Privacy Policy of UDesign Engine
Last updated: 2026-09-11 - Version: 3.0
Data Controller
UDesign Engine (hereinafter "UDesign") is a business-to-business platform for managing multi-brand, multi-language product catalogues (Company → Brand → Product). This Privacy Policy explains how personal data is processed when you use UDesign as a registered user — either as a user of a client organisation that manages its own catalogue, or as a user who creates an account to download, or share with third parties, catalogue content published on a client's website.
The data controller for the personal data described in this policy (user accounts and service logs) is Luca Salomoni, with registered office at Via Plinio il Vecchio 12, 31100 Treviso, Italy, VAT no. IT04986080267 — the operator of UDesign (hereinafter "we", "us" or "UDesign").
For any request regarding the processing of your personal data you can contact us at: luca@udesign.global.
Note on roles: three distinct data flows
This Privacy Policy covers three different data flows, with different roles under the GDPR:
— Account data of client-organisation users (those who manage the catalogue on UDesign): UDesign is the data controller.
— Catalogue content and business contacts that a client organisation uploads to UDesign: the client organisation is the data controller and UDesign acts as data processor on its behalf (see the Terms of Service and the data-processing terms therein).
— Account data of users who register to download, or share with third parties, catalogue content published on a client's website (typically designers, specifiers or technical buyers; see the dedicated section below): UDesign is the data controller for collecting and managing the account; the client whose catalogue or brand is involved in the download or share becomes an independent controller of the data contained in the related report (for example, for a sales follow-up).
Personal data we collect
We collect the following categories of personal data, limited to what is necessary to provide the service.
Account data — client-organisation users
When you register or are invited to UDesign to manage the catalogue we process: first name, surname, email address, telephone number, job position and — where provided — postal address (street, city, state/province, postal code, country), preferred language and nationality.
If you use a local account we store a hashed password (never in clear text). If you sign in with Google we store your Google account identifier, the email-verified flag and your profile picture URL (see "Google sign-in").
Consent records
When you accept this Privacy Policy and the Terms of Service we record the acceptance together with the document version and the date, in order to demonstrate compliance.
Usage and security logs
To operate, secure and improve the service we keep server-side logs that may contain personal data. These logs are not anonymous — they contain identifiers such as IP address, browser user-agent and a user reference — and we do not use them for advertising or profiling:
— Activity log (audit trail): for each change made to catalogue data we record the acting user, the affected product/brand, the type of action, the timestamp, the IP address and the browser user-agent, and we store a copy of the changed record.
— Search log: the search terms you enter in the catalogue, together with the IP address, user-agent, page path and (where available) the user.
— Visitor geo log: the IP address, the derived two-letter country code and the visited controller/action. The country is derived locally from a MaxMind GeoLite2 database; the IP address is not sent to any third party for this purpose.
Account data — users who download or share content (designers, specifiers, technical buyers)
UDesign integrates with clients' (manufacturers') websites to publish their CAD/BIM technical catalogues. To download catalogue content from a client's website, or to share it with third parties, you must create your own free UDesign account — there is no anonymous or separate download form. When this account is created we collect: first name, surname, email address and, where requested, company and job role.
Subsequent sign-in uses the same authentication methods described under "Account data — client-organisation users" (including Google sign-in, where available) and the same session and authentication cookies described under "Cookies and local storage": no additional cookie or tracking mechanism is used specifically for downloads.
When creating the account, these users expressly accept the Terms of Service, which inform them that their name, company/role (if provided) and the products they download or share with third parties will be included in a report made available to the client that owns the catalogue or brand concerned — for commercial lead-generation purposes. This is currently part of the value UDesign offers to its manufacturer clients.
Legal basis: performance of the contract with the user who creates the account (Art. 6(1)(b) GDPR) for providing the download/share service, and the legitimate interest (Art. 6(1)(f) GDPR) of the client/manufacturer for the commercial reporting purpose — made transparent to, and expressly accepted by, the user at registration through the Terms of Service.
"Sharing with third parties" here means sending the link to the catalogue page — for example, from the manufacturer's sales representative to a prospective designer — without UDesign collecting any data about the recipient at that stage: whoever receives the link can view the page, but to download a file they must in turn create their own account, thereby falling under the same processing described in this section. UDesign therefore does not process any data about the recipient of a share until they create an account themselves.
This data is shared exclusively with the client that owns the specific brand/catalogue involved in the download or share (never with other UDesign clients) — see "Recipients and sub-processors".
Purposes and legal bases
Account data and consent records are processed to create and manage your access and to perform the service — legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in providing the platform to the client organisation (Art. 6(1)(f)).
