Privacy notice

In force from 26 October 2026

This notice explains what personal data Lineplate handles, why, for how long, and your rights over it under the UK GDPR and the Data Protection Act 2018. The short version: the studio works in your browser, so it never sends us your CAD files, projects or drawings. The only way a CAD file reaches us is if you email one to us yourself, for our drawing service.

Who we are

The data controller is Galaxy Technology, a Scottish partnership of Lesley McCoy and Michael McCoy, 31 Priorwood Road, Newton Mearns, Glasgow G77 6ZZ, Scotland, registered with the Information Commissioner's Office under reference ZC212441 (see the ICO's public register). For anything about this notice or your data, email privacy@lineplate.com. We reply within one month.

What we don't receive

Your CAD files, the projects you make from them, your drawings, manuals and exports stay in your browser's storage on your own device. Our server has no route that accepts them, so the studio can't give them to us to read, keep, share or lose. Security and your files lists exactly what is stored where on your device and how to delete it. Our account database has no place for file names, part names or geometry.

One exception is in your hands: if you point the studio at a kernel of your own in its kernel settings, your browser fetches that kernel from the address you gave and hands it your file. Whoever runs that address is then responsible for what it does.

When you visit the site

Requests. Every request passes through Cloudflare and reaches our server on Microsoft Azure, which see your IP address, your browser's user-agent string, the page requested and the time. Cloudflare uses them to deliver the site and protect it from abuse, and keeps its own logs under its own policy.
Our server's logs record errors and service events, not your visits. If something goes wrong while we email you, the log line can contain your email address. They are deleted after 30 days.
Abuse limits. To stop the sign-in, quote and free-drawing forms being used to send mass email, the server counts requests from each IP address over the last hour, in its memory only. The count is never written to disk and is gone when the server restarts.

We don't use analytics services, advertising or tracking. We do count, as a total for each day, how many times a few things happen on the site: a page such as pricing being opened, a form sent, a checkout started. Nothing is counted in the studio itself. Only the total is stored. No cookie is set for it, and nothing about you, your device or your IP address is recorded, so the totals can't be linked to anyone. The fonts are served by us, so your browser doesn't contact Google or anyone else for them.

When you email us or ask for a quote

Email to hello@lineplate.com or privacy@lineplate.com is forwarded by Cloudflare to our business mailbox. We use your address and what you write to reply, and keep the correspondence for as long as we need it to deal with your question, and for up to 6 years where it is about a purchase.
The quote form sends us, by email through Microsoft Azure Communication Services, what you type into it (company, name, email address, country, number of editors, message) and, if you are signed in, your account's email address. We keep it as correspondence. Our database records only that a quote was asked for and for how many editors.
The free-drawing form sends us, by email, what you type into it (email address, company, a link to your file, a note), and sends one email to the address you give, asking you to reply with the file. We keep it as correspondence. Our database records only that day's total of requests, never who sent one.
CAD files for the drawing service. If you send us a CAD file (attached, or as a link) so that we can draw it for you, we keep the file, and the projects and drawings we make from it, only to do that job. A CAD file can hold personal data, such as the name of the person who made it in a STEP file's header; we use none of it for anything else, and never share the files. We delete them, including the attachments from our mailbox, 30 days after we deliver the drawings, or, if the job doesn't go ahead, 30 days after we last hear from you. The emails about the job and its invoice are kept like other correspondence, above. They don't go into our account database.

If you have an account

Accounts are for Pro and Team. For an account we hold exactly this:

You: your email address (you sign in with a link sent to it; there is no password), when you signed up, last signed in and confirmed you are buying for a business and accepted the terms, which version of the terms that was, and whether you are an administrator of the service. We hold no name or photo.
Your company's workspace: its name, its country, its VAT number if you gave one and when the EU's VIES service confirmed it, and the reference of its customer record at Stripe.
Its members: who belongs to it and in which role (owner, editor or reviewer). If you were invited, the workspace's owner gave us your email address: we hold the invitation (your address, the role and the dates) and email you the link.
Its subscription: the plan, number of seats, status, billing period, and whether the latest invoice was paid, as Stripe reports them, and your answer to "How did you find Lineplate?" if you chose one at checkout (it's optional, and a choice from a list, never free text). Never card or bank details: Stripe holds those, and we never see them.
A log of account events (signed in, invited someone, subscription changed, data exported, account deleted), recording the internal reference of the account that did it, never an email address or company name, so we can answer questions and spot misuse.
Sign-in: a token for each emailed link, which works for 24 hours and is deleted when it is used, or, if it never is, the next time anyone asks for a link after it has expired.

