Privacy policy

1. Who processes your data

RenderThink (RENDERTHINK SAS, SIRET 102 977 147 00010, 17 rue Louis Pasteur, 38400 Saint-Martin-d’Hères, France), the publisher of DrawThink, is the controller for the data relating to accounts, workspaces, subscriptions, support and use of the service.

Data about a kitchen designer’s own customers, contained in its InSitu or KitchenDraw projects and in what the service keeps of them, is processed on behalf of that kitchen designer, who is the controller, with RenderThink acting as its processor. For such data, please contact the kitchen designer first.

RenderThink’s commitments as a processor are set out in our data processing agreement

RenderThink has not appointed a data protection officer; any question about your data can be sent to contact@drawthink.app.

2. Data we process

3. What passes through without being kept

The InSitu and KitchenDraw scenes your assistant reads or changes, and the quotations and images it requests (plans, elevations, perspective views), pass through our servers to be delivered to it. They stay there only for the time of that delivery, ten minutes at most, and are never recorded in our database or in our file storage. Only the project data described in section 2 is kept.

The tools do not read, on their own initiative, your customers’ contact details held by the design software (address, phone number, email): your assistant only receives them if you give them to it or have it read them. The name of a project and its customer reference, which often name your customer, do reach it when it lists or opens your projects.

Your project files stay on your PC. The plugin keeps a technical log without content and a cache of the 3D objects of your library there, which it does not send to us; it only reports its failures to the server, as a code.

4. Purposes and legal bases

Performance of the contract:

creating and managing your account, workspace, licences and PCs; running the connector, the plugin, the assistant memory, project data and the 3D object library; managing the subscription, its discounts and any free access; answering your support requests.

Legal obligation:

invoicing, accounting and retention of invoices; responding to requests from authorities.

Legitimate interest:

securing the service and preventing fraud (sessions, connection history, rate limits, team log, fingerprint of a trial card); detecting and fixing errors; improving the tools based on the tool call log; measuring, on the server side, the steps of the journey to improve the service.

Consent:

audience measurement in your browser (cookies and session recording), which you can withdraw at any time with “Manage cookies”.

We do not use your data for advertising, and we do not sell or rent it. RenderThink does not use it to train any artificial intelligence model. The service takes no decision producing legal effects concerning you based solely on automated processing.

5. Recipients

6. Transfers outside the European Union

The service and its database are hosted in France, with OVHcloud, the 3D object files in the European Union, and a copy of the database backups in Western Europe. Some service providers (Stripe, Resend, PostHog, Cloudflare, Google, Microsoft) belong to groups established outside the European Union, in particular in the United States, and may process certain data there. Such transfers are covered by the safeguards provided for by the GDPR: a European Commission adequacy decision, such as the one for the EU-U.S. Data Privacy Framework, or standard contractual clauses.

The data you have your AI assistant read is sent to its publisher, possibly outside the European Union, at your request and under the safeguards of your contract with that publisher.

7. Retention periods

Account, memory, settings and authorized assistants:

for as long as the account exists; a memory entry, a setting or an assistant you remove is erased at once, and deleting the account erases the rest (section 9).

Workspace, team and subscription:

for as long as the workspace exists; it is erased with its owner’s account when the owner is its only member.

Authorized PCs:

for as long as the account exists; a removed PC remains in the account’s history.

Project data and 3D object library:

for as long as the workspace exists, including after the subscription ends, so that you can resume or export your projects; an object removed from the library is erased at once with its files. Without a workspace, they are kept in your name for as long as the account exists.

Learned style:

until you ask your assistant to forget it, or you reset your memory.

Sketchfab key:

until you remove your Sketchfab account, or until the account is deleted.

File sent for preparation:

erased as soon as the preparation has read it; an interrupted upload is then erased automatically.

Scenes, quotations and images read by the assistant:

ten minutes at most, the time it takes to deliver them (section 3).

Support requests:

for as long as the account exists.

Tool call log:

90 days.

Team log:

1 year; when an account is deleted, its entries remain without naming it.

Connection history:

1 year from the start of each connection; it is erased with the account.

Sessions:

until they end, at the latest 7 days after their last use, or until you sign out; an expired session is erased within the hour.

Rate limits:

one hour at most.

