DrawX Privacy Policy

Privacy Notice

At Scalex Technology Solutions LLP (“Scalex,” “we,” “us” or “our”), we are committed to protecting privacy and the security of information processed through DrawX. This Privacy Policy explains how we collect, use, disclose, store, retain and protect personal information when you visit the DrawX website, request information or a demonstration, create or administer a DrawX account, or use the DrawX Web Application and related services (collectively, “DrawX” or the “Service”).

DrawX is a web-based PDF processing application for industrial, engineering, manufacturing and technical drawings. Users can upload PDF drawings, detect text contained in those drawings, redact selected text and/or translate or convert selected text into another language, and generate processed PDF copies.

This Privacy Policy applies to both the public DrawX website and the DrawX Web Application, including the authenticated environment.

Where Scalex processes personal information on behalf of a business customer, that customer may act as the controller/business responsible for the relevant information and Scalex may act as a processor/service provider, depending on the circumstances and applicable law.

1. Information We Collect

1.1 Personal Information

When you visit the DrawX website, request a demonstration, contact us, create an account, accept an invitation to a DrawX organization, subscribe to DrawX, use the Web Application or communicate with us, we may collect information you voluntarily provide, including:

• Name; business email address; phone number; company or organization name; job title or professional role.
• Account and login information, including authentication-related information.
• Contact, billing and subscription information where applicable.
• Support requests, communications, feedback and inquiry information.
• Other information you choose to provide.

1.2 Usage and Technical Data

We may automatically collect IP address; browser and device information; operating system; login and authentication activity; pages or screens accessed; application activity; session and event information; error and diagnostic information; usage statistics; security and access logs; and approximate location derived from an IP address where applicable. We may collect this information through cookies, log files, analytics tools and similar technologies.

1.3 Drawing and File Content

When you use DrawX, we may process PDF files and information contained in them, including industrial, engineering, manufacturing or technical drawings; text detected or extracted from drawings; labels, notes, title blocks, identifiers and annotations; translated or converted text; redaction instructions and selections; processed PDF copies; file names and metadata; and other content submitted or generated through DrawX.

Industrial drawings may contain confidential business information, proprietary technical information, personal information or other sensitive information. We process such content to provide the requested DrawX functionality and related services.

1.4 Account, Organization and Activity Information

Where DrawX supports organization accounts, we may process user roles, permissions, organization membership, file activity, processing history, timestamps and other information necessary to administer, secure and operate the Service.

2. How We Use Information

• Provide, operate, maintain and secure DrawX.
• Create and administer customer and user accounts and organization access.
• Authenticate users and manage permissions.
• Receive, store and process PDF drawings and related content as requested by users.
• Detect and extract text from PDF drawings.
• Perform requested redaction and create processed copies.
• Perform requested language translation or language conversion and create processed copies.
• Provide previews, processing status, downloads and other requested functionality.
• Provide customer service, technical support, demonstrations, trials and proof-of-concepts.
• Monitor performance, diagnose errors and improve reliability and security.
• Detect, prevent and investigate fraud, abuse, security incidents and unauthorized access.
• Communicate about accounts, subscriptions, service changes, maintenance and security.
• Process subscriptions, billing and payments where applicable.
• Comply with legal, regulatory and contractual requirements.
• Protect the rights, property and security of Scalex, customers, users and others.

3. AI, OCR and Automated Processing

DrawX may use OCR, artificial intelligence, machine learning, rules-based processing, language models, automated text detection and other automated technologies to detect, extract, redact, translate or otherwise process text contained in PDF drawings.

Automated processing may produce errors, including missed text, incorrectly detected text, incorrect redaction selections, translation errors, formatting changes or other unexpected results. Users are responsible for reviewing processed PDFs before relying on or distributing them.

3.1 Customer Content and General-Purpose AI Models

Unless expressly agreed with the customer in writing, Scalex does not use Customer Content to train or fine-tune general-purpose AI models.

Where third-party AI, OCR, machine-learning or translation providers are used, they may process information on Scalex’s behalf subject to applicable contractual, confidentiality, security and data-processing requirements.

