, Huangpu District, Guangzhou, Guangdong Province, People’s Republic of China. We do not have an establishment in Brazil.
• Legal bases (LGPD Article 7): we process personal data (a) as necessary to perform the contract with you or preliminary procedures related to it (Article 7, V), for your account, sign-in, cloud drawings, sharing, shared viewing, subscriptions and support; (b) for our legitimate interests or those of third parties (Article 7, IX), for the security of the Services, license and device checks, prevention of fraud, trial abuse and bulk registration, diagnostics and improvement of the Services, always respecting your fundamental rights and freedoms; (c) to comply with legal or regulatory obligations (Article 7, II), such as keeping tax, accounting and access log records; (d) for the regular exercise of rights in judicial, administrative or arbitration proceedings (Article 7, VI); and (e) with your consent where applicable (Article 7, I), for example for optional permissions such as location, camera and microphone.
• International transfer (LGPD Article 33): as explained in Section 3, your personal data is transferred to and stored in the People’s Republic of China, because the Services you request are provided from servers located there. The transfer is necessary to perform the contract with you (Article 33, IX, in combination with Article 7, V). Specific information about the transfer: the destination country is the People’s Republic of China; the data transferred are the categories described in Section 4; the purposes are those described in this Privacy Policy; the data are kept for the periods described in Section 10; the recipient is the controller itself and the service providers described in Section 6; and the data are protected by the measures described in Section 11. In China, the data are subject to Chinese law, including the Personal Information Protection Law, and may be subject to requests from competent authorities as described in Section 9.
• Your rights (LGPD Article 18): you may request from us (I) confirmation of the existence of processing; (II) access to your data; (III) correction of incomplete, inaccurate or outdated data; (IV) anonymization, blocking or deletion of unnecessary or excessive data, or of data processed in non-compliance with the LGPD; (V) portability of your data to another service or product provider, in accordance with ANPD regulations and subject to our commercial and industrial secrets; (VI) deletion of data processed with your consent, except where retention is permitted by Article 16 of the LGPD; (VII) information about the public and private entities with which we have shared your data; (VIII) information about the possibility of not giving consent and the consequences of refusing; and (IX) revocation of consent. You may also oppose processing carried out on the basis of another legal ground in case of non-compliance with the LGPD, request review of decisions taken solely on the basis of automated processing that affect your interests (Article 20), and petition the National Data Protection Authority (Autoridade Nacional de Proteção de Dados, “ANPD”) or consumer protection bodies regarding your data.
• How to exercise your rights: send your request to support@xcubecad.com from the email address registered to your account, or describe the account concerned. We may verify your identity before acting on a request. Requests are free of charge. Confirmation of the existence of processing or access to your data will be provided in simplified form promptly or, where you ask for a complete statement, within 15 days of your request, as provided by Article 19 of the LGPD. Other requests are answered within the time limits set by applicable law and regulation; if we cannot act on a request immediately, we will tell you the reasons. Many requests can also be handled directly in the app (editing your profile, deleting cloud drawings, deleting your account).
• Communication channel and data protection officer: we are a small-scale processing agent and, under Resolution CD/ANPD No. 2/2022, small-scale processing agents are not required to appoint a data protection officer (encarregado). We provide a communication channel for data subjects and the ANPD at support@xcubecad.com, which receives complaints and communications, provides clarifications and handles requests regarding personal data. We will review this arrangement and appoint an encarregado if we no longer qualify for this exemption.
• Access logs and retention: in addition to the retention periods described in Section 10, application access logs are kept for at least six months, as also required by Article 15 of the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014). Data may be kept after the end of processing in the cases permitted by Article 16 of the LGPD, such as compliance with legal or regulatory obligations.
• Security incidents: if a security incident occurs that may cause relevant risk or damage to data subjects in Brazil, we will notify the ANPD and the affected data subjects in the manner and within the time limits established by applicable regulation.
• Children and adolescents: the Services are not directed to children. Personal data of children under 12 is processed only with the specific consent of at least one parent or legal guardian, and personal data of children and adolescents is processed in their best interest, as provided by Article 14 of the LGPD.

16. Additional information for users in Japan (APPI)

This section applies to the handling of personal information of individuals in Japan and supplements the rest of this Privacy Policy as required by the Act on the Protection of Personal Information (Act No. 57 of 2003, the “APPI”). If there is any conflict, this section prevails for such handling.

