1. Who we are

FITD is operated by its founder as an individual based in the United Kingdom, and runs at fitdcad.com. Company registration details will be added here on incorporation. We are the data controller for the personal data described here.

Privacy contact: privacy@fitdcad.com. Use this address for any question or request about your data.

To report abuse of the service, email abuse@fitdcad.com. What we will and will not generate is set out on our Prohibited Uses page.

2. What we collect and why

3. Approved examples — how the 'thumbs-up' works

If you approve a design (thumbs-up), your prompt and the design may be shown as examples to other users' generations, to make their results better. A few things to know:

• You choose this at approval time — nothing is shared unless you approve a design.
• Don't include personal data in prompts (names, addresses, contact details). Prompts should only describe parts.
• Approving a design does not publish it straight away — an approved design waits in a review queue and is only used as an example if we approve it too.
• Changed your mind? Contact us at privacy@fitdcad.com and we will remove your approved examples.

4. Who we share data with (subprocessors)

• Anthropic (US) — AI model that generates and verifies designs from your prompts, and screens requests against our Prohibited Uses
• Google — OAuth sign-in (if you use it)
• GitHub — OAuth sign-in (if you use it)
• Resend — transactional email
• Hetzner (Germany) — application hosting, including the database
• Backblaze (EU) — media and backup storage, including generated files
• Cloudflare — DNS and proxy in front of the site; it sees connection metadata such as your IP address

We do not sell your data.

5. International transfers

Some providers (notably Anthropic) are in the United States. Where data leaves the UK, we rely on the UK–US Data Bridge (the UK extension to the EU–US Data Privacy Framework) where the provider is certified, and on Standard Contractual Clauses (with the UK Addendum) as a fallback.

6. How long we keep data

Account data, conversations and generated files are kept for the life of your account. Security logs are kept for a short period (weeks, not years). When you ask us to delete your account, we delete your data — except records we are legally required to keep (for example tax records once payments launch). During the beta, data may also be wiped when the beta ends.

Records of refused requests are kept for 18 months for abuse prevention and legal compliance, on the basis of our legitimate interests. They survive account deletion for that period.

That log records the prompt text, the verdict, the reason and the time, against the account the request came from. We may disclose it to the police or another authority where we are required to, or where a request meets the threshold in our internal referral policy. If an account is frozen for a policy violation, we also keep the identifiers it signed up with on an internal deny-list so the account cannot simply be created again.

7. Your rights

You have the right to access your data, to correct it, to have it erased, to receive a copy in a portable format, and to object to processing based on legitimate interests. To exercise any of these, email privacy@fitdcad.com — we respond within one month.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

We do not use analytics or tracking cookies.

9. If something goes wrong

If a data breach puts your data at risk, we will notify the ICO within 72 hours where required, and tell you directly if the breach is likely to put you at high risk.