OpenMyDrawing

Privacy notice

Last updated 22 October 2026.

This notice explains what personal data OpenMyDrawing processes, why, and for how long. The controller is the operator named on the Company page, contact the address on the Company page.

Your drawings

When you open a DWG, DXF or PDF drawing, the file is sent to our server, which turns the page you are viewing into an image. The file is processed for that request only and is not kept. The rendered page is kept in the server's memory for at most one hour so that switching between pages is fast, and is then discarded. Drawings are never stored permanently, shared, or used to train any model. Legal basis: performing the service you asked for (GDPR Art. 6(1)(b)).

An IFC model is opened only in your browser, on your device. It is never sent to our server.

Converting files is not offered at present.

Your measurements

Measurements, prices and settings are stored only in your own browser (local storage) and in project files you choose to download. We do not receive them.

Payments

Nothing is on sale at present. This section and the next apply once passes are.

Payments are handled by Stripe. We receive the name, email, billing address, company name, VAT number and payment status you enter at checkout, and use them to provide the export pass, issue invoices and keep accounting records. Card details go to Stripe only. Invoices and accounting records are kept for seven years as required by the Estonian Accounting Act (Raamatupidamise seadus ยง 12). Legal bases: contract and legal obligation (GDPR Art. 6(1)(b) and (c)).

Export passes

There are no user accounts. After a payment, your browser keeps a random pass token and a random browser secret in its local storage; the server keeps the pass with a fingerprint of the plan file (a SHA-256 hash, not the file) and the Stripe payment references. These are needed to provide what you bought, so no consent banner is used. Deleting your browser data removes the token from your device.

Server logs

The server logs the IP address, time and requested address of API calls to protect the service against abuse (rate limits) and to investigate faults. Logs are deleted after 30 days. Legal basis: legitimate interest in keeping the service secure (GDPR Art. 6(1)(f)).

Visit counts

The server counts how the service is used, as totals only: per day, pages viewed (per page and its language), requests for pages that do not exist (one number, without the address), drawings sent to the server to be opened (per file type, the page they were opened from, and whether the server drew them or refused them; a drawing counts once the server has drawn it, even if the page is then cancelled, and IFC models, which open only in your browser, are not counted) and conversions started (per format); per month, the countries visitors come from. For counting, the IP address is used only to look up the country at the moment of the request, in a country database kept on our server (IP Geolocation by DB-IP, licensed under CC BY 4.0), and is not stored by the counting (the server logs described above are separate); the browser's user agent is checked at that moment only to leave out search engine robots, and is not stored either. No cookies are used, nothing is read from or stored on your device for counting, and there is no visitor identifier, so the totals cannot tell whether two visits came from the same person. Nothing is counted when your browser sends Do Not Track or Global Privacy Control. The totals are aggregated: countries are kept per month only, and our reports show a country with fewer than five visits in a month only as "other". The totals are kept for as long as the service runs. Legal basis: legitimate interest in knowing whether the service works and is used (GDPR Art. 6(1)(f)).

Service providers

Stripe and Tailscale may process data outside the EU under the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

No cookies, no tracking

OpenMyDrawing sets no cookies and uses no analytics scripts or advertising trackers; visits are counted on the server as described above.

Your rights

You can ask for access to, correction or deletion of your personal data, restriction of or objection to its processing, and a copy of it, by writing to the address on the Company page. We answer within one month. Accounting records cannot be deleted before the legal retention period ends. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).