Privacy notice

Last updated 4 October 2026

In short: we collect what we need to draw your blocks and run your account. That's your email address, the files you upload, the drawings we make and your billing status. Your photos are sent to Anthropic's Claude API to draw the blocks and aren't used to train its models. We also note how you found us, so we know which places bring us customers. We use one sign-in cookie, we count visits without cookies, and advertising cookies load only if you say yes to them.

1. Who we are

CAD Blocks (cadblocks.app) is run by Devin Jones, a sole trader in the United Kingdom trading as CAD Blocks. We are the controller of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018). For anything about your data, email hello@cadblocks.app.

2. What we collect

• Account details: your email address, and the one-time sign-in codes we send you. Codes expire within minutes.
• Team details: on the Studio plan, the email addresses of the people you invite.
• What you upload: photos, screenshots, PDFs, item names, makers, model numbers, sizes and notes.
• What we make: the drawings, DXF files and previews made from your uploads.
• Billing details: your plan, block balance and payment history. Card details go straight to Stripe, and we never see or store your card number. Stripe tells us your name, billing country and the last four digits of your card. If you cancel a plan, Stripe passes on the reason you choose.
• How you found us: on the first page you visit, the site or link that brought you there. That means the referring website, any campaign tags in the link (such as utm_source), an ad click ID if you came from an ad, and the page you landed on. It travels in the page address, not in a cookie, and we save it with your account if you sign up. If you answer our one-question survey, we also save where you heard about us.
• Invites: if you join through someone's invite link, we record that so we can give you both the bonus blocks. They see how many people joined through their link, not who. To stop bonus blocks being collected with made-up accounts, we check whether a new account looks like another address of an existing or closed account, or comes from the same network as the person who invited it.
• Closed accounts: when you close your account, we keep a scrambled (hashed) form of your email address that can't be turned back into it, and the network address you last used, for 12 months, only to apply the limits above.
• How you use CAD Blocks: the steps you've reached, such as your first block, your first download or using all your free blocks, and when.
• Technical details: your IP address, browser type, the requests you make and when, kept in server logs for security and fixing faults.
• Messages: anything you send us by email.

3. Why we use it, and our lawful basis

• To provide the service (signing you in, drawing blocks, keeping your library and sharing it with your team): to perform our contract with you.
• To take payments and keep accounts: to perform our contract, and to meet our legal obligations for tax records.
• To send service emails (sign-in codes, team invitations, bonus blocks you've earned, and important changes to your account or these terms): to perform our contract.
• To send occasional emails about CAD Blocks (tips, new features, or a personal note from us when you've used all your free blocks): our legitimate interest in telling customers about our own service. Every one of these emails lets you opt out, and you can turn them off on your account page at any time.
• To learn which places bring us customers and to improve the site (how you found us, visit counts, page analytics and the steps you've reached): our legitimate interest in growing the service sensibly. You can object at any time by emailing us.
• To keep the service secure and fair (preventing abuse of the free plan and invite bonuses, rate limits, investigating misuse): our legitimate interest in running a safe service.
• To fix problems: when a drawing fails or comes out badly, we may look at its inputs and outputs to find out why. This is our legitimate interest in making the service work properly.

4. Who we share it with

We use these providers to run the service. Each one only gets what it needs for its job.

• Anthropic (United States) runs the Claude API, the AI that draws your blocks. It receives your uploaded files and notes for each drawing. Under Anthropic's commercial terms, API inputs and outputs aren't used to train its models, and it keeps them only for a limited period under its own data retention policy.
• Stripe (Ireland and the United States) takes payments and manages subscriptions.
• Resend (United States) sends our emails.
• Hetzner (Germany and Finland) hosts our servers and stores your files and account data in the EU. Our page analytics (Umami, open-source software we run ourselves) is on the same servers and isn't shared with anyone.
• Porkbun (United States) provides our domain name and DNS, and forwards email sent to hello@cadblocks.app.
• Advertising platforms (Google, Microsoft, Meta and Reddit), only if we advertise with them. If you arrived from one of their ads, we may tell that platform that the click led to a sign-up or a purchase, using the click ID from the ad link. We never send them your email address. Their own measurement tags load only if you accept them (see section 7), and never on the sign-in or account pages.

We don't sell your data. We'll only disclose it to anyone else if the law requires us to.

5. Transfers outside the UK

Some of these providers process data in the United States. Those transfers are protected by the UK International Data Transfer Addendum to the EU standard contractual clauses, or by the UK Extension to the EU-US Data Privacy Framework where the provider is certified.

6. How long we keep it

• Account details, how you found us and the steps you've reached: while your account is open. We delete them within 30 days of you closing it, and backups roll off within a further 30 days.
• The scrambled form of a closed account's email address and its network address: 12 months.
• Your uploads and drawings: until you delete them or close your account.
• Payment and invoice records: 6 years after the end of the tax year they relate to, as HMRC requires.
• Visit counts: daily totals per source (for example "12 visits from Reddit"), with nothing that identifies anyone.
• Page analytics: pages viewed, the referring site, browser, device type and country, with no cookies, names or email addresses.
• Server logs: 30 days.
• Sign-in codes: until they're used or expire.

7. Cookies and storage in your browser

We set one cookie, when you sign in, to keep you signed in. It's strictly necessary for the service, so it doesn't need your consent. We count visits with Umami, which uses no cookies and stores nothing on your device, and the details of how you found us travel in the page address rather than a cookie.

If we advertise with Google, Microsoft, Meta or Reddit, we may use their measurement tags, which set cookies. We'll only load them if you accept them in a banner, and you can change your mind at any time with the "Cookie choices" link at the bottom of the page. When none of these tags are in use, there's no banner.

The app also remembers display choices, such as millimetres or inches, your cookie choice, and when it last showed you the invite prompt, in your browser's local storage. That stays on your device. When you pay, Stripe's checkout page (on stripe.com) sets its own cookies to prevent fraud.

8. Your rights

You have the right to:

• get a copy of your personal data;
• have it corrected if it's wrong;
• have it deleted;
• restrict or object to how we use it, including for emails about CAD Blocks and for learning how you found us;
• receive it in a portable format.

You can delete blocks yourself in the app at any time, and turn off emails about CAD Blocks on your account page. For anything else, email hello@cadblocks.app. We'll reply within one month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.

9. Security

The service only runs over HTTPS. Sign-in codes and session keys are stored in hashed form. Access to the servers is restricted to the operator.

10. Children

CAD Blocks is for professionals and isn't meant for anyone under 18.

11. Changes to this notice

If we change how we use your data in a way that matters, we'll update this notice and email you before the change takes effect.