Privacy Policy

1. What we process and why

Email-only account profile

The only profile field we ask you to provide is your email address. It is used to send a requested sign-in link, identify your account, and respond to account-related messages. We do not ask for a name, phone number, address, date of birth, or password when you create this account. We do not send marketing emails as part of sign-in.

Optional Google sign-in

You can choose Google instead of an email link. Google and Firebase process your verified email and Google account identifier; Firebase may also retain the basic name and profile picture supplied by Google as provider information. Our account pages display only your verified email. We do not request access to your Gmail messages, contacts, Drive files or calendar. Google sign-in uses Google’s authentication services and their own privacy terms.

Necessary authentication records

“Email-only” does not mean that authentication works without any other records. Firebase Authentication processes an internal account identifier, email-verification status, account creation and sign-in timestamps, and security/session information. One-time email links and signed session tokens are used to verify access to your inbox. These are for account operation and protection, not audience statistics.

Technical requests and abuse prevention

Our server and service providers necessarily process connection information such as IP addresses, request times and browser/protocol information to deliver pages, email and authentication securely. Our account service uses short-lived keyed hashes of an IP address or email in memory to limit abusive attempts; it does not store raw IP addresses in an account profile. We do not use this data to track your browsing for analytics or advertisements. Hosting or authentication providers may maintain their own operational/security logs.

Messages you send us

If you email support, we receive your email address and whatever you include in the message or attachments. Please send only information needed for your request.

2. Cookies are for sign-in and its protection

The account service uses these essential first-party cookies on arteries.tech. They are set when you open or use the account flow, not for advertising or statistics:

These cookies contain signed authentication information or random security values. They are not advertising identifiers. The cookie stays host-only on arteries.tech. The account dropdown on our approved AeroCAD site can check your sign-in using that same session and links to your Profile, Settings and Licenses pages on arteries.tech. Other websites and unapproved subdomains are not granted this access. The menu checks your session when you open it; account pages verify it when opened or revisited. No private profile details are included in the static page HTML.

The main Arteries page may store your light/dark preference locally as arteries-theme. This is a display preference, not a cookie or tracking identifier, and the page does not send it to us. The AeroCAD page is dark-only. Account emails and tokens are not stored in localStorage.

The sign-in page loads Firebase’s authentication code from Google to prepare the Google button. Choosing it opens Google’s sign-in pop-up, where Google may use its own sign-in cookies or storage. The Firebase user on our page is held in memory and signed out after the server-session exchange; your Arteries sign-in then uses the essential session cookie above.

You can clear cookies and local storage in your browser. Blocking essential cookies prevents sign-in, but you can still browse the public sites and download the free Demo. We do not use Google Analytics, advertising pixels, session replay, or marketing cookies.

3. Necessary providers, not data sales

We do not sell or rent your personal data, or share it with third parties for their advertising. We do use providers to deliver the services you request:

• Google/Firebase Authentication: handles email-link verification, optional Google sign-in, authentication records and signed sessions. See Firebase privacy information and Google’s Privacy Policy.
• Resend: delivers requested sign-in emails and processes the recipient, message/link and delivery information. The application sends plain-text messages without tracking pixels or other tracking markup. See Resend’s Privacy Policy.
• Our website/server hosting provider: processes the connections required to serve the sites and account API.
• Our email providers: deliver and store correspondence sent to artur@arteries.tech, support@arteries.tech and contact@arteries.tech.
• Stripe, when you purchase through Stripe Checkout: processes the payment and information required for checkout, fraud prevention, receipts and legal obligations. Stripe may collect billing/contact details and payment information, and Arteries may receive transaction identifiers, payment status, purchase amount and receipt/customer details. We do not receive your full card number or card security code. Payment processing is separate from the email-only sign-in profile. See Stripe’s Privacy Policy.

Providers may process data outside Thailand. Their handling, security measures, locations and retention are governed by their applicable terms and privacy information. We disclose information only as needed for these services, your request, or a legal obligation—not for advertising or personal-data sales.

4. Your AeroCAD projects stay local

The current AeroCAD Alpha and Demo save project files and exported images to locations you choose on your computer. The account feature does not upload those files, add cloud storage, or sign the desktop app in automatically. We receive a project only if you choose to send it to support. The current desktop app has no analytics or advertising integration.

5. Retention and deletion

• Your Firebase account remains until you delete it or ask us to remove it. You can delete it from the account page after a fresh sign-in; this removes the active account and invalidates its sessions.
• Our sign-in service does not keep its own email-address database, a copy of the sign-in emails, or a request-body/token log. Rate-limit hashes expire from service memory after their short limit window (normally 15 minutes); the global mail-volume counter lasts up to 24 hours.
• Cookies expire as listed above. Clearing a local cookie does not itself delete a Firebase account.
• Support correspondence is kept while handling the request and generally for up to 12 months afterward, unless a longer period is needed for an ongoing dispute or legal obligation.
• Service providers may retain security, delivery or backup records under their own policies. Deleting the active account does not promise immediate erasure from every provider backup.
• Payment and accounting records may need to be kept for applicable legal requirements. Deleting a sign-in account does not automatically delete Stripe records, cancel a purchase, or remove your local AeroCAD files.

6. Your choices and rights

We use necessary account data to provide the account service you request; security processing protects that service; purchase processing supports the transaction and legal obligations. Where consent is required for a particular use, we will request it separately. Signing in is not consent to marketing.

Depending on applicable law, including Thailand’s Personal Data Protection Act, you may have rights to access or obtain a copy of your personal data, correct it, request deletion or restriction, object to processing, request portability where applicable, or withdraw consent for uses based on consent. You may also complain to the relevant data-protection authority, including Thailand’s Personal Data Protection Committee.

Send requests to contact@arteries.tech. We may verify control of your account email before acting and will respond within the period required by applicable law. Some requests may be limited by security, legal or transaction-record obligations.

Use your own email account and protect your inbox. If you need parental or guardian permission under applicable law, obtain it before creating an account or purchasing. If you believe information was provided without required permission, contact us.

7. Changes and contact

We will update the version date when this policy changes. If we introduce materially different data uses, we will explain them before they apply and seek any consent required. For questions about either Arteries or AeroCAD, email contact@arteries.tech.