Privacy Policy

1. Scope and roles

For account administration, licensing, billing, website operation, security, communications and Cadvex’s direct business relationships, Cadvex generally acts as a controller or equivalent responsible business. For personal data submitted by a Customer to Cadvex Cloud in technical files, RFQs, quotes or other Customer Content, Cadvex generally acts as a processor or service provider on the Customer’s behalf.

Cadvex Desktop processes and stores manufacturing content only on the Customer’s own device. Cadvex never receives that content and has no access to it, so Cadvex is not a processor of it. Cadvex sees Desktop content only if the Customer chooses to send it, for example a file, backup, screenshot or log attached to a support request, and uses it only to provide that support.

The Service is intended for business users and is not directed to children or consumers.

2. Personal data collected

2.1 Account and business information

• Name, business email, telephone number if provided, company, country and organization role.
• Account identifiers, authentication events, invitations, membership and legal-consent records.
• Communications, support requests, feedback, refund requests and privacy requests.

2.2 Cadvex Cloud Customer Content

Customers may upload STEP/CAD files, drawings, RFQs, part identifiers, technical specifications, quote records, customer/supplier contacts, comments and other manufacturing information to Cadvex Cloud. Technical documents may incidentally contain personal data such as names, emails, signatures, approval records or employee identifiers.

2.3 Cadvex Desktop local manufacturing content

Cadvex Desktop runs on the Customer’s own computer. STEP files, drawings, RFQs, quotes, prices, customer and supplier details, analysis results, DFM results and Desktop backups are stored on that device and nowhere else, unless the Customer copies them elsewhere. Cadvex Desktop has no feature that sends this content to Cadvex or to any third party, and Cadvex has no access to it: Cadvex cannot view, copy, change, delete, restore or recover it. The only information Cadvex Desktop sends to Cadvex is the account, licensing and security information described in section 2.4, which never includes manufacturing files, quotes, or customer or supplier information.

2.4 Desktop account, licensing and security metadata

To authenticate and license Cadvex Desktop, Cadvex may process account and organization identifiers, application version, device name/platform, installation and device-fingerprint hashes, device public keys/thumbprints, proof-challenge status, activation/deactivation/transfer events, entitlement and lease metadata, validation timestamps, trial/subscription/perpetual state and security/audit events. The device private signing key remains on the Customer’s device and is not sent to Cadvex.

2.5 Website, technical and usage data

• IP address, browser, operating system, session identifiers and security events.
• For website account creation, we retain the approximate country supplied by our hosting provider to administer accounts and understand where registrations originate. This signup record stores only the country code, not the raw IP address; VPNs and travel can affect its accuracy. If the visitor arrived through a link carrying campaign parameters (utm_source, utm_medium, utm_campaign), these are also stored with the new account.
• Pages/features used, file type/size for Cloud uploads, processing events, error codes and diagnostic information.
• Referral/outreach/demo-video engagement information where such tracking is enabled.
• Links in our emails may contain a code identifying the recipient company, used to measure whether our video was watched; no cookies are used.
• With optional analytics consent: pages and screens viewed, clicks, scrolling, form entries (excluding passwords, payment-card fields and one-time codes), errors, performance data and session recordings of the website and Cadvex Cloud application, linked after sign-in to the user’s account email, name, role and organization.
• Without analytics consent, on the pages of the public website only: page views counted without cookies by PostHog (page address without personal parameters, referring page, campaign parameters, browser and device type, approximate country). PostHog uses the IP address and browser details only to compute a one-way hash that changes every day, so that visits can be counted without storing anything in the browser; clicks, scrolling, form entries and recordings are never captured without consent.
• Product-usage events recorded by Cadvex’s own servers and linked to the account and organization identifiers, never to the email address or IP address: account creation completed (product chosen and, if any, the campaign source of the signup), Cloud analyses run (first and subsequent, with status and duration), Cadvex Desktop download started (platform and version), Desktop evaluation or device activated (kind and platform) and the move from an evaluation to paid use (product and, for Desktop, the plan; for Cloud, the first paid analysis). They are sent to PostHog EU Cloud whether or not cookies were accepted and never include files, drawings, quotes or Desktop manufacturing content.
• With the same consent, on the marketing pages of the public website only: information collected by the LinkedIn Insight Tag (address of the page visited, referring page, browser and device information, IP address, time of visit, button clicks and LinkedIn cookie identifiers such as li_sugr, bcookie, lidc, UserMatchHistory and, after a LinkedIn ad click, li_fat_id), which goes to LinkedIn for ad measurement and retargeting.
• hCaptcha-related anti-abuse information during public signup when CAPTCHA is enabled.

2.6 Billing data

When paid Cloud or Desktop billing is enabled, Paddle may collect payment and tax information. Cadvex may receive billing name/address, tax information, invoice history, payment status, payment-method type, card brand/last four digits where provided by Paddle, transaction identifiers, subscription/license state and refund information. Full card details are not intended to reach Cadvex application servers.

