DESIC PRIVACY POLICY

Effective Date: October 2, 2026

This Privacy Policy explains how Desic Labs, LLC, a Colorado limited liability company (“Desic Labs,” “we,” “us,” or “our”), collects, uses, processes, retains, and discloses information in connection with:

• the desic.io website;

• the DESIC plugin for Autodesk Civil 3D;

• account creation and authentication;

• waitlist and invitation communications;

• subscriptions and billing coordination;

• customer support; and

• related software, websites, communications, and services.

Together, these are referred to in this Privacy Policy as the “Services.”

This Privacy Policy does not form part of the DESIC End User License Agreement (“EULA”). Your installation and use of DESIC are also governed by the EULA.

1. Overview of DESIC

DESIC is a locally installed plugin that operates within a customer’s separately licensed copy of Autodesk Civil 3D. The plugin communicates with Desic Labs’ cloud service to provide account authentication, subscription entitlement, usage metering, transactional email, billing coordination, and relay of requests to an artificial intelligence provider.

DESIC performs drafting and automation functions on the user’s computer. Although certain instructions, metadata, and AI responses are transmitted to provide the Services, DESIC does not transmit the underlying drawing files or drawing geometry to Desic Labs.

2. Information We Collect and Process

The information we process depends on how you interact with the Services.

Information You Provide

We may collect information that you provide directly, including:

• your email address and account information;

• information submitted when joining a waitlist or requesting early access;

• subscription and billing-related information;

• communications with Desic Labs;

• support requests, feedback, and troubleshooting information;

• chat instructions submitted through DESIC; and

• information you choose to provide when requesting assistance.

If you use the Services on behalf of an employer or another organization, your account and communications may also identify that organization.

Project Information Processed Through DESIC

To interpret user instructions and perform requested automation, DESIC may read and transmit limited metadata from the open drawing or associated project environment. Depending on the request, this information may include:

• drawing file names and project folder names or paths;

• sheet numbers and sheet titles;

• layout names;

• saved-view names and scales;

• paths or names associated with referenced files;

• alignment station ranges;

• client names;

• project names and project numbers;

• designer, drafter, checker, or other staff names;

• other title-block information;

• AI responses; and

• records of automation actions and associated parameters.

We refer to user instructions, project metadata, and related information processed through DESIC collectively as “Customer Data.”

Information DESIC Does Not Transmit

DESIC is not designed to transmit the following information to Desic Labs:

• drawing files, including DWG files;

• drawing geometry;

• survey data;

• engineering design content;

• Autodesk account credentials; or

• Autodesk license information.

DESIC may read information locally as necessary to perform an authorized action without transmitting the underlying files or design content.

Account, Device, and Usage Information

Desic Labs’ systems may collect and maintain operational information such as:

• email address;

• Stripe customer ID and related billing identifiers;

• subscription and entitlement status;

• waitlist, invitation, activation, suspension, or revocation status;

• devices or computers associated with an account (including device names and related device or hardware identifiers);

• authentication activity;

• request counts;

• token counts;

• usage limits; and

• timestamps associated with requests, authentication, and subscription activity.

This information helps us authenticate users, manage subscriptions, enforce device and usage limits, prevent account sharing, operate the Services, and address security or support issues.

Billing Information

Subscription payments are processed through our payment provider, currently Stripe. Desic Labs may receive billing-related information such as your Stripe customer ID, payment status, subscription plan, transaction status, and limited payment-method details.

Complete payment card information is generally submitted directly to and processed by Stripe rather than stored by Desic Labs. Stripe’s own terms and privacy practices apply to its processing of payment information.

Website and Communications Information

When you visit desic.io or interact with our emails, website, waitlist, or other online services, we and our service providers may receive technical information such as:

• IP address;

• browser and device type;

• operating system;

• referring pages;

• requested pages;

• date and time of access; and

• information about email delivery or interaction.

If we use cookies, analytics technologies, or similar tools, those technologies may collect information about how visitors interact with the website. The technologies used may change as the website develops. Where required, we will provide appropriate notices or choices concerning those tools.

