Cadyon Privacy Notice
Version 1.5, 1 October 2026
This notice explains what personal data the Cadyon software processes, on what basis, for how long, and what rights you have. It forms part of the Cadyon End User Licence Agreement.
Controller. Drugo projektiranje, Petar Crnčec s.p., registration number 9190422000, Ulica borcev za severno mejo 21, 1000 Ljubljana, Slovenia. Contact: privacy@cadyon.com.
1. Your drawings
Drawings are converted locally on your computer. No drawing file, output file, or content extracted from either is transmitted to the Controller or to any third party. This includes file names, folder paths, block and layer names, annotation text, coordinates, and dimensions.
Each STEP file the software writes carries, in its header, an identifier for the conversion that produced it. The identifier is a random value. It says nothing about the drawing, its name, or its contents, and it is written into the file you keep, not sent anywhere on its own. See section 5.
2. Licence activation
Data. The licence key, the computer name, and the operating system user name.
Purpose. To activate a licence key on a computer, to count activations against the number the key permits, and to confirm periodically that the key remains valid.
Recipients. Lemon Squeezy Inc., the Controller's payment provider, which processes this data under its own privacy terms. The provider also holds the purchase record, including the email address used to buy the licence.
Legal basis. Article 6(1)(b) GDPR, performance of the contract of sale.
Retention. For the life of the licence, and thereafter in accordance with the provider's retention schedule.
3. Usage reporting
Data. A randomly generated installation identifier, the application and operating system versions, the licence tier in force, the date of first use, and counts of conversions, of drawings refused for exceeding the size limit, and of attempts to convert several files at once.
Purpose. To understand how the software is used and to support and improve it.
Frequency. With each conversion, and otherwise once in any thirty-day period.
Legal basis. Article 6(1)(f) GDPR, the legitimate interests of the Controller in maintaining and improving the software. A balancing assessment has been carried out and