Privacy Policy

1. Scope

This Policy applies to personal data we process in connection with (a) the www.zcad.ai website; (b) zCAD.Online and zCAD.AI; and (c) our related communications, marketing and support channels. It does not apply to third-party websites or services that we do not operate (for example, Google sign-in or our payment processors), which are governed by those parties' own privacy policies.

2. Personal Data We Collect

We collect personal data from three sources: information you provide to us, information collected automatically, and information received from third parties. We do not intentionally collect sensitive personal data (such as health, biometric or religious information), and we ask that you do not include such data in your User Content or communications.

3. How We Use Personal Data

We use personal data to provide accounts and the Services, process payments, operate the Public Model Library, deliver zCAD AI features, support customers, secure the Services, improve our products, send service and marketing communications, and comply with legal obligations.

We do not use personal data for automated decision-making that produces legal or similarly significant effects on you.

1. (a) create and administer your account, authenticate you (including via Google sign-in), and provide, operate and maintain the Services, including storing, rendering and synchronizing your User Content;
2. (b) operate the Public Model Library, including displaying your public User Content together with your public display name (Section 5);
3. (c) provide zCAD AI features, including processing your Inputs to generate Outputs (Section 6);
4. (d) process payments, manage subscriptions, issue invoices and detect and prevent fraudulent transactions;
5. (e) provide customer support and respond to your requests;
6. (f) monitor, secure and protect the Services, including detecting abuse, enforcing our Terms of Service and protecting the rights and safety of users and third parties;
7. (g) analyze usage in order to improve, debug and develop the Services (using aggregated or de-identified data where practicable);
8. (h) send you service communications (such as security alerts, transaction confirmations and material changes to terms) and, subject to your right to opt out and applicable consent requirements, marketing communications about our products, features and events; and
9. (i) comply with legal obligations and establish, exercise or defend legal claims.

4. Legal Bases (EEA/UK Users)

Where the GDPR applies, we rely on the following legal bases: performance of a contract (providing the Services you sign up for, including the Free Plan and the Public Model Library functionality that is part of it, and processing payments); legitimate interests (securing and improving the Services, preventing fraud and abuse, business analytics, and direct marketing to existing customers where permitted), balanced against your rights; consent (optional cookies, certain marketing communications, and any use of your private content for AI model training); and legal obligation (tax, accounting and regulatory requirements).

5. Public Model Library — Public Disclosure of Free Plan Content

5.1 A core feature of the Free Plan is that User Content is public by default. When you create or store content on the Free Plan, the following information is disclosed publicly: the content of the model or design itself; its title, description, tags and preview images; your public display name and avatar; and creation/update metadata.

5.2 Public content is visible to all users and visitors of the Services, may be indexed and cached by search engines, and may be viewed, downloaded and copied by other users under the license described in our Terms of Service (https://www.zcad.ai/terms). Copies made by other users, and search-engine caches, are outside our control and may persist even after you delete the original or make it private.

5.3 Please do not include personal data (yours or anyone else's), confidential information or trade secrets in Free Plan content. If you need private storage, upgrade to a Paid Plan and set your content to private before storing it.

5.4 Paid Plan users may set content to private at any time; private content is disclosed only as described in Sections 2, 6 and 7 of this Policy and in our Terms of Service.

6. zCAD AI and Your Data

6.1 When you use zCAD.AI, your Inputs (and, where a feature operates on a model, the relevant model data) are processed to generate Outputs. This processing may be performed by third-party AI model providers acting as our processors/sub-processors (we use multiple third-party model providers; you may request a current list by contacting us at contact@zcad.ai), under contracts imposing confidentiality and data protection obligations.

6.2 Training. We do not use your private User Content, or Inputs associated with private content, to train generalized AI models without your explicit consent. We may use public User Content from the Public Model Library, and de-identified, aggregated usage data, to develop, evaluate and improve the Services, including the models underlying zCAD.AI. You can opt out of the use of your public User Content for AI training at any time in your account settings; the opt-out applies prospectively. Where the GDPR applies, we rely on our legitimate interests for this processing (or your consent where required), and an opt-out will be honored as an objection to further such processing.

6.3 We retain AI interaction logs for a limited period for abuse prevention, safety, debugging and legal compliance, as described in Section 10.

7. How We Disclose Personal Data

We do not sell your personal data. We disclose personal data only to service providers under contract, to the Public Model Library as described in Section 5, to our affiliates, for legal and safety reasons, in connection with business transfers, and with your consent or at your direction.

1. (a) Service providers (processors). Cloud hosting and infrastructure providers (with servers located in Singapore), payment processors, AI model providers, email and communications delivery, analytics, customer support tooling and security vendors, in each case under contracts limiting their use of the data to providing services to us.
2. (b) Public Model Library. As described in Section 5, for Free Plan content.
3. (c) Affiliates. Our corporate affiliates that support the operation of the Services may process personal data on our behalf, consistent with this Policy.
4. (d) Legal and safety. Where required by law, regulation, legal process or governmental request, or where necessary to enforce our terms, protect the security of the Services, or protect the rights, property or safety of ZIXEL, our users or the public.
5. (e) Business transfers. In connection with a merger, acquisition, financing, reorganization or sale of assets, in which case this Policy will continue to apply to your personal data, or we will notify you and, where required, seek fresh consent.
6. (f) With your consent or at your direction (for example, when you share a link to a model).

8. Cookies and Similar Technologies

8.1 We use cookies, local storage and similar technologies for: strictly necessary purposes (authentication, session management, security, load balancing); functional purposes (remembering preferences such as language and units); and analytics purposes (understanding how the Services are used so we can improve them). We do not currently use advertising or retargeting cookies; if we introduce them in the future, we will update this Policy and, where required by law, request your consent before setting them.