4. Customer Content and Ownership

“Customer Content” means PDF drawings, files, text, annotations, redaction selections, translation instructions, terminology, metadata, processed copies and other content made available by a customer or Authorized User through DrawX.

Customers retain ownership of Customer Content. Scalex does not acquire ownership merely because it processes Customer Content to provide DrawX.

We process Customer Content only as necessary to provide DrawX; perform requested text detection, redaction and language conversion; store and retrieve original and processed files; provide support; maintain security and reliability; prevent misuse; comply with applicable law; and otherwise as authorized by the customer or applicable agreement.

5. Original Files and Processed Copies

DrawX creates a new processed copy when a user performs a redaction or language conversion operation. The original uploaded PDF is not automatically overwritten or deleted by that operation.

Accordingly, a customer may have an original PDF and one or more processed PDFs, including redacted or translated versions, in its DrawX account. A redacted copy should not be understood as deletion or destruction of the original drawing.

The customer is responsible for selecting the appropriate version for sharing, publication, manufacturing, engineering, procurement, quality or other intended use.

6. Redaction and Translation Privacy Considerations

Redaction and translation may involve processing the text and visual content of uploaded PDF drawings. Users should not upload information they are not authorized to process.

DrawX is an assistive software service. Automated text detection and redaction may not identify every item of information, and translation or language conversion may not accurately reflect every technical term, abbreviation, symbol or instruction. Users should review the resulting PDF before disclosure or reliance.

Scalex does not represent that a DrawX-generated redaction satisfies a particular legal, regulatory, contractual or confidentiality requirement unless expressly agreed in writing.

7. Communications

7.1 Service and Account Communications

We may use personal information to respond to inquiries; provide support; communicate about accounts and subscriptions; send service-related notifications; provide information about DrawX and requested demonstrations; communicate about security, maintenance or changes; and process billing-related communications.

7.2 Marketing Communications

Where permitted by law, we may send promotional communications. You may opt out using the instructions in those communications. Non-promotional communications necessary to provide the Service, administer an account, maintain security or comply with law may continue.

8. Analytics and De-Identified Information

We may use aggregated, anonymized or de-identified information to understand DrawX usage, monitor performance, identify trends, improve products and services, develop features, and improve security and reliability. We do not use aggregated or de-identified information to publicly identify customers or disclose confidential Customer Content.

9. Sharing of Information

9.1 Service Providers

We do not sell Customer Content or personal information for monetary consideration. We may share information with trusted providers supporting cloud hosting, infrastructure, authentication, storage, monitoring, analytics, customer support, communications, payment processing, security, OCR, translation and AI/machine-learning services. Such providers are engaged to process information for relevant business purposes and subject to appropriate confidentiality, security and data-processing requirements.

9.2 Business Transfers

Information may be transferred as part of a merger, acquisition, restructuring, financing, sale of assets or similar transaction. Where required by law, appropriate notice will be provided.

9.3 Legal Requirements

We may disclose information where required by law, regulation, court order, legal process or valid governmental request, or where reasonably necessary to protect rights, property, security, customers, users or others, or investigate fraud, security issues or misuse.

10. Data Security

We implement reasonable technical and organizational measures designed to safeguard personal information and Customer Content against unauthorized access, disclosure, alteration, loss or destruction.

Depending on the environment, measures may include access controls; authentication and authorization; least-privilege access; encryption in transit; encryption at rest where applicable; credential protection; logging and monitoring; backup and recovery controls; security incident procedures; and secure software development practices.

No method of transmission or electronic storage can guarantee absolute security. Customers remain responsible for credentials, permissions, devices, networks and connected third-party systems.

11. Your Choices and Rights

Depending on applicable law, individuals may have rights to access personal information; request correction or deletion where applicable; request restriction; object to certain processing; request portability; withdraw consent where applicable; obtain processing information; and raise a privacy complaint.

You may exercise applicable rights using the contact details in Section 24.

Where Scalex processes personal information on behalf of a DrawX business customer, that customer may determine the purposes and means of processing and may be responsible for responding to individual requests. Scalex will assist as required by applicable law and contractual arrangements.