3. Information Stored Locally

Certain DESIC information may be stored locally on the user’s computer or in customer-controlled project folders, including:

• conversation journals used for continuity or crash recovery;

• operation or trace logs;

• project snapshots and backups;

• locally stored entitlement or sign-in information; and

• other settings or files created through local operation of the plugin.

Local information is maintained on systems controlled by the user or customer and is not ordinarily accessible to Desic Labs through the Services. Customers are responsible for securing their computers, project folders, networks, backups, and locally stored credentials or entitlement information.

If you voluntarily provide local files or logs to Desic Labs for support, security, or debugging, we will process the submitted information for those purposes as described in this Privacy Policy.

4. How We Use Information

Desic Labs may process information to:

• operate, maintain, and provide the Services;

• establish and administer user accounts;

• authenticate users and devices;

• manage waitlist registration, invitations, and early access;

• verify subscription status and software entitlements;

• relay user requests to the AI provider and return responses;

• perform requested drafting and automation actions;

• measure requests and enforce usage limits;

• process and coordinate subscriptions, payments, renewals, and cancellations;

• send sign-in codes, account messages, receipts, service notices, and other transactional communications;

• respond to support requests and user communications;

• diagnose errors and troubleshoot technical issues;

• protect the Services, users, and third parties against fraud, misuse, unauthorized access, and security threats;

• enforce the EULA and other applicable agreements;

• comply with legal requirements and respond to lawful requests;

• establish, exercise, or defend legal claims;

• maintain and improve the reliability, performance, and functionality of the Services; and

• develop aggregated or de-identified operational statistics.

We may use aggregated or de-identified information for analytics, product planning, security, and service improvement, provided the information does not reasonably identify a user, customer, or project.

5. AI Processing

DESIC currently uses Anthropic, PBC’s Claude models through Anthropic’s commercial API. When a user submits a request, Desic Labs may relay the user’s instructions and relevant project metadata to Anthropic’s API. The AI provider processes that information and returns a response that DESIC may use to identify or perform an automation action.

Desic Labs does not use Customer Data to train artificial intelligence models. Anthropic’s current commercial API terms state that API customer content is not used to train its models. Anthropic processes information under its own commercial terms, data processing terms, and privacy and security practices.

Our AI provider may retain inputs and outputs for a limited period under its own terms (currently up to 30 days, and longer where content is flagged for a policy review or retention is required by law).

We may change or add AI providers as the Services develop. Any provider change is subject to this Privacy Policy and applicable law, and we will update this Privacy Policy when required by law. We do not make an unconditional promise that the practices or terms of any third-party provider will remain unchanged.

AI-generated responses may contain errors or inaccuracies. Users should independently review AI responses and all work produced using DESIC, particularly before using that work in engineering, permitting, construction, or other professional activities.

6. Retention of Chat Content and Project Information

Desic Labs does not intentionally retain the content of user chat instructions, transmitted project information, or AI responses after processing a request, except as described below.

This does not prevent limited retention or processing when reasonably necessary to:

• transmit, queue, or complete a request;

• maintain the security, availability, or integrity of the Services;

• investigate suspected misuse, fraud, or security incidents;

• provide support or perform debugging with the user’s authorization;

• comply with applicable law, legal process, or enforceable governmental requests;

• establish, exercise, or defend legal rights; or

• maintain temporary operational systems or backups.

Temporary copies may remain for a limited period in system memory, transmission infrastructure, security records, or backups before being deleted or overwritten through ordinary operations. Desic Labs will limit any such processing to what is reasonably necessary for the applicable purpose.

If support or debugging requires access to Customer Data, we may ask the user to provide the relevant information voluntarily or authorize temporary diagnostic processing.

This Section 6 addresses the retention of chat instructions, transmitted project information, and AI responses specifically. Section 9 (Data Retention) describes our general retention practices for account, subscription, billing, support, and other categories of information.