8.2 Where required by law, non-essential cookies are set only with your consent, which you can give and withdraw through our cookie banner or settings page. You can also manage cookies through your browser; blocking necessary cookies may prevent parts of the Services from functioning.

8.3 Emails we send may contain pixels that tell us whether an email was opened or a link clicked; you can opt out of marketing emails at any time via the unsubscribe link.

8.4 If your browser sends a "Do Not Track" or Global Privacy Control signal, we honor it where required by applicable law.

9. International Data Transfers

9.1 We are based in Singapore and use cloud infrastructure located in Singapore. Your personal data may be transferred to, stored in and processed in countries other than your own, including countries that may not provide the same level of data protection as your home jurisdiction.

9.2 Where we transfer personal data internationally, we implement appropriate safeguards required by applicable law, including: for transfers out of Singapore, ensuring a comparable standard of protection as required by the PDPA; for transfers of EEA/UK personal data, the European Commission's Standard Contractual Clauses and the UK Addendum or International Data Transfer Agreement (supplemented by additional measures where appropriate); and reliance on adequacy decisions where available. You may request further information about these safeguards using the contact details in Section 15.

10. Data Retention

We retain personal data for as long as your account is active and thereafter only as long as necessary for the purposes described in this Policy, including: account and User Content data — until you delete the content or your account, plus a limited backup-cycle period of up to 30 days; transaction and billing records — as required by tax and accounting laws (5 years under Singapore law); support communications — 24 months after the matter is closed; security and access logs — 12 months; and AI interaction logs — 90 days unless longer retention is needed for abuse investigation or legal compliance. When retention ends, we delete or irreversibly anonymize the data. Note that public User Content copied by other users, and search-engine caches of it, may persist after deletion (Section 5.2).

11. Security

We implement technical and organizational measures appropriate to the risk, including encryption of data in transit (TLS) and at rest, network and access controls with role-based permissions and multi-factor authentication for administrative access, segregation of production and development environments (with no use of real user data in testing), logging and monitoring, vendor security review, and regular backups. No system is completely secure; if we become aware of a personal data breach affecting you, we will notify you and the relevant authorities where required by applicable law (including the PDPA's notifiable data breach regime and the GDPR).

12. Your Rights

Subject to applicable law and certain exceptions, you have the right to: access the personal data we hold about you and information about how it has been used or disclosed; correct inaccurate or incomplete data; delete your data or your account; port data you provided to us in a structured, commonly used, machine-readable format; restrict or object to certain processing, including direct marketing (which you can stop at any time); withdraw consent at any time where processing is based on consent, without affecting prior processing; and lodge a complaint with a supervisory authority — in Singapore, the Personal Data Protection Commission (PDPC); in the EEA/UK, your local data protection authority.

You can exercise most rights directly in your account settings (updating profile data, deleting models, deleting your account) or by contacting us at contact@zcad.ai. We will verify your identity before acting on a request and will respond within the timeframe required by applicable law (and in any event within 30 days where feasible; if we need more time, we will tell you). We will not discriminate against you for exercising your rights.

13. Region-Specific Disclosures

13.1 California. The categories of personal information we collect are described in Section 2 (identifiers; commercial information; internet/electronic activity; geolocation at approximate level; audio/visual content you upload; professional information; and inferences for service improvement). We collect them from the sources and for the purposes in Sections 2 – 3, and disclose them to the recipients in Section 7. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information other than as permitted. California residents may exercise the rights in Section 12, including through an authorized agent.

13.2 EEA/UK. The controller is ZIXEL TECHNOLOGIES PTE. LTD.. Legal bases are set out in Section 4 and transfer safeguards in Section 9.

13.3 Singapore. Our Data Protection Officer can be contacted at contact@zcad.ai (Section 15).

14. Children

The Services are not directed to children under the age of 13 (or the higher minimum age required for consent to data processing in your jurisdiction, such as up to 16 in certain EEA countries), and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, please contact us and we will delete it promptly.

15. Contact Us; Data Protection Officer

If you have questions, requests or complaints regarding this Policy or our handling of your personal data, please contact:

Data Protection Officer, ZIXEL TECHNOLOGIES PTE. LTD.

6 Raffles Quay, #14-06, Singapore 048580

Email: contact@zcad.ai

We aim to acknowledge complaints promptly and to respond substantively within 30 days.

16. Changes to This Policy

We may update this Policy from time to time. If we make material changes — such as processing personal data for materially new purposes, changing the categories of recipients, or changes affecting your rights — we will notify you in advance by email or prominent notice within the Services and, where required by law, obtain your consent. The "Last Updated" date at the top indicates when this Policy was last revised. Your continued use of the Services after the effective date of a revised Policy constitutes acknowledgment of the revised Policy.

Appendix — Summary of Personal Data Collection

Account registration (email or Google sign-in): email address, display name, hashed password or Google account identifiers (name, email, avatar) — to create and secure your account.

Content creation and storage: models, designs, files, comments, AI Inputs and saved Outputs — to provide the Services; Free Plan content is published in the Public Model Library.

Purchases (Paid Plans): billing name and address, tax information, transaction records, limited card metadata via payment processor — to process payment and comply with tax law.

Use of the Services: IP address, device/browser information, usage logs, error and crash diagnostics (including graphics capability data) — to operate, secure, debug and improve the Services.

Support and communications: contact details and message content — to respond to you and improve support quality.