DOMDUX / Legal

Privacy Policy

Draft prepared 25 October 2026 · Effective date pending approval

1. Scope and responsibility

This draft describes the intended privacy approach for DOMDUX, a workspace for architecture, construction and property project information. It covers the marketing website and, where enabled, the application and connected services. The operator’s full legal name, business address and privacy contact must be inserted before adoption.

2. Information involved

Depending on the features you use, DOMDUX may process account details such as name and email; company and workspace membership; project and stakeholder records; notes, measurements and documents; and files or media you choose to upload. Technical hosting and security records may include IP address, browser information, request timestamps and error information.

The marketing page currently includes a search that filters page content in your browser. It does not require an account. This draft does not confirm the production application’s complete collection inventory.

Contact enquiries

The website contact form collects your name, company, employee count, email address, optional phone number and message to respond to your enquiry. Submissions are processed by FormSubmit and emailed to marcos@arcanary.com. FormSubmit uses Google reCAPTCHA for spam prevention. Their processing is subject to their respective privacy policies. Do not include confidential project information or sensitive personal data in an enquiry. FormSubmit states that submissions awaiting recipient activation may be retained for up to 30 days. Contact marcos@arcanary.com about your enquiry or to request deletion; lawful retention requirements may apply.

3. Purposes and legal grounds

Information is intended to be used to provide account access, operate workspace features, organise project records, perform user-requested integrations, respond to support enquiries and protect the service. Where applicable, the operator must identify and document the relevant legal basis, such as contract, legitimate interests, consent or legal obligation, for each use before this policy becomes effective.

4. Google account and Drive connections

Google connections are optional and subject to the permissions shown on Google’s consent screen. Depending on the authorised feature, relevant data may include Google account identity, Drive and folder identifiers, file names and metadata, and file contents needed to complete the action you request. The final policy must name the actual scopes and confirm which of these categories are accessed.

The proposed permitted purpose is to connect company storage locations, create project folder structures and organise or store associated project files. Google data must only be used for disclosed, user-facing functions. It must not be sold, used for advertising or used to train general-purpose AI models. Any human access must be limited to authorised support, security or legal purposes permitted by Google’s policies.

Where Google API data is used, DOMDUX’s use and transfer of that information must adhere to the Google API Services User Data Policy, including its Limited Use requirements. These are proposed operating commitments that require implementation confirmation.

5. Sharing and service providers

Project information may be visible to people authorised within the relevant workspace or connected storage location. Providers supporting hosting, authentication, database storage and integrations may process information to deliver those services. The production provider list, processing locations and contractual safeguards must be confirmed. Information may also need to be disclosed where required by law or to address service abuse.

6. Storage, security and international transfers

Appropriate access controls and technical safeguards are required to protect information. No service can guarantee absolute security. The final policy must specify the actual data locations, cross-border transfer safeguards and security practices; this draft does not make unverified claims about encryption or certifications.

7. Retention, disconnection and deletion

Data should be retained only as needed for the service, legitimate operational requirements and applicable law. The final retention schedule must cover active records, deleted accounts, logs and backups. Disconnecting Google access stops future authorised access but does not necessarily remove existing DOMDUX records or files stored in your organisation’s Drive.

You can revoke Google permissions through your Google account connections. Workspace administrators control access to shared project records. A verified privacy contact and deletion request process must be supplied before this policy becomes effective.

8. Your rights and choices

Depending on your jurisdiction, you may have rights to access, correct, delete or obtain a copy of personal information, restrict or object to processing, withdraw consent and complain to a data protection authority. Requests must be directed to the operator’s confirmed privacy contact. Shared business records may remain subject to the organisation’s own obligations.

9. Cookies and local storage

The language switch stores your preference in browser local storage. The production service’s cookies, authentication storage and any analytics must be inventoried before adoption. This draft does not authorise marketing tracking. Any required consent mechanism must be implemented before non-essential tracking is enabled.

10. Children, changes and contact

DOMDUX is intended for professional use. Material privacy changes should be communicated through the service and reflected in an updated policy date. Before launch, replace this draft with the approved policy and add the operator’s legal identity, postal address and privacy email.