7. Service Providers and Third Parties

We use third-party providers to help operate the Services. Current providers include:

These providers may process information on our behalf or in connection with services they provide directly. Their own terms, privacy policies, and security practices may apply to their processing.

We may replace providers or engage additional providers as the Services evolve. Service providers are authorized to receive information as reasonably necessary to perform services for us, subject to applicable contractual and legal requirements.

DESIC operates with Autodesk Civil 3D, but Desic Labs does not receive your Autodesk credentials or Autodesk license information. Your use of Autodesk products is governed separately by your agreements with Autodesk.

8. When We May Disclose Information

We may disclose information in the following circumstances.

Service Providers

We may disclose information to vendors, contractors, and service providers that support hosting, AI processing, authentication, billing, email, security, customer support, analytics, and related business functions.

Customer Organizations

If an account is purchased, administered, or provided by an employer or other organization, we may provide that organization with information needed to manage its account, subscriptions, authorized users, security, and compliance. Organizational administrators may be able to add or remove users and view account or subscription information.

Legal and Safety Purposes

We may disclose information if we reasonably believe disclosure is necessary to:

• comply with applicable law, legal process, or a valid governmental request;

• protect the rights, property, or safety of Desic Labs, our users, or others;

• investigate fraud, misuse, security incidents, or violations of our agreements;

• prevent harm or unlawful activity; or

• establish, exercise, or defend legal claims.

Business Transactions

We may disclose or transfer information in connection with an actual or proposed merger, financing, acquisition, reorganization, sale of assets, bankruptcy, or similar business transaction. Any recipient may use the information subject to this Privacy Policy unless users are notified otherwise as required by law.

With Your Direction or Consent

We may disclose information when you direct us to do so, authorize the disclosure, or intentionally use a feature that requires disclosure.

9. Data Retention

We retain information for periods appropriate to the purpose for which it was collected, including as necessary to:

• provide and secure the Services;

• maintain accounts and subscription records;

• administer billing, accounting, and tax obligations;

• document agreement acceptance and transactions;

• respond to support requests;

• enforce our agreements;

• resolve disputes; and

• comply with legal obligations.

Account, subscription, metering, and transaction records may be retained during the customer relationship and for a reasonable period afterward. Retention periods may differ depending on the nature of the information, operational needs, contractual obligations, and applicable law.

When information is no longer reasonably required, we may delete, anonymize, or aggregate it. Information may remain in backups for a limited period until those backups are overwritten or deleted through ordinary operations.

Locally stored information is controlled by the user or customer and generally must be deleted from the applicable computer, user profile, project folder, or backup by that user or customer.

For the retention of chat instructions, transmitted project information, and AI responses, see Section 6 (Retention of Chat Content and Project Information).

10. Security

Desic Labs uses reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure.

No system, network, transmission method, or storage environment is completely secure. We cannot guarantee that information will never be accessed, disclosed, altered, lost, or destroyed without authorization.

Users should help protect information by:

• securing their email accounts and computers;

• limiting access to sign-in codes and locally stored entitlement information;

• maintaining appropriate network and endpoint protections;

• restricting access to customer project folders;

• keeping DESIC and other software reasonably current; and

• promptly notifying Desic Labs of suspected unauthorized access or misuse.

11. Communications

We may use your contact information to send:

• waitlist and invitation messages;

• sign-in or authentication codes;

• subscription, renewal, payment, and cancellation notices;

• service, security, and support communications;

• notices regarding material changes to the Services or applicable terms; and

• product or promotional communications where permitted by law.

You may unsubscribe from promotional emails by using the instructions in those messages or by contacting us. You may continue to receive transactional or service-related messages necessary to administer your account or provide the Services.

12. Your Choices and Requests

Depending on where you live and applicable law, you may have the right to request that we:

• provide access to personal information associated with you;

• correct inaccurate personal information;

• delete certain personal information;

• provide a portable copy of certain personal information;

• explain categories of information processed or disclosed;

• restrict or object to certain processing; or

• honor legally recognized opt-out rights.

