Privacy Policy of UDesign
Last updated: 2026-06-13 - Version: 1.0
Data Controller
UDesign is a business-to-business platform for managing multi-brand, multi-language product catalogues (Company → Brand → Product). This Privacy Policy explains how personal data is processed when you use UDesign as a registered user.
The data controller for the personal data described in this policy (user accounts and service logs) is [COMPANY LEGAL NAME], with registered office at [REGISTERED OFFICE ADDRESS], VAT no. [VAT NUMBER] — the company that operates UDesign (hereinafter "we", "us" or "UDesign").
For any request regarding the processing of your personal data you can contact us at: [privacy contact email].
Note on roles: for the catalogue content and business contacts that a client organisation uploads to UDesign, the client organisation is the data controller and UDesign acts as data processor on its behalf (see the Terms of Service and the data-processing terms therein). This Privacy Policy concerns the data for which UDesign is the controller.
Personal data we collect
We collect the following categories of personal data, limited to what is necessary to provide the service.
Account data
When you register or are invited to UDesign we process: first name, surname, email address, telephone number, job position and — where provided — postal address (street, city, state/province, postal code, country), preferred language and nationality.
If you use a local account we store a hashed password (never in clear text). If you sign in with Google we store your Google account identifier, the email-verified flag and your profile picture URL (see "Google sign-in").
Consent records
When you accept this Privacy Policy and the Terms of Service we record the acceptance together with the document version and the date, in order to demonstrate compliance.
Usage and security logs
To operate, secure and improve the service we keep server-side logs that may contain personal data. These logs are not anonymous — they contain identifiers such as IP address, browser user-agent and a user reference — and we do not use them for advertising or profiling:
— Activity log (audit trail): for each change made to catalogue data we record the acting user, the affected product/brand, the type of action, the timestamp, the IP address and the browser user-agent, and we store a copy of the changed record.
— Search log: the search terms you enter in the catalogue, together with the IP address, user-agent, page path and (where available) the user.
— Visitor geo log: the IP address, the derived two-letter country code and the visited controller/action. The country is derived locally from a MaxMind GeoLite2 database; the IP address is not sent to any third party for this purpose.
Purposes and legal bases
Account data and consent records are processed to create and manage your access and to perform the service — legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in providing the platform to the client organisation (Art. 6(1)(f)).
Usage and security logs (activity, search, visitor-geo) are processed for security, abuse prevention, accountability/audit and service improvement — legal basis: legitimate interest (Art. 6(1)(f) GDPR). UDesign is a professional tool used by employees of client organisations in an authenticated environment; the data is not used for profiling or advertising and is retained for limited periods (see "Data retention"), so we consider this processing proportionate and within users' reasonable expectations.
Automatic translation of catalogue text is carried out in order to provide the service (Art. 6(1)(b) GDPR).
Google sign-in
If you choose to sign in with Google, authentication is handled by Google LLC. We receive your email address, the email-verified status, a stable account identifier and your profile-picture URL; we never receive your Google password. Google processes this data as an independent controller under its own privacy policy (policies.google.com/privacy). Transfers are covered by the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses.
Automatic translation of catalogue content
To produce multi-language catalogue content, product text (such as descriptions, categories and keywords) is sent to an external machine-translation provider. Depending on the configuration in force, the provider is one of the following:
— DeepL SE (Germany, EU): processing takes place within the European Union.
— Google Cloud Translation, provided by Google LLC (USA) / Google Ireland Ltd.
— Microsoft Azure Translator, provided by Microsoft (EU/USA).
— Anthropic Claude, provided by Anthropic PBC (USA).
Transfers to providers outside the EU are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and/or the EU–US Data Privacy Framework, as applicable to each provider. Catalogue text may incidentally contain personal data (for example a contact name inside a description); we recommend not placing unnecessary personal data in catalogue free-text fields.
Cookies and local storage
UDesign uses only strictly necessary cookies and does not use profiling, advertising or third-party analytics cookies. The following are set:
— Session cookie: HttpOnly, essential to maintain your session; expires after 30 minutes of inactivity.
— Authentication cookie: HttpOnly, Secure, used to keep you signed in.
— Language/culture cookie: stores your interface-language preference.
Because these cookies are strictly necessary for the functioning of the service, they do not require consent under Art. 5(3) of the ePrivacy Directive. No information stored on your device is used for advertising or profiling.
Recipients and sub-processors
We do not sell personal data. We share it only with service providers acting on our instructions (processors) or where required by law. The providers that may process personal data are:
— Google LLC (USA): authentication (Google sign-in). Transfer covered by the EU–US Data Privacy Framework / Standard Contractual Clauses. Policy: policies.google.com/privacy
— Translation providers (one or more of DeepL SE, Google, Microsoft Azure, Anthropic), as described under "Automatic translation of catalogue content".
— Google LLC (USA): geocoding of company/brand addresses into coordinates via the Google Maps/Geocoding API, where that feature is used.
— Email-delivery provider (SMTP) for service and account-related emails.
Transfers to providers established outside the EU are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and/or the EU–US Data Privacy Framework, depending on the provider.
Data retention
Account data is retained for the duration of the relationship and for 24 months after the account is closed, unless a longer period is required by law.
Consent records are retained for as long as necessary to demonstrate compliance and for the applicable limitation period.
Activity (audit) logs, including the stored copy of changed records, are retained for 24 months.
Search logs are retained for 12 months.
Visitor-geo logs are retained for 12 months.
Catalogue text sent for translation is not retained by us beyond the translation itself; the providers' own retention is governed by their respective terms (for example, Anthropic retains API input/output for a limited abuse-prevention period and does not use it to train its models).
Your rights
Under the GDPR (Regulation (EU) 2016/679) you have the right to access your personal data, to obtain rectification or erasure, to restrict or object to processing, and to data portability, within the limits set by law.
Where processing is based on legitimate interest, you have the right to object on grounds relating to your particular situation.
To exercise your rights contact us at [privacy contact email]; we will respond within 30 days. If your data was provided through your employer's UDesign account, we may direct your request to that organisation where it acts as controller.
You have the right to lodge a complaint with a supervisory authority — in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
Changes to this Privacy Policy
We may update this Privacy Policy. Registered users will be notified by email of material changes. The current version is always available on this page.