Usage and security logs (activity, search, visitor-geo) are processed for security, abuse prevention, accountability/audit and service improvement — legal basis: legitimate interest (Art. 6(1)(f) GDPR). UDesign is a professional tool used by employees of client organisations in an authenticated environment; the data is not used for profiling or advertising and is retained for limited periods (see "Data retention"), so we consider this processing proportionate and within users' reasonable expectations.
Data of users who download or share content is processed as described in the dedicated section above — legal basis: performance of a contract (Art. 6(1)(b) GDPR) for the download/share service, and legitimate interest (Art. 6(1)(f) GDPR) for the commercial reporting purpose towards the client, with the safeguards described there.
Automatic translation of catalogue text is carried out in order to provide the service (Art. 6(1)(b) GDPR).
Google sign-in
If you choose to sign in with Google, authentication is handled by Google LLC. We receive your email address, the email-verified status, a stable account identifier and your profile-picture URL; we never receive your Google password. Google processes this data as an independent controller under its own privacy policy (policies.google.com/privacy). Transfers are covered by the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses.
Automatic translation of catalogue content
To produce multi-language catalogue content, product text (such as descriptions, categories and keywords) is sent to an external machine-translation provider. Depending on the configuration in force, the provider is one of the following:
— DeepL SE (Germany, EU): processing takes place within the European Union.
— Google Cloud Translation, provided by Google LLC (USA) / Google Ireland Ltd.
— Microsoft Azure Translator, provided by Microsoft (EU/USA).
— Anthropic Claude, provided by Anthropic PBC (USA).
Transfers to providers outside the EU are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and/or the EU–US Data Privacy Framework, as applicable to each provider. Catalogue text may incidentally contain personal data (for example a contact name inside a description); we recommend not placing unnecessary personal data in catalogue free-text fields.
Cookies and local storage
UDesign uses only strictly necessary cookies and does not use profiling, advertising or third-party analytics cookies. The following are set:
— Session cookie: HttpOnly, essential to maintain your session; expires after 30 minutes of inactivity.
— Authentication cookie: HttpOnly, Secure, used to keep you signed in.
— Language/culture cookie: stores your interface-language preference.
Because these cookies are strictly necessary for the functioning of the service, they do not require consent under Art. 5(3) of the ePrivacy Directive. No information stored on your device is used for advertising or profiling.
Recipients and sub-processors
We do not sell personal data. We share it only with service providers acting on our instructions (processors), with clients within the limits described in this Privacy Policy, or where required by law. The recipients of personal data are:
— Google LLC (USA): authentication (Google sign-in). Transfer covered by the EU–US Data Privacy Framework / Standard Contractual Clauses. Policy: policies.google.com/privacy
— Translation providers (one or more of DeepL SE, Google, Microsoft Azure, Anthropic), as described under "Automatic translation of catalogue content".
— Google LLC (USA): geocoding of company/brand addresses into coordinates via the Google Maps/Geocoding API, where that feature is used.
— Hosting provider: the servers and databases on which UDesign runs.
— Email-delivery provider (SMTP) for service and account-related emails.
— The client that owns the brand/catalogue involved in a download or a share with third parties: it receives the name, email, company/role (if provided) and the list of actions (downloads/shares) relating to its own content, as described under "Account data — users who download or share content". Unlike the other recipients listed in this section, for this flow the client does not act as a processor on our behalf but as an independent controller (see "Note on roles").
Transfers to providers established outside the EU are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and/or the EU–US Data Privacy Framework, depending on the provider.
Data retention
Account data is retained for the duration of the relationship and for 24 months after the account is closed, unless a longer period is required by law — this applies both to client-organisation users and to users who download or share content.
Consent records are retained for as long as necessary to demonstrate compliance and for the applicable limitation period.
Activity (audit) logs, including the stored copy of changed records, are retained for 24 months.
Search logs are retained for 12 months.
Visitor-geo logs are retained for 12 months.
Catalogue text sent for translation is not retained by us beyond the translation itself; the providers' own retention is governed by their respective terms (for example, Anthropic retains API input/output for a limited abuse-prevention period and does not use it to train its models).
Your rights
Under the GDPR (Regulation (EU) 2016/679) you have the right to access your personal data, to obtain rectification or erasure, to restrict or object to processing, and to data portability, within the limits set by law.
Where processing is based on legitimate interest, you have the right to object on grounds relating to your particular situation.
To exercise your rights contact us at luca@udesign.global; we will respond within 30 days. If your data was provided through your employer's UDesign account, we may direct your request to that organisation where it acts as controller.
If you created an account to download or share content of one of our clients and your data was shared with that client through a report, to exercise your rights regarding the client's use of your data after receiving it you may need to contact that client directly, as it acts as an independent controller for that stage of the processing.
You have the right to lodge a complaint with a supervisory authority — in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
Changes to this Privacy Policy
We may update this Privacy Policy. Registered users will be notified by email of material changes. The current version is always available on this page.