3. Purposes of processing

• Create, authenticate and administer accounts and organizations.
• Provide Cadvex Cloud file analysis, optional drawing extraction, quotation and collaboration functions.
• Provide Cadvex Desktop account, licensing, entitlement, device-transfer and security validation. This never involves Desktop manufacturing files, quotes, or customer or supplier information.
• Measure Cloud usage and administer Cloud and Desktop billing, taxes, refunds and payment status through Paddle.
• Provide support and respond to requests.
• Secure the Service, prevent fraud, enforce terms and protect device/license integrity.
• Diagnose errors and improve reliability and usability.
• With consent, understand how the website and Cadvex Cloud are used through analytics and session recordings.
• Count visits to the public website without cookies and understand how accounts are created, how the Service is adopted and how evaluations convert to paid plans (audience measurement and product-usage events).
• With consent, measure the results of Cadvex advertising on LinkedIn and show Cadvex ads on LinkedIn to people who visited the public website (retargeting).
• With consent, measure whether visits from Cadvex ads on Google lead to an account being created (Google Ads conversion measurement through the Google tag, in consent mode: no cookie and no Google request other than a cookieless consent-mode ping before consent; no name, email address or other account data is sent to Google).
• Visitors in the United States: this website uses an opt-out model. Cookies for analytics and for measuring our advertising (PostHog, LinkedIn and Google ads measurement; never ad personalisation) are set unless you opt out, with “Do Not Sell or Share My Personal Information” in the website footer, “Opt out” in the notice or Privacy choices on the Cookie Notice page. Visitors in the EEA, the United Kingdom, Switzerland and elsewhere: nothing optional before you accept. Everywhere, a browser that sends the Global Privacy Control signal is treated as having opted out, and an opt-out or refusal is never overridden.
• Comply with law and establish, exercise or defend legal claims.
• Send service, legal, security, product and permitted marketing communications.

4. Legal bases for EU/EEA processing

Where GDPR or similar law requires a legal basis, Cadvex relies on performance of a contract, legitimate interests, compliance with legal obligations and consent where required. Legitimate interests include operating and improving the Service, securing systems, preventing fraud and license abuse, supporting Customers, maintaining business records and managing professional relationships. Cookieless counting of website visits and server-side product-usage events rely on Cadvex’s legitimate interest in measuring the audience of its website and the adoption of its Service; anyone may object by writing to [email protected]. Consent may be withdrawn where consent is the applicable basis, without affecting prior lawful processing.

5. Cloud AI-assisted drawing processing

When a Customer enables AI-assisted drawing extraction in Cadvex Cloud, the selected drawing is transmitted in full to Anthropic’s commercial API to extract technical information such as materials, tolerances, finishes, treatments, threads, markings and notes. STEP/STL geometry is not sent to Anthropic for this workflow.

Cadvex does not claim Zero Data Retention for the current Anthropic configuration. Retention is governed by Anthropic’s then-current commercial terms, model-specific safety policies and legal requirements and may include a limited retention period such as up to approximately 30 days for applicable traffic. Anthropic states that commercial/API customer content is not used to train its models by default under applicable commercial terms. Customers may skip Cloud drawing extraction and use manual inputs instead.

Cadvex Desktop does not transmit drawings to Anthropic or any other AI provider. Drawings attached in Desktop stay on the Customer’s device.

6. How information is shared

With consent, information collected by the LinkedIn Insight Tag on the marketing pages of the public website goes to LinkedIn (LinkedIn Ireland Unlimited Company and its affiliates) for ad measurement and retargeting. For the collection of this information through the Insight Tag and its transmission to LinkedIn, Cadvex and LinkedIn Ireland Unlimited Company act as joint controllers. LinkedIn’s own use of the information is governed by LinkedIn’s Privacy Policy (https://www.linkedin.com/legal/privacy-policy) and Cookie Policy, and LinkedIn may process it outside the European Union. Individuals may exercise their rights regarding this joint processing with Cadvex ([email protected]) or with LinkedIn. Cadvex receives only aggregated statistics from LinkedIn, not the identity of individual visitors.

Cadvex may disclose data to service providers that support hosting, databases, storage, authentication, networking, AI processing, email, payments, anti-abuse/CAPTCHA, product analytics and session recording, security, support and professional advice. Providers are limited to the purposes for which they are engaged and are described in the Subprocessor List.

Information may also be disclosed within the Customer organization according to permissions, where required by valid legal process, to protect rights and safety, investigate fraud/security incidents, enforce agreements, or in connection with a merger, financing, acquisition or sale of assets.

7. International transfers

Cadvex is established in India and uses providers that may process data in the European Economic Area, India, the United States and other countries. Cadvex uses contractual and other safeguards required by applicable law, which may include data-processing agreements, standard contractual clauses and transfer assessments. Cadvex does not represent that all Cloud/account processing remains exclusively within the European Union.

Desktop manufacturing content that remains solely on the Customer’s local device is transferred only as directed by the Customer through its own device, network and backup practices.

