Privacy Policy

Last updated: June 3, 2026

This Privacy Policy explains how ConduitMap ("we", "us", "our") collects, uses, and protects your personal information when you use our web-based 3D electrical room layout editor (the "Service").

1. Who We Are (Data Controller)

The data controller responsible for your information is ConduitMap, based in Tijuana, Baja California, México. You can contact us at support@conduitmap.app with any privacy-related questions or requests.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address — used for login, account confirmation, and important service notifications.
• Display name — shown in your dashboard greeting and used for personalization.
• Password — stored as a one-way cryptographic hash (bcrypt) by our auth provider, Supabase. We never see your plaintext password.

2.2 Project Content

When you use the editor, we collect and store:

• Project data — room dimensions, equipment placements, conduit routes, measurements, and labels you create.
• Thumbnails — small image captures of your 3D viewport, generated automatically when you save a project, used to display previews in your dashboard.
• Project metadata — names, timestamps, and whether you've marked a project as publicly shareable.

2.3 Payment Information

If you subscribe to Pro, payment is processed by Stripe. We do not store your credit card number, CVV, or full card details on our servers. We do store:

• Your Stripe customer identifier (used to look up your subscription)
• Your Stripe subscription identifier and status (active, cancelled, past_due, etc.)
• Subscription tier (free, pro)

2.4 Technical Information

We automatically collect technical information when you use the Service, including:

• IP address (collected by our hosting and DNS providers — Vercel and Cloudflare)
• Browser type and version
• Approximate location (derived from IP address)
• Pages visited and timestamps
• Referring URLs

This data is used for security (preventing fraud and abuse), performance monitoring, and aggregate analytics.

2.5 Communications

If you email us at support@conduitmap.app, we keep a record of the correspondence to provide support and improve the Service.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Authenticate your identity and secure your account
• Process your subscription payments and renewals
• Send transactional emails (confirmation, password reset, billing receipts, important service updates)
• Respond to support requests
• Detect and prevent fraud, abuse, and unauthorized access
• Comply with legal obligations

We do not use your information for advertising, do not sell or rent your information to third parties, and do not share your project content with anyone except as described in this Policy.

4. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area or United Kingdom, our legal bases for processing your personal data are:

• Contract — to provide the Service you signed up for (account creation, project storage, billing).
• Legitimate interest — to keep the Service secure, prevent fraud, and improve our product.
• Consent — for any optional features you actively enable (such as making a project publicly shareable).
• Legal obligation — to comply with applicable laws, such as tax and accounting requirements.

5. Who We Share Your Information With (Subprocessors)

We use a small number of trusted third-party services to run our Service. Each of them processes only the data necessary for their specific role. They are all bound by contractual confidentiality and data-protection obligations.

We may also share information when legally required — for example, in response to a valid court order, subpoena, or to protect our rights or the safety of others.

6. International Data Transfers

Our subprocessors are headquartered in the United States and operate global infrastructure. By using the Service, you understand that your information may be transferred to, stored, and processed in countries outside your country of residence, including the United States. Where required by law, we rely on standard contractual clauses or equivalent safeguards to protect international transfers.

7. Data Retention

We retain your personal information for as long as your account is active and for a limited period thereafter, as follows:

• Account information and project data — retained while your account is active. Deleted within 30 days of account deletion (with backups purged within 90 days).
• Billing records — retained for at least 5 years as required by tax and accounting laws in México.
• Support correspondence — retained for up to 2 years to provide ongoing support context.
• Technical logs — IP addresses, browser data, and similar are typically retained by our subprocessors for 30 to 90 days.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

8.1 Access

Request a copy of the personal information we hold about you. Your dashboard already shows most of this, and the Export feature lets you download your project data in machine-readable JSON format.

8.2 Correction

Update your display name directly in your account settings. To correct your email address, contact support@conduitmap.app.

8.3 Deletion

Request deletion of your account and personal information through the Danger Zone section of your account settings, or by emailing support@conduitmap.app. Some information may be retained as legally required (for example, billing records).

8.4 Portability

Export your project data at any time using the Export JSON feature on the dashboard. This produces a complete, structured copy of your work that can be re-imported or used elsewhere.

8.5 Objection and Restriction

Where applicable under GDPR or similar laws, you may object to certain processing of your information or request that we restrict its use. Contact us with your request.

8.6 Withdraw Consent

Where we process information based on your consent (for example, making a project public), you may withdraw consent at any time without affecting the lawfulness of prior processing.

8.7 Complaints

If you are in the European Economic Area or United Kingdom, you have the right to lodge a complaint with your local data protection authority. If you are in México, you may contact the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI).

9. Cookies and Local Storage

We use a small number of essential cookies and browser storage technologies:

• Authentication cookies set by Supabase to keep you logged in.
• localStorage used by the editor to cache your work as a backup and to remember UI preferences (such as dark mode).
• sessionStorage used briefly during the demo experience.

We do not currently use analytics cookies, advertising cookies, or any third-party tracking pixels. If we add analytics in the future, we will update this Policy and provide notice.

10. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will delete it promptly.

11. Security

We take security seriously and use industry-standard measures to protect your information:

• All data is encrypted in transit using TLS (HTTPS).
• Passwords are hashed using bcrypt by our authentication provider.
• Database access is protected by row-level security policies that ensure users can only access their own data.
• Server-side credentials (API keys, payment secrets) are stored in encrypted environment variables and never exposed in client-side code.
• Strict HTTP security headers are applied to prevent common web vulnerabilities.

No system is perfectly secure. In the unlikely event of a data breach affecting your personal information, we will notify you and the appropriate authorities as required by law.

12. Public Project Sharing

If you choose to mark a project as publicly shareable, anyone with the share link can view that project in read-only form, without an account. The shared view does not expose your account email or other personal information — only the project content itself. You can revoke sharing at any time from the dashboard, after which the existing link will no longer load.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice — for example, by email or by displaying a banner in the Service — at least thirty (30) days before the changes take effect. The "Last updated" date at the top of this page indicates when the Policy was last revised.

14. Contact Us

If you have questions or concerns about this Privacy Policy, your personal information, or your rights, please contact us at support@conduitmap.app.