Privacy Policy

Account: your email address and, if you sign in with Google, your name and Google account identifier. Sign-in uses a one-time email link or Google; we never see a password.

Content: the designs you save (specifications, edit history and a preview thumbnail), the organizations you belong to and your role in them, and your settings.

Prompts and images: the text you write and the reference photos you attach are sent to generate a design. Photos are reduced in your browser, are not stored by us, and uploaded logos are converted to shapes in your browser and become part of the design specification.

Usage: counters needed to enforce plan credits and rate limits, and technical logs generated by our hosting. We also measure page views and site performance with Vercel Web Analytics and Speed Insights, which do not use cookies and do not identify you across sites or over time.

Billing: your plan and subscription status. Card and payment details are handled only by Lemon Squeezy; we do not receive or store them.

Optional research data: only if you opt in, we keep your requests and the resulting designs (including your final exported design) to improve the service. This is off by default and you can turn it off at any time.

To provide the service you ask for (contract): authentication, saving designs, generating and checking models, sharing links, credits and billing.

To keep the service secure and prevent abuse (legitimate interest): rate limits, fraud and abuse prevention.

To improve our recipes and quality (consent): only the optional research data described above.

To meet legal obligations, such as tax and accounting, through our payment provider.

AI providers (Anthropic and OpenAI) receive your prompt, the current design specification and any attached reference images or model previews so they can propose a design. They act on our behalf and we ask that they do not train their models on this data.

Supabase provides authentication and our database. Vercel hosts the application. Lemon Squeezy processes payments as merchant of record and is an independent controller for payment data.

We do not sell your personal data and we do not use advertising trackers. People with a share link can see the design you shared, but not your account details.

Our providers may process data in countries other than yours, including the United States. Where required, transfers rely on adequate safeguards such as standard contractual clauses.

We keep your account and designs until you delete them or your account. When you delete your account, your personal organization, designs, thumbnails, share links and optional research data are deleted. Backups are overwritten on the provider’s normal schedule.

We may retain limited billing records for as long as tax and accounting law requires.

Depending on where you live (for example under Argentine data protection law or the GDPR) you can ask to access, correct, delete, restrict or port your data, object to processing and withdraw consent at any time. You can delete your account yourself from your settings; for anything else write to support@tirbby.com.

You may also complain to your data protection authority (in Argentina, the Agencia de Acceso a la Información Pública).

Access to your data is limited by your account and organization membership at the database level, connections are encrypted and API keys stay on the server. No system is perfectly secure, so we cannot guarantee absolute security.

TirbbyCAD is not intended for children under 16 and we do not knowingly collect their data. If you think a child has given us data, contact us and we will delete it.

We will update this policy when our practices change and tell you about material changes in the service or by email.