12. California Consumer Privacy Act (CCPA)

If you are a California resident and the California Consumer Privacy Act and related California privacy laws apply to our processing of your personal information, this Section provides additional information about the categories of personal information we may collect, use, disclose or otherwise process and applicable California privacy rights.

12.1 Scope and Applicability

This Section applies to personal information collected through the DrawX website, account registration, demonstrations, communications, subscriptions and use of the DrawX Web Application, to the extent the CCPA applies.

Where Scalex processes personal information solely on behalf of a DrawX business customer and acts as a service provider or contractor under applicable California law, the relevant customer may be responsible for responding to certain California privacy requests.

12.2 Categories of Personal Information

• Identifiers — name, business email address, telephone number, IP address, account identifiers and similar identifiers.
• Personal information described in California Civil Code §1798.80, where applicable.
• Commercial information — subscription, billing, transaction, purchase and requested-service information.
• Internet or electronic network activity information — login activity, browser/device information, pages or features accessed, interaction with DrawX, sessions and security logs.
• Professional or employment-related information — company name, job title, professional role and business contact information.
• Geolocation information — approximate location inferred from IP address or similar technical information; DrawX does not require precise geolocation for ordinary use.
• Inferences — limited inferences derived from account, usage or interaction information for service, security or operational purposes.
• Sensitive personal information — DrawX does not intentionally request sensitive personal information for ordinary use, but such information may be contained in Customer Content or voluntarily provided.

12.3 Sources of Personal Information

• Directly from you.
• From your organization or employer.
• From your use of DrawX, including application activity, login information, security events and technical information.
• From connected systems or integrations authorized by you or your organization.
• From service providers supporting website, application, communications, analytics, security, payments or business operations.
• From publicly available sources, where applicable and permitted by law.

12.4 Business and Commercial Purposes

We may collect, use and disclose personal information for providing, operating, maintaining and securing DrawX; account administration; authentication; processing PDF drawings and requested redaction/translation; support and demonstrations; performance monitoring; fraud and security prevention; billing; permitted marketing communications; analytics and product development; legal compliance; and exercising or defending legal rights.

12.5 Categories of Recipients

• Cloud hosting and infrastructure providers.
• Database, storage and backup providers.
• Authentication and identity providers.
• Analytics, monitoring and logging providers.
• Customer support and communication providers.
• Payment processors and financial service providers.
• Security and fraud-prevention providers.
• OCR, translation, AI and machine-learning service providers used for specific DrawX functionality.
• Professional advisers, auditors, insurers and legal advisers where reasonably necessary.
• Government authorities, courts, regulators or other parties where disclosure is required or permitted by law.
• Parties involved in a merger, acquisition, financing, restructuring or sale of assets, subject to applicable legal requirements.

12.6 Sale and Sharing of Personal Information

We do not sell personal information for monetary consideration. We also do not knowingly share personal information for cross-context behavioral advertising in connection with ordinary DrawX operation. If our practices change in a manner that constitutes a “sale” or “sharing” under applicable California law, we will update this Privacy Policy and provide disclosures and opt-out mechanisms required by law.

12.7 California Privacy Rights

• Right to Know.
• Right to Know Sources and Purposes.
• Right to Know Recipients.
• Right to Delete, subject to statutory exceptions.
• Right to Correct inaccurate personal information.
• Right to Opt Out of Sale or Sharing, where applicable.
• Right to Limit Certain Uses of Sensitive Personal Information, where applicable.
• Right to Non-Discrimination.

12.8 Exceptions and Limitations

California privacy rights are subject to exceptions and limitations under applicable law, including where retention or processing is necessary to complete a transaction, detect security incidents, comply with legal obligations, exercise or defend legal claims, maintain certain records or for another purpose permitted by law.

12.9 California Privacy Requests

California residents may submit applicable requests using the contact information in Section 24. We may need to verify identity before completing a request. Where DrawX processes personal information on behalf of a business customer, we may direct the request to that customer or require the customer to submit or manage the request.