• Business operator: Guangzhou Tucexin Technology Co., Ltd., Unit D16, Room 680, 6th Floor, Building 2, No. 96 Banhe Road, Huangpu District, Guangzhou, Guangdong Province, People’s Republic of China, represented by Mo Qinglu.
• Purposes of use: we use personal information for the purposes described in Sections 4 and 5. We will not use it beyond the scope necessary to achieve those purposes without your prior consent, except as permitted by the APPI.
• Provision to third parties in a foreign country (APPI Article 28): as explained in Section 3, the Services are provided from servers in the People’s Republic of China. When you use the Services, your personal information is handled by us in China and provided to service providers located in China that host our servers and databases, deliver verification emails and, if you join “Help improve XCubeCAD”, provide analytics and crash reporting (see Section 6). By agreeing to this Privacy Policy, you consent to this provision. The following information is provided for that purpose.
• Name of the foreign country: the People’s Republic of China.
• Personal information protection system in China: China has a comprehensive personal information protection law, the Personal Information Protection Law (in force since November 1, 2021), together with the Cybersecurity Law and the Data Security Law. The Personal Information Protection Law contains principles comparable to those of the APPI, including notice and consent, purpose limitation, data minimization, security measures, rules on provision to third parties and cross-border transfer, and the rights of individuals to access, copy, correct and delete their information. However, China has not been recognized by the Personal Information Protection Commission of Japan as having a system equivalent to that of Japan, and Chinese law grants government authorities broad powers to request access to data for national security, public security and criminal investigation purposes, for example under the National Intelligence Law. Information on the personal information protection systems of foreign countries is published by the Personal Information Protection Commission (https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/#gaikoku).
• Measures taken by the recipients: our service providers process personal information only under contracts, configurations and access controls that limit processing to the agreed purposes and require confidentiality and appropriate security measures. Umeng+ and Tencent Bugly also handle data under their own privacy policies listed in Section 6.
• Security control measures (APPI Article 23): we have adopted internal rules for handling personal information and designated persons responsible for it (organizational measures); we restrict access to personal information to staff who need it and require confidentiality (personnel measures); servers are located in access-controlled data centers operated by our hosting providers (physical measures); and we use access controls, encryption in transit, password hashing, audit logs and security monitoring (technical measures). Understanding of the external environment: we handle personal information in the People’s Republic of China and take these measures with an understanding of the personal information protection system of China described above.
• Requests for disclosure and other requests: you may request us to notify you of the purposes of use, to disclose retained personal data (including records of provision to third parties), to correct, add to or delete it, to stop using or erase it, or to stop providing it to third parties, as provided by the APPI. Send your request to support@xcubecad.com from the email address registered to your account. We will verify your identity and respond without delay as required by law. We do not currently charge fees for these requests. Many requests can also be handled directly in the app (editing your profile, deleting cloud drawings, deleting your account).
• Complaints: please send questions and complaints about our handling of personal information to support@xcubecad.com.

17. Additional information for users in the Republic of Korea (PIPA)

This section applies to the processing of personal information of data subjects in the Republic of Korea and supplements the rest of this Privacy Policy as required by the Personal Information Protection Act (the “PIPA”). If there is any conflict, this section prevails for such processing.

• Items and purposes of processing: the items of personal information we process and the purposes of processing are described in Sections 4 and 5. We process personal information as necessary to conclude and perform our contract with you, to comply with legal obligations, for our legitimate interests that clearly override your rights, and, for optional permissions and the optional “Help improve XCubeCAD” program, with your consent.
• Overseas transfer (PIPA Article 28-8): the Services are provided from servers in the People’s Republic of China, so transferring your personal information to China is necessary to conclude and perform our contract with you. The details are as follows.
• Items transferred: the items described in Section 4 (account, device, license and security information, drawings and business data, purchase information and, only if you join “Help improve XCubeCAD”, usage statistics and crash reports).
• Destination country, timing and method: the People’s Republic of China; transferred whenever you use features that connect to our servers (sign-in, cloud drawings, sharing, collaboration, purchases and support), over encrypted network connections.
• Recipients and their contact details: (1) Guangzhou Tucexin Technology Co., Ltd., the controller, which stores and processes the information on servers in China (contact: support@xcubecad.com); (2) Alibaba Cloud (Aliyun Computing Co., Ltd.), for cloud servers, databases, storage and verification email delivery (https://www.aliyun.com); (3) only if you join “Help improve XCubeCAD”, Zhejiang Lianxin Technology Co., Ltd. (Umeng+) and Shenzhen Tencent Computer Systems Co., Ltd. (Tencent Bugly), whose privacy policies are listed in Section 6.
• Purpose of use and retention by the recipients: the recipients use the information only for the purposes described in this Privacy Policy and keep it for the periods described in Section 10.
• How to refuse the transfer and its effect: you can refuse the transfer by not creating an account or not using online features, by turning off “Help improve XCubeCAD” in Settings → Privacy, or by deleting your account. Because the Services are provided from servers in China, features that require an account or our servers cannot be provided if you refuse the transfer.
• Destruction (PIPA Article 21): when the purpose of processing has been achieved or the retention period has expired, we destroy personal information without delay, unless we are required to keep it by law. Electronic files are deleted using technical methods that make them irrecoverable, and printed records, if any, are shredded or incinerated. Information we must keep by law is stored separately from other personal information.
• Your rights: you or your legal representative may request access to, correction or deletion of, or suspension of processing of your personal information, and may withdraw consent, as provided by the PIPA. You can make requests in the app or by email to support@xcubecad.com. We will respond within 10 days of receiving a request, or explain the reason if we cannot. Personal information of children under 14 is processed only with the consent of their legal representative.
• Privacy officer (PIPA Article 31): our Chief Privacy Officer is the head of our Privacy Office, who can be contacted at support@xcubecad.com.
• Domestic representative (PIPA Article 31-2): we do not currently meet the criteria that require a foreign business to designate a domestic representative in Korea. We will designate one and publish its details in this policy if we meet those criteria.
• Remedies: in addition to contacting us, you may seek help from the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972), the Personal Information Infringement Report Center of the Korea Internet & Security Agency (privacy.kisa.or.kr, 118), the Supreme Prosecutors’ Office (www.spo.go.kr, 1301) or the Korean National Police Agency (ecrm.police.go.kr, 182).