Privacy Policy
Last updated: 2 September 2026 · This page explains what Drawing Inbox stores and why.
Who we are
M&R Tekla Detailing Limited (trading as Drawing Inbox), registered in England and Wales (company no. 16257071), of Office 8, Wykeham House, 3 Station Road, Okehampton, Devon, EX20 1DY, is the data controller for Drawing Inbox. Contact: hello@drawinginbox.com.
What we store, and why
| Data | Why | Lawful basis |
|---|---|---|
| Your email address, company name and a password you choose (kept only as a one-way hash — we cannot read it) | Your account and sign-in; the welcome and password-reset emails | Contract |
| Drawing files you upload (PDF, DWG, DXF, IFC) and the register built from them | The service itself: filing, revision history, viewing, keeping site phones current | Contract |
| Mobile numbers of your office and site team, and names where you give them | Signing in by text-message code, and showing the office who is on the team | Contract |
| Passkeys — a public key your phone makes so it can sign in with Face ID or a fingerprint | Signing in again without a text; it cannot be used to read anything | Contract |
| The phones and PCs you sign in on (a name, when last seen) | Keeping them on the current drawings, and letting the office remove one | Contract |
| Billing details you give Stripe at checkout | The subscription — Stripe holds the card; we hold only the subscription's status | Contract |
| Emails you ask us to send (office sign-in links, teammate invites) | Delivering those messages | Contract |
| Basic server logs (IP address, request times) | Security, abuse prevention, fixing faults | Legitimate interest |
| The email address and question you send from the website's question box | Answering you, and remembering what was asked | Legitimate interest — you asked |
We do not sell data, run advertising, or use third-party analytics cookies. The only cookie is the session cookie that keeps you signed in.
Your drawings stay yours
Files you upload belong to you and your company. Only signed-in members of your company can see them, plus the site team your office has added by mobile number — which it can remove at any time. There are no links to a drawing. The title block of a sheet the reader could not settle — as text, or as an image of the page — is sent to Anthropic's service for an assisted read, and is not used to train their models.
Who processes data for us
- Hetzner Online GmbH (servers in the EU — Finland) — servers and storage, EU region.
- Resend — sending the emails described above.
- Twilio — sending the sign-in and approval text messages.
- Stripe — taking the subscription payment; we never see the card.
- Anthropic — assisted title-block reading only, as described above.
Retention
Account data and drawings are kept while your subscription is active. After cancellation you have 30 days to export everything (a one-click zip per job); we then delete it. Backups roll off within a further 30 days. Server logs are kept for 90 days.
Your rights
Under UK GDPR you can ask for a copy of your data, correction, deletion, or restriction of processing, and you can complain to the ICO (ico.org.uk). Email hello@drawinginbox.com and we will respond within one month.