These rights may be subject to exceptions. For example, we may retain information needed to complete transactions, maintain security, comply with law, preserve legal rights, or fulfill contractual obligations.

To submit a request, email privacy@desic.io. Please describe your request and identify the email address associated with your account. We may take reasonable steps to verify your identity and authority before acting on a request.

If you submit a request on behalf of another person, we may require proof that you are authorized to act for that person. Where applicable law provides a right to appeal our decision, you may submit an appeal by replying to our decision or emailing privacy@desic.io with the subject line “Privacy Appeal.”

You may also request closure of your DESIC account. Closing an account does not automatically delete information stored locally on your computer or in customer-controlled project folders.

13. State Privacy Rights

Residents of certain U.S. states may have additional privacy rights under applicable state law. The rights available, applicable exceptions, and our obligations depend on factors such as the individual’s state of residence, the nature of the information, the context in which it was collected, and whether the relevant law applies to Desic Labs.

Where required, Desic Labs will honor applicable requests to access, correct, delete, or obtain a copy of personal information and applicable rights to opt out of covered processing activities.

Nothing in this Privacy Policy limits any rights that cannot be limited under applicable law.

14. Sale and Sharing of Personal Information

Desic Labs does not sell personal information for monetary consideration, and we do not share personal information for purposes of cross-context behavioral advertising, as the terms “sell” and “share” are defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and comparable state privacy laws. We also do not knowingly sell or share the personal information of individuals under 16 years of age. If our practices change, we will update this Privacy Policy and provide any legally required opt-out mechanism, including a “Do Not Sell or Share My Personal Information” option, and will honor legally recognized opt-out preference signals where required.

15. U.S. Processing

Desic Labs is based in the United States, and the Services are operated from the United States. Information may be processed and stored in the United States or other locations where our service providers operate.

If you access the Services from outside the United States, your information may be transferred to jurisdictions with privacy laws that differ from those in your location. Where required, Desic Labs will use appropriate measures for covered cross-border transfers.

16. European Economic Area, United Kingdom, and Switzerland

The Services are directed to professional and business users in the United States and are not targeted to individuals located in the European Economic Area, the United Kingdom, or Switzerland. We do not intend to offer the Services to, or to monitor the behavior of, individuals located in those regions. If you access the Services from one of those regions, you do so on your own initiative and are responsible for compliance with applicable local law. To the extent any data protection law, such as the EU or UK General Data Protection Regulation, applies to our processing, our legal bases are performance of a contract with you, our legitimate interests in operating and securing the Services, your consent where required, and compliance with legal obligations, and we will use appropriate safeguards, such as standard contractual clauses, for covered cross-border transfers.

17. Children’s Privacy

The Services are intended for professional and business use and are not directed to children under 13 years of age. Desic Labs does not knowingly collect personal information from children under 13.

If you believe a child under 13 has provided personal information to us, contact privacy@desic.io so that we can review and, where appropriate, delete the information.

The under-13 standard in this Section 17 addresses the collection of personal information from children. Separately, as described in Section 14 (Sale and Sharing of Personal Information), we do not knowingly sell or use for targeted advertising the personal information of individuals under 16 years of age.

18. Third-Party Services and Links

The Services may integrate with, operate within, or link to third-party products and websites, including Autodesk, Anthropic, Stripe, and other providers.

This Privacy Policy applies only to Desic Labs’ processing. Third parties may collect or process information under their own terms and privacy policies. Desic Labs is not responsible for the privacy, security, or data-handling practices of third parties acting independently of Desic Labs.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the Services, our providers, legal requirements, or our information practices.

When we make changes, we will post the updated policy and revise the effective date. If a change materially affects how we process previously collected personal information, we will provide additional notice or obtain consent when required by law.

20. Contact Us

Questions, concerns, and privacy requests may be directed to:

Desic Labs, LLC 

PO Box 6566

Breckenridge, Colorado 80424 

United States

Email: privacy@desic.io