Privacy Policy

Last updated: June 26, 2026 · Effective immediately for all users
Operator: SCIDraw · Contact: support@scidrawio.com

1. Data We Collect

• Account data: email address, password (bcrypt-hashed), nickname, optional affiliation.
• Project data: vector drawings, uploaded reference images, AI-generated outputs you save.
• Usage data: pages visited, AI prompts submitted (for abuse prevention and quality improvement), IP address (hashed), browser type.
• Payment data: PayPal processes your payment. We receive only the PayPal transaction ID and billing email — never your card number.
• Academic verification: if you register with a .edu or .ac.* email, we grant you a 7-day free VIP. We do not contact your institution.

2. Where Your Data Lives

Your data is stored on Alibaba Cloud infrastructure located in the Hong Kong Special Administrative Region. Backups are also held in Hong Kong. We do not store user data on servers in mainland China or the United States.

3. Legal Basis for Processing (GDPR Art. 6)

• Contract: account creation and project storage necessary to deliver the service you requested.
• Legal obligation: retaining billing records for tax/accounting purposes.
• Legitimate interest: preventing abuse, fraud, and ensuring service security.
• Consent: optional analytics and marketing emails (you can opt out anytime).

4. International Transfers & SCC

Hong Kong is not covered by the EU adequacy decision. For any transfer of personal data from the EU/EEA or UK to Hong Kong, we rely on the European Commission's Standard Contractual Clauses (SCCs) — the modular clauses adopted by Commission Implementing Decision (EU) 2021/914. We act as the data importer; you may request a copy of the SCCs by emailing us.

AI inference calls may transit to model providers in mainland China (Zhipu GLM, Alibaba DashScope, MiniMax). These calls contain only your prompt text and uploaded images — never your account password or billing data. We require these providers to protect your data under written agreements that include confidentiality and security obligations. Because they are located in jurisdictions not covered by an EU adequacy decision, you acknowledge this cross-border transfer when submitting prompts to AI features.

5. How We Use Your Data

• Provide the editor, AI generation, and project management features.
• Send transactional emails (verification codes, password resets, payment receipts).
• Detect abuse (mass account creation, payment fraud, scraping).
• Aggregate, de-identified analytics to improve features.

We do not train AI models on your private project content.

6. Data Retention

• Active accounts: indefinitely while you use the service.
• Deleted accounts: project data purged within 30 days; billing records kept 7 years for tax compliance.
• AI generation logs: 90 days, then automatically deleted.

7. Your Rights (GDPR / UK GDPR / CCPA)

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your account and associated data ("right to be forgotten").
• Restrict or object to processing for marketing purposes.
• Data portability — export your projects in SVG/JSON.
• Withdraw consent at any time without affecting prior processing.
• Lodge a complaint with your local data protection authority or the Hong Kong PCPD.

To exercise any right, email support@scidrawio.com. We respond within 30 days.

8. Cookies

We use only essential cookies (session authentication) and optional analytics cookies. See our Cookie Policy for details. No third-party advertising cookies.

9. Children's Privacy

SCIDraw is not directed to children under 13 (or 16 in the EU). We do not knowingly collect data from children. If you believe a minor has registered, contact us and we will delete the account.

10. Security

Passwords are bcrypt-hashed. HTTPS is enforced site-wide with HSTS. Database access is restricted to application servers inside a private network. Payment data never touches our servers — handled exclusively by PayPal. Despite these measures, no internet service is 100% secure. In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours (per GDPR Art. 33), and notify affected users without undue delay where the breach is likely to result in high risk to their rights and freedoms (per GDPR Art. 34).

11. Changes to This Policy

We will update this page and the "Last updated" date above whenever we change our practices. Material changes will also be announced by email to active users at least 14 days before taking effect.