8. Data retention

8.1 Cloud active accounts

Cloud uploaded files, analyses, reports and quotes are retained while the account remains active unless the Customer deletes them earlier, subject to operational backup rotation and legal/security retention.

8.2 Desktop local data

Cadvex does not control the retention of manufacturing content stored locally by Cadvex Desktop. The Customer controls deletion and backup of that local content. License expiry, READ_ONLY status, device deactivation or account-side entitlement changes do not remotely delete the Customer’s local manufacturing data.

8.3 Account/licensing records

Cadvex retains account, legal-consent, license, payment, device, transfer, entitlement, security and audit records for as long as reasonably necessary to provide the Service, enforce license rights, prevent fraud, support Customers, comply with law and establish or defend claims. Certain immutable security/license histories may be retained after a device or license is no longer active.

8.4 Cloud account closure

Following ordinary Cloud account closure, Cadvex may provide a limited export period and then schedule active Cloud Customer Content for deletion, normally within 30 days after the export period. Residual copies may remain temporarily in backups/caches until normal rotation.

8.5 Business records after closure

• Invoices, payment, tax and accounting records: for the legally required period.
• Support and contractual correspondence: ordinarily up to three years after closure unless longer retention is justified.
• Security, license and audit records: ordinarily up to 12 months or longer where necessary for fraud, security, entitlement history, investigation or claims.
• Suppression records: as long as needed to honor a marketing objection.
• Fraud, legal-hold, dispute and claims records: until the matter and applicable limitation periods end.

9. Security

Cadvex uses administrative, technical and organizational safeguards designed to protect personal data and Cloud Customer Content, including access controls, provider-supported encryption, restricted privileged credentials, authentication, private storage, logging, backups and incident-response processes.

Cadvex Desktop uses local application security mechanisms and platform-supported key protection (Windows key protection or macOS Keychain) for account/device secrets and device proof. The Customer remains responsible for securing its Windows or Mac endpoint, user accounts, storage, backups, network and personnel access.

10. Cookies and similar technologies

The website and Cloud application use browser storage and related technologies for authentication, session management, security, preferences, signup anti-abuse, outreach attribution and provider functionality. Paddle and hCaptcha may use provider technologies when their functions are invoked. With optional analytics consent, PostHog EU Cloud, reached through Cadvex’s analytics domain p.cadvex.com, measures and records use of the website and the Cadvex Cloud application: pages and screens viewed, clicks, scrolling, heatmaps, form entries, errors, performance and session recordings. After sign-in, this activity is linked to the user’s account email, name, role and organization. Passwords, payment-card fields, one-time codes, CAPTCHA responses and the 3D model viewer are excluded from recordings. Cadvex Desktop activity is not recorded. Without consent, visits to the pages of the public website are still counted with PostHog’s cookieless mode, which stores nothing in the browser. With the same consent, the marketing pages of the public website (not the signup, sign-in and email-verification pages, the Cadvex Cloud application, Cadvex Desktop or the /watch video page) also load the LinkedIn Insight Tag, which sets or reads LinkedIn cookies such as li_sugr, bcookie, lidc, UserMatchHistory and li_fat_id to measure Cadvex’s LinkedIn advertising and to show Cadvex ads on LinkedIn to people who visited the website (retargeting); this data goes to LinkedIn. Use Privacy choices on the Cookie Notice page to withdraw consent. Further details are in the Cookie Notice. Cadvex Desktop local application storage is not a browser cookie and is described separately in this Policy.

11. Marketing

Cadvex may send necessary account, billing, legal, support and security communications. Product or marketing messages will include an unsubscribe method where required. Prospective contacts approached individually are not automatically added to a general mailing list. Cadvex may retain a minimal suppression record to avoid unwanted future marketing.

12. Privacy rights

Depending on applicable law, individuals may request access, correction, deletion, restriction, objection, portability, withdrawal of consent, information about recipients and review of certain automated decisions. EU/EEA individuals may lodge a complaint with a competent supervisory authority. Requests should be sent to [email protected]. Where Cadvex processes data only on behalf of a Customer, the request may be referred to that Customer.

13. Children and sensitive information

The Service is not directed to persons under 18. Cadvex Cloud must not be used for protected health information, classified information, controlled nuclear information, ITAR/CUI or similar controlled technical data requiring an environment Cadvex has not expressly agreed to provide, payment-card details outside approved checkout, biometric identifiers for unique identification, third-party passwords, or highly sensitive personal data unrelated to the manufacturing purpose.

Cadvex Desktop may be used with export-controlled technical data only where the Customer’s own environment and use satisfy applicable export-control obligations. Cadvex does not independently certify the Customer’s overall ITAR or CUI compliance.

14. Automated processing

Cadvex uses automated systems to analyze technical files and produce estimates, DFM findings and recommendations. These outputs do not independently make legally binding decisions about individuals. The Customer remains responsible for human review and final business/manufacturing decisions.

15. Changes

Cadvex may update this Policy to reflect changes in the Service, providers, law, security or processing. Material changes will be communicated by an appropriate notice and, where required, a new consent may be requested.