Technical logs:

180 days.

Audience and journey measurement:

events, 1 year; session recordings, 30 days; the visit identifier, 1 year at most; your answer to the cookie banner, 13 months.

Database backups:

one per night, kept seven days on the server and thirty days in their off-server copy; erased data disappears from them when they are renewed.

Emails written to contact@drawthink.app:

for the time needed to handle your request and its follow-up.

Invoices and accounting records:

10 years, as required by the French Commercial Code; they remain with Stripe, even after the account is deleted.

Fingerprint of a trial card:

with no time limit, even after the account is deleted, so that the same card can only open one trial.

When the subscription ends, access to the service closes, but your account and your workspace remain, with their data: you can export your data from your workspace, subscribe again, or have your account deleted at any time by asking support from your workspace.

8. Security

• Encryption of all communications (HTTPS and TLS) between your browser, the plugin, your assistant and our servers
• Hashed passwords; two-factor authentication; two-factor secret, backup codes and Sketchfab key encrypted at rest; limits on attempts and request rates
• PCs authenticated by a key specific to the workstation, created by the plugin and kept by Windows without allowing it to be exported; instructions signed by our servers and verified by the plugin, which also verifies the signature of each of its updates
• Rights re-checked on every call from an assistant; a removed PC or assistant loses access immediately
• Each workspace’s data kept separate: the owner is checked in every request
• 3D models from the Internet prepared in an isolated process, with no network or database access
• Hosting in France, 3D object files in the European Union; team console restricted to its members, with two-factor authentication, and every change logged

In the event of a personal data breach that poses a risk to your rights, we notify the CNIL (the French data protection authority) within 72 hours and inform you where the law requires it.

9. Your rights

Access:

obtain a copy of your data; the export in My account provides most of it, and we answer any broader request.

Rectification:

have inaccurate data corrected: your memory, your settings and the names of your PCs can be corrected from your workspace, everything else on request to support.

Erasure:

have your account deleted by asking support from your workspace (My account, “Request deletion”), or at contact@drawthink.app. We check your identity and settle your subscription before erasing anything: the owner of a team first removes its members and invitations, and an ongoing subscription must have been cancelled. Deletion erases your account and everything that depends on it, as well as the workspace of which you are the only member, with its projects and library; the 3D objects a member prepared remain in the workspace, without their name. Invoices with Stripe, the team log without your name and the fingerprint of a trial card remain. An email confirms the deletion.

Everyday erasure:

you erase a memory entry, your whole memory, a 3D object, a PC or an assistant yourself, from your workspace.

Portability:

download your data from My account, as a structured file (JSON): account, workspace, PCs, assistants, memory and settings, support requests, tool call log, connection history, and project data and the 3D object library, without their files (for the owner, those of the workspace; for a member, the objects they prepared). Never a password, a secret, a session or an IP address.

Restriction and objection:

ask for processing to be restricted, or object, on grounds relating to your particular situation, to processing based on our legitimate interest.

Post-mortem instructions:

set instructions on what happens to your data after your death.

To exercise your rights, write to contact@drawthink.app stating the right you wish to exercise. We reply within one month, which the law allows to be extended for complex requests. If you are a customer of a kitchen designer, please send your request to them first; we will help them answer it.

If you believe your rights are not being respected, you may lodge a complaint with the CNIL (Commission nationale de l’informatique et des libertés), https://www.cnil.fr.

10. Cookies

We use strictly necessary cookies (sign-in, security). With your consent, PostHog, whose data is hosted in the European Union, measures how the website and your workspace are used; your sessions are recorded there, with what you type and any text identifying a person masked. No advertising cookies. You can change your mind at any time with “Manage cookies”, at the foot of the website or in your workspace menu.

Regardless of this choice, our server records the steps of your journey, without cookies and without content. This tracking is based on our legitimate interest; you can object to it by writing to contact@drawthink.app.

For details, please read our cookie policy

11. Changes

This policy evolves with the service and the law; the date of its last update appears at the top. We will inform you by email of any material change, in particular the addition of a service provider, before it applies.

12. Contact

For any question about this policy or your data, write to contact@drawthink.app, or by post to RenderThink, Data Protection, 17 rue Louis Pasteur, 38400 Saint-Martin-d’Hères, France.