Privacy Policy

Last updated: October 15, 2026

CYZEA SAS (“we”, “us”, “our”) operates the DrawNet.ai web application. This Privacy Policy explains how we collect, use, and protect information when you use our Service, in compliance with the EU General Data Protection Regulation (GDPR), French data protection law, and the California Consumer Privacy Act (CCPA).

1. Data Controller

• Company: CYZEA SAS
• Address: 6 Rue d’Armaillé, 75017 Paris, France
• SIREN: 895 162 600
• Contact: contact@drawnet.ai

2. Data We Collect

2.1 Analytics Data (Google Analytics 4)

We use Google Analytics 4 (GA4) to understand how visitors use DrawNet.ai. GA4 collects:

• Pages visited and navigation flow
• Approximate geographic location (country/city level)
• Browser type and operating system
• Referral source
• Session duration and interactions

IP anonymization is enabled. Google Analytics never stores your full IP address.

2.2 Local Data (localStorage)

Your diagrams, preferences, and application state are stored in your browser’slocalStorage. This data is not transmitted to our servers, with the two exceptions described in 2.3 and 2.4 — both of which you trigger deliberately, and neither of which stores anything. Two further values stored there, described in 2.5, are never transmitted either: they are read on your device to decide which counter to add one to, and whether a notice you have already seen should stay closed.

2.3 AI Feature

When you use the AI generation feature — describing a diagram, or asking for a device icon — the text you submit, and the photo if you attach one, is sent to an AI provider for processing. We do not store it: it is used to build the answer and then dropped.

Which provider handles it depends on what you asked for, and the two halves of the feature are answered in different countries.

Describing a diagram is processed on OVHcloud AI Endpoints, in Gravelines, France, on open-weight models OVHcloud runs on its own infrastructure. OVHcloud states that data is not stored or shared during or after model use, and that it is never used to train or improve the models. Nothing you type into the diagram generator leaves the European Union unless that service is unavailable or too slow, in which case the request falls back to Anthropic so the feature still answers.

Asking for a device icon — including the photo, when you attach one — is processed by Anthropic (Claude), in the United States. We chose that deliberately and it is a change from earlier versions of this policy: on the same requests, the European models we compared drew equipment that did not match the photo, and an icon that misrepresents your hardware is worse than no icon at all. Anthropic does not use API inputs or outputs to train its models, and retains them for a limited period for safety and abuse monitoring only. If that service is unavailable, this request falls back to OVHcloud in France.

Both paths are transient either way — nothing you send to the generator is stored on our side. Transfers to the United States are covered by the Standard Contractual Clauses in 4.3. If you would rather no photo of your equipment left the EU, do not use the icon generator: every other feature of the editor runs in your browser or in France.

2.4 Tidy Links

Tidy Links runs on our server, so pressing it sends the geometry of your diagram: where each device sits, how big it is, how many ports it has, how its port strip is oriented, and which ports each cable joins. Device names, port IP addresses, cable labels, notes and images are not sent, and the endpoint refuses them if they are. The geometry is used to compute the cable layout, returned, and not stored.

2.5 Anonymous Usage Counters

Independently of Google Analytics, DrawNet.ai keeps its own counters so we can tell which features are actually used. When you do something in the editor — open it, add a device, run Tidy Links, export a file — the name of that action aloneis sent to our server, which adds one to a total for the day. Nothing accompanies the name: no diagram content, no page address, no identifier, and no IP address is stored with it. What we hold is a table of the form “on 3 September, 24 people ran Tidy Links”, from which no individual visit can be recovered.

When the editor crashes, the count also names the place in our own codewhere it failed — a file of the application, a line and a column — so we can find and fix it. That place is the same for everyone who meets the same fault; it says nothing about you or about what you had drawn.

Two of these counters distinguish a browser opening the editor for the first time from one coming back, so we can tell whether the tool is used again after the first try. To do that, your browser stores the date of your first visit in itslocalStorage and keeps it there. That date never leaves your device: it is compared with today’s date locally, and only the resulting bucket — first visit, returned within 7 days, within 30, or later — is counted. A date is not an identifier; every browser that first arrived on the same day holds exactly the same value, and it cannot single you out. It expires after 13 months— past that age it is no longer used, and the next visit throws it away and starts again from that day — and clearing your browser data removes it immediately.

This is audience measurement in the strict sense allowed without consent by the CNIL: the result is used only to understand and improve the Service, it is never cross-referenced with any other data, never used to follow you across websites, and never shared with or sold to anyone. Should you decline analytics in the banner, no such date is written at all and your visits are not counted.

