Privacy Policy

Who is responsible

Floyd Guevarra, an individual operating as a sole proprietor in the Philippines, runs FalCAD and is responsible for the personal data described here. Write to [email protected] with any question or request about your data.

Local projects stay on your device

Projects you open from your disk in the desktop app or the web app, and projects the web app keeps in your browser's storage, never leave your device. We do not receive or see them. They reach our servers only when you upload a project to the cloud yourself.

What we store

Account

Your email address, the name you choose, a salted hash of your password (never the password itself), when you signed up, and the teams you belong to with your role in each.

Sessions

Hashed sign-in tokens with their creation and expiry times, so you stay signed in and can sign out other devices.

Cloud projects

The projects you upload and every change made to them, comments, who is a member with which role, share links you create, and invitations, which include the invited person's email address.

Logs

A security log of account and project events (sign-ins, membership and permission changes, deletions) and server logs with IP addresses, times and the requests made. They help us protect accounts, prevent abuse and fix problems.

Billing

Your Paddle customer and subscription ids, the plan, its status, seats and next billing date. Paddle processes the payment itself. Card and bank details go to Paddle only and never reach us.

We do not sell personal data, show advertising or use analytics trackers.

Why we use it

• To provide the service you signed up for: your account, cloud projects, sharing and real-time editing (performance of our contract with you).
• To bill paid plans through Paddle and keep records the law requires (contract and legal obligations).
• To keep the service secure, prevent abuse and fix faults (our legitimate interest in running a safe service).
• To send messages about your account, such as invitations, security notices and changes to these policies.

Cookies

FalCAD sets one cookie: the session cookie that keeps you signed in. It is set by api.falcad.com when you sign in, cannot be read by scripts on the page, and is removed when you sign out. There are no analytics, advertising or tracking cookies, so there is no cookie banner.

When you open the checkout, Paddle's payment window loads from paddle.com and may use its own cookies to process the payment. Paddle's privacy notice covers them.

Who helps us run FalCAD

These providers process personal data for us, only for the purposes above:

Paddle

Paddle.com Market Limited (United Kingdom) and its affiliates sell our subscriptions as Merchant of Record. Paddle processes payments, tax, invoices and refunds, and is responsible for the payment data it collects.

Hosting provider

Our servers, which run the FalCAD API and its database and store cloud projects, are rented from a hosting provider.

Cloudflare

Cloudflare, Inc. (United States) handles DNS, encrypted connections and protection against attacks for falcad.com and its subdomains.

Some of these providers process data outside the country where you live. Where the law requires it, we rely on safeguards such as standard contractual clauses.

How long we keep it

• Account data and cloud projects: for as long as your account exists. Deleted cloud projects are removed with their history.
• Sessions: until they expire or you sign out, at most 60 days after you sign in.
• Logs: only as long as needed for security and troubleshooting.
• Billing records: as long as tax and accounting law requires.

Your rights

You can ask to see the personal data we hold about you, to correct it, to receive a copy, to delete it, or to object to or limit how we use it. You can change your name and password on your account page and export your projects at any time. For everything else, write to [email protected] from the address you sign in with. We answer within 30 days.

These rights come from the Data Privacy Act of 2012 of the Philippines and, where they apply to you, from laws such as the GDPR. You can also complain to the National Privacy Commission of the Philippines or to the data protection authority where you live.

Security

Connections are encrypted. Passwords and sign-in tokens are stored only as hashes. Every request to a cloud project is checked against your current permissions. If a breach affects your data, we tell you and the authorities as the law requires.

Children

FalCAD accounts are not meant for children under 16. We do not knowingly collect their personal data.

Changes

We update this policy when what we do changes. For changes that matter, we tell you by email or in the service before they apply.