12.10 Authorized Agents and Response Timing

Where permitted by applicable California law, an individual may designate an authorized agent. We may require documentation establishing the agent’s authority and may independently verify identity. We will respond to verified requests within periods required by applicable law and provide legally required extension notices.

12.11 California Privacy Contact

California privacy requests may be submitted using Section 24 contact details. Subject to applicable law, individuals may have rights to contact the California Privacy Protection Agency or California Attorney General concerning unresolved privacy concerns.

13. GDPR Information for EU/EEA Customers

If you are located in the European Economic Area (“EEA”) or another jurisdiction where the General Data Protection Regulation (“GDPR”) applies, this Section describes additional information concerning Personal Data processed through the DrawX website and Web Application.

13.1 Scope and Roles

Depending on the context, Scalex may act as a data controller when determining purposes and means of processing Personal Data for its own website operations, account administration, direct communications, security, billing and certain business operations.

Where a business customer determines the purposes and means of processing Personal Data through DrawX and Scalex processes that Personal Data on the customer’s behalf, Scalex may act as a data processor. Such processing may be governed by a separate Data Processing Agreement (“DPA”) or equivalent contractual terms.

13.2 Categories of Personal Data

Depending on use, Personal Data may include identity and contact information; business and professional information; account and authentication information; device, browser, IP and security information; application activity; billing and subscription information; communications; and Personal Data contained within Customer Content.

13.3 Purposes

Depending on our role and legal basis, we may process Personal Data to provide and administer DrawX; authenticate users; manage accounts and permissions; process drawings and requested redaction/translation; provide support; process subscriptions and payments; maintain security; detect fraud and misuse; communicate about the Service; improve reliability and functionality; conduct analytics with appropriate safeguards; comply with legal obligations; and establish, exercise or defend legal claims.

13.4 Legal Bases

Where Scalex acts as a controller, applicable legal bases may include performance of a contract, compliance with a legal obligation, Scalex’s legitimate interests, or consent where required and relied upon.

Where legitimate interests are relied upon, these may include providing and securing DrawX, preventing misuse, improving reliability, communicating with business customers and protecting legal and commercial interests, subject to applicable balancing and rights.

Where Scalex acts as a processor, the customer is generally responsible for determining the legal basis for underlying processing and Scalex processes Personal Data in accordance with documented customer instructions and applicable contractual terms.

13.5 Data Subject Rights

• Right to be informed.
• Right of access.
• Right to rectification.
• Right to erasure, subject to exceptions.
• Right to restriction.
• Right to object to certain processing.
• Right to data portability where applicable.
• Right to withdraw consent where processing is based on consent.
• Rights relating to automated decision-making where applicable.
• Right to lodge a complaint with a competent supervisory authority.

13.6 Exercising GDPR Rights

Individuals may contact Scalex using Section 24 contact details. We may need to verify identity. Where Scalex acts as a processor, requests may need to be directed to the customer as controller. Scalex will provide reasonable assistance as required by applicable law and the DPA.

13.7 International Transfers

DrawX may use cloud infrastructure and service providers located in India or other jurisdictions. Where Personal Data is transferred from the EEA to a country not recognized as providing an adequate level of protection, Scalex will use an appropriate transfer mechanism required by applicable law, which may include an adequacy decision, Standard Contractual Clauses or another legally recognized safeguard.

13.8 DPAs and Processor Obligations

Where Scalex acts as a processor, the applicable DPA may address processing instructions, confidentiality, security, sub-processors, assistance with data-subject rights, personal-data breaches, audits and deletion or return of Personal Data at the end of the processing relationship.

13.9 Sub-Processors

Scalex may use third-party service providers as sub-processors where necessary to provide DrawX, including providers supporting hosting, infrastructure, authentication, storage, monitoring, communications, security, analytics, payments, OCR, translation or AI functionality. Where required by applicable law or the DPA, Scalex will provide relevant sub-processor information and apply appropriate contractual obligations.

13.10 Personal Data Breaches

Scalex maintains procedures designed to identify, investigate and respond to security incidents. Where Scalex acts as a processor and becomes aware of a Personal Data breach affecting Personal Data processed on behalf of a customer, Scalex will notify the customer without undue delay as required by applicable law and the applicable DPA, subject to legal restrictions.