We make no decisions about you by automated means alone, and we don't sell or share personal data except with the providers listed below.

Why, and on what basis

Delivering the site, server logs and abuse limits: our legitimate interest in running a secure website.
Email and quotes: our legitimate interest in answering you, or steps you ask us to take before entering a contract.
CAD files sent for the drawing service: steps you ask us to take before entering a contract (the free first view), and then performing it.
Account, workspace, members, invitations and subscription: to perform our contract with your company, and our legitimate interest in providing the service to the people it names.
VAT numbers and billing records: to meet our legal obligations, including tax law.
The account event log: our legitimate interest in running the service securely and answering questions about it.

How long we keep it

Account data: while the account exists. Delete your account from the account page (or ask us) and your email address, sign-in data, memberships and invitations to you are deleted, and the account record keeps no email address. If you own the workspace, its name, VAT number and invitations go too.
Billing records (the subscription's plan, seats, periods and payment status) are kept with nothing that identifies you, for about 6 years, because UK tax law requires transaction records. Stripe keeps its own records of the customer, invoices and payments, which tax law also requires, under its own retention rules.
The account event log is kept while the service runs. Once your account is deleted, its entries point at an account with no email address, and so no longer identify you.
CAD files sent for the drawing service, and our working copies: 30 days after we deliver the drawings, or after we last hear from you if the job doesn't go ahead. The emails and invoice for the job are kept as correspondence, for up to 6 years.
Server logs: 30 days.
Database backups roll over after 14 days, so a deletion is gone from backups within that time.

Cookies and browser storage

We set no cookies unless you ask for a sign-in link or sign in. Signing in uses three cookies, all strictly necessary for the account to work: one keeps you signed in for up to 14 days after your last visit, and signing out removes it; the other two protect the sign-in form and remember which page to return you to, and are gone when you close your browser. Cloudflare may set its own strictly necessary cookie to tell people from automated traffic.

The studio uses your browser's own storage (IndexedDB, the origin private file system and localStorage) to keep your projects, drawings, line-style presets and settings, such as your light or dark theme and the studio's layout, on your device. That storage is strictly necessary for the studio to do what you ask of it, none of it is sent to us, and you can delete it at any time (see Security and your files). Because everything we store is strictly necessary, we don't ask for consent to it.

Who else is involved

These providers process personal data for us, or receive it so that we can provide the service:

Cloudflare: DNS, TLS and protection from abuse for every request to the site, and forwarding of email sent to our addresses. Receives your IP address, browser details and the pages you request; the email you send us. Where: a global network, including the US.
Microsoft Azure: hosting of the website and the account database. Receives everything our server and database hold (below). Where: the UK (UK South region).
Microsoft Azure Communication Services: sending email: sign-in links, invitations and quote requests. Receives the recipient's email address and the email's content. Where: stored in the UK; delivered by Microsoft's mail servers, which may be outside the UK.
Resend: a standby email sender, used only if we switch back to it from Azure Communication Services. Receives the recipient's email address and the email's content. Where: the US.
Stripe: payments, invoices (including those for the drawing service), the billing page and tax calculation. Receives your company's name, country and VAT number, the email address of the person subscribing or being invoiced, and how you found Lineplate if you said; card and bank details you give Stripe directly. Where: the UK, the EU and the US.
The European Commission's VIES service: checking an EU VAT number, when an EU business gives one at checkout. Receives your company's country and VAT number. Where: the EU.

Stripe also uses payment data for its own purposes, such as preventing fraud and meeting its own legal duties, under its own privacy policy. Where a provider processes data outside the UK, it does so under the UK's adequacy regulations (including the UK extension to the EU-US Data Privacy Framework, where the provider has signed up to it) or the ICO's International Data Transfer Addendum to the EU standard contractual clauses, as set out in that provider's data processing terms.

We don't store your projects: there is no cloud workspace. If one is ever offered, this notice will be updated before it is switched on.

Your rights

Signed in, you can download the personal data our database holds about you, and delete your account, from the account page. For anything else, write to privacy@lineplate.com. Under the UK GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data deleted;
restrict or object to processing;
receive your data in a portable format; and
complain to the Information Commissioner's Office, though we'd like the chance to put things right first.

Children

Lineplate is a tool for work and isn't intended for anyone under 18. Accounts are for businesses only.

Changes

If this notice changes in a way that matters, we'll update the date at the top, say what changed, and email account owners before the change takes effect.