Privacy Policy
Last updated: 12 October 2026
In short:
- We collect what we need to run your account: your email, a password (stored only as a one-way hash), your drawings, and billing status.
- Your drawings are yours. We do not look at them, sell them or use them for advertising.
- We do not sell your data and we do not use advertising or tracking cookies.
- You can change your password or delete your account and all your data yourself, at any time, from My account.
1. Who we are
SchematicStudio (schematicstudio.co.uk) is run by SchematicStudio. We are the “controller” of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Contact us about anything in this policy at info@schematicstudio.co.uk.
2. What we collect, and why
| Information | Why we need it | Lawful basis |
|---|---|---|
| Account details: your email address and a hash of your password (we never store the password itself). If you use Google sign-in: your Google account ID and name. The date you joined and your plan. | To create and secure your account, let you log in, and send you verification and password emails. | Contract |
| Your work: the projects you save (sheets, symbols, cables, panel layouts, logos and so on) and any title block designs you save. | To store your drawings and give them back to you. | Contract |
| Billing status: your Stripe customer and subscription IDs, and whether you are on Free, trial or Pro. We never see or store your card number: Stripe handles it. | To take payment and give you Pro features. | Contract; legal obligation (accounting records) |
| Login and security records: for each device you are logged in on, your IP address, a description of your browser and when you last used it. Also a scrambled (hashed) record of login attempts, which cannot be turned back into your email or IP. | To enforce the one-device limit, show you where you are logged in, and to block password-guessing and abuse. | Legitimate interests (keeping the service and your account secure) |
| Messages you send us: emails to our support address. | To reply and keep a record. | Legitimate interests |
| Server logs: our web host keeps standard logs (IP address, pages requested, time). | Running and securing the site. | Legitimate interests |
We do not knowingly collect “special category” data (such as health information). Please don’t put it in your projects.
3. Who we share it with
We do not sell your personal data. We use a small number of companies to run the service. They only act on our instructions, apart from Stripe and Google, which are responsible for their own use of data in their own services.
| Company | What for | What they receive |
|---|---|---|
| Our web host 123-reg | Hosting the site and database | Everything stored in your account |
| Stripe | Payments, invoices and the billing portal | Your email and payment details, entered on Stripe’s own pages |
| Resend | Sending our emails (verification, password reset, confirmations) | Your email address and the text of the message |
| “Continue with Google” sign-in, only if you use it | Google tells us your Google ID, email and name | |
| Have I Been Pwned | Checking a new password has not appeared in a known data breach | Only the first five characters of a one-way hash of the password. Neither your password nor your email is sent, and the service cannot tell whose password it was |
| unpkg | Delivers the drawing library the editor uses | Your IP address, like any website you visit |
We may also disclose information if the law requires it, to protect our rights or users’ safety, or if the business is sold (the new owner would have to honour this policy).
4. Transfers outside the UK
Some of these companies (for example Stripe, Google and Resend) process data in other countries, including the USA. Where they do, the transfer is protected by a UK adequacy decision or approved safeguards such as the UK International Data Transfer Addendum.
5. How long we keep it
- Account and projects: until you delete your account. Deletion removes your account, projects, title block designs and login records straight away. Copies in our host’s backups are overwritten within 30 days.
- Device login records: removed when you log out, or when a device has been idle for a while.
- Login-attempt records: about two days.
- Verification and reset links: expire on their own after a short time.
- Payment and invoice records: kept by Stripe and by us for up to 6 years, because tax law requires it. These are not deleted when you delete your account.
- Emails to us: up to 2 years.
6. Your rights
Under UK law you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong;
- delete your data (you can do this yourself in My account);
- restrict how we use your data, or object to our use of it where we rely on legitimate interests;
- give you your data in a portable format (Pro users can export projects as files in the editor; otherwise ask us).
Email us to use any of these rights. We will reply within one month. If you are not happy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.
7. How we protect your data
Passwords are stored using a strong one-way hash (Argon2id), so even we cannot read them. Connections to the site are encrypted. We limit login and sign-up attempts, check new passwords against known breaches, protect forms against forgery, and email you if your password is changed. No system is perfectly secure, but we take reasonable steps and will tell you and the ICO if a breach that affects you occurs, as the law requires.
8. Cookies
We use one essential cookie to keep you logged in and no advertising or tracking cookies. Details are in our Cookie Policy.
9. Marketing
We only email you what is needed to run your account (verification, password and billing messages). If we ever send news or offers, we will ask your permission first and every message will have an unsubscribe link.
10. Children
SchematicStudio is for professional and hobby use by adults and is not aimed at anyone under 18. We do not knowingly collect children’s data. If you think a child has an account, please tell us and we will delete it.
11. Changes
If we change this policy in a way that matters, we will tell you by email or in the app. The date at the top shows when it was last updated.