The second value is a single mark recording that we have shown you the notice about the commercial licence. That notice appears at most once, when the diagram you have drawn has the shape of professional work — a judgement made entirely on your device, from the diagram in front of you, which is never sent anywhere and never looked at by us. What reaches our server is one of three counts: that a notice was shown, that it was followed to the pricing page, or that it was dismissed. Nothing distinguishes one of those from another person’s, and clearing your browser data removes the mark.

2.6 Feedback You Send

If you use the “Bug or Idea” form, we store what you wrote: the type of report, its title, its description, the severity you picked, and two counters describing the diagram you had open (how many devices and how many connections). We do not store your IP address with it.

That form has one optional field for a name, used only to credit you publicly on our What’s New page if your report leads to a change. It is the only personal data we ever ask for, it is never required, and leaving it empty keeps your report anonymous. The legal basis is your consent, given by filling the field in; you can withdraw it at any time by writing to contact@drawnet.ai and the name will be removed from the page and from our records.

2.7 Purchases

A commercial licence, or the removal of the export credit line from one diagram, is paid on a page operated by Stripe. Card details are entered there and never reach us. Stripe passes us what you enter to complete the purchase — email address, and where you give them a company name, billing country or address and VAT number — which we keep as accounting records.

For the removal from one diagram, the editor gives that diagram a random identifier, sends it to Stripe with the payment, and sends it to our server when it checks whether the payment has gone through. The identifier says nothing about what the diagram contains; the diagram itself is never sent. Our server does not store it: it asks Stripe, and the answer is kept inside the diagram’s own file in your browser.

For a commercial licence paid by card, Stripe sends you back to the editor with the identifier of the payment session; the editor sends it to our server, which asks Stripe whether that session paid for a licence and answers with a licence key. Our server stores neither. The key holds a payment reference and an end date, is kept in your browser’s storage, and is checked there; entering it sends nothing.

2.8 Data We Do Not Collect

Apart from the optional name described above and what a purchase requires (2.7), we do not collect: email addresses, payment information, account credentials, or any other personally identifiable information. No account is required to use DrawNet.ai.

3. Legal Basis for Processing (GDPR Art. 6)

• Consent (Art. 6(1)(a)): Analytics cookies are placed only with your consent.
• Consent (Art. 6(1)(a)): The optional name in the feedback form is stored and displayed only because you chose to enter it.
• Legitimate interest (Art. 6(1)(f)): Improving and maintaining the Service, including reading the reports sent through the feedback form.
• Contract and legal obligation (Art. 6(1)(b) and (c)): Taking a payment you asked to make, and keeping the accounting records the law requires of it.

4. Hosting & Sub-processors

4.1 Hosting

DrawNet.ai is hosted on a dedicated virtual server provided by OVHcloud (OVH SAS, 2 Rue Kellermann, 59100 Roubaix, France). The server is located in London, United Kingdom. The UK benefits from an adequacy decision by the European Commission (adopted June 28, 2021), which means personal data can be transferred from the EU/EEA to the UK without additional safeguards. OVHcloud is a French company subject to the GDPR.

4.2 Sub-processors

4.3 International Transfers

Google Analytics may transfer data to the United States, and so does the AI feature in the two cases described in 2.3 — every device-icon request, and a diagram request only when the European service is unavailable. Both companies operate under Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate data protection. Transfers to the UK are covered by the EU adequacy decision mentioned above. Diagram generation is otherwise processed in France and does not leave the EU.

5. Data Retention

• Analytics data: retained for 14 months, then automatically deleted.
• localStorage data: persists until you clear your browser data, except the first-visit date of 2.5, which expires after 13 months and is replaced on the next visit.
• Anonymous usage counters: daily totals per action name, with nothing attached to them. They identify no one and are kept as a historical record of how the Service is used.
• Server logs: our web server records each request (IP address, page requested, date, browser and referring page) to keep the Service secure and to measure its traffic. These logs are kept for 90 days, then deleted.
• Purchase records: kept for ten years, the period French commercial law requires for accounting documents.

6. Your Rights

Under the GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (“right to be forgotten”)
• Restrict processing
• Port your data to another service
• Object to processing
• Withdraw consent at any time

To exercise these rights, contact us at contact@drawnet.ai.

You also have the right to lodge a complaint with the French data protection authority (CNIL) at www.cnil.fr.

7. California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, to request deletion, and to opt out of the sale of personal information. We do not sell personal information.

8. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised date. We encourage you to review this page periodically.

9. Contact

For any questions about this Privacy Policy, contact us at contact@drawnet.ai.