13.11 Supervisory Authorities

Individuals in the EEA may have the right to lodge a complaint with the supervisory authority in their habitual residence, place of work or place of alleged infringement, subject to applicable law.

14. Location of Personal Information

DrawX may store or process information using cloud infrastructure and service providers located in India or other jurisdictions depending on configuration. Where information crosses jurisdictions, Scalex will take reasonable steps to comply with applicable data-protection requirements. Specific data-residency commitments may be provided in a commercial agreement or DPA.

15. Data Retention Policy

DrawX retains uploaded original PDFs and generated processed copies, including redacted or translated versions, in the customer’s account until the customer deletes the relevant content, subject to applicable account, legal and operational requirements.

Account and technical information may be retained for as long as reasonably necessary to provide DrawX, administer accounts, maintain security, meet legal obligations, resolve disputes, prevent abuse and maintain legitimate business records.

After account termination or deletion, information is handled under applicable deletion and retention procedures. Limited information may remain for legal obligations, disputes, enforcement, fraud/abuse prevention, security and legitimate business records.

16. Data Deletion and Removal

Users may delete files and other Customer Content through DrawX where the applicable functionality is available. Deletion from active DrawX storage may not immediately remove copies maintained in backups, disaster-recovery systems, security logs or other systems where immediate deletion is not technically feasible.

Residual copies will be retained only for the period reasonably necessary for the applicable operational, security, legal or backup purpose and will remain subject to applicable access controls.

Where Scalex processes Customer Content on behalf of an organization, the organization may be responsible for managing deletion requests and instructions.

17. Data Storage

Customer Content and personal information may be stored in databases, application infrastructure, file/object storage, logs, backups and other systems necessary to operate DrawX.

Where applicable, information is encrypted in transit and at rest using appropriate security practices. Access is restricted to authorized personnel and systems based on business, security and operational requirements.

18. Procedure for Handling Requests for Data Deletion

Requests concerning deletion of personal information or account information may be submitted using Section 24 contact details. We will review and verify requests and process them under applicable law, contractual obligations and retention/deletion procedures.

Deletion may be subject to legal, contractual, security or backup retention requirements.

19. No Training of General-Purpose AI Models

Unless expressly agreed in writing, Scalex does not use Customer Content to train or fine-tune general-purpose AI models.

Customer Content is processed to provide DrawX functionality, including text detection, redaction, translation/language conversion, storage of original and processed copies, support, security and service operation.

This does not prevent use of aggregated or de-identified information in accordance with Section 8.

20. Cookies and Similar Technologies

The DrawX website and Web Application may use cookies, local storage, session technologies, analytics technologies and similar mechanisms to maintain sessions, authenticate users, remember preferences, improve functionality, measure usage, maintain security and understand website or application performance.

Where required by applicable law, we will provide appropriate notices and consent mechanisms for non-essential cookies or similar technologies. You may control cookies through your browser or available consent settings, although disabling certain technologies may affect DrawX functionality.

21. Third-Party Links and Services

The DrawX website or Web Application may contain links to or integrations with third-party websites, applications or services not controlled by Scalex. This Privacy Policy does not apply to those third parties. Review their privacy policies before providing information or connecting services.

Third-party service providers used for hosting, OCR, AI, translation, analytics, communications or other functions may process information under their own contractual and privacy requirements.

22. Children’s Privacy

DrawX is intended for business and professional use and is not directed toward children. We do not knowingly collect, maintain or process personal information from individuals below the applicable legal age in their jurisdiction.

If you become aware that such an individual has provided information without appropriate consent, contact us so we can take reasonable steps to verify, restrict and delete the information where required by law.

23. Changes to this Privacy Policy

We may update this Policy to reflect changes in our practices, DrawX functionality, technology, business operations or applicable law. The updated Policy will be posted on the DrawX website or made available through the Web Application and the Effective Date will be updated. Where required, we will provide additional notice of material changes.

24. Contact Us

Privacy-related inquiries concerning the DrawX website and Web Application may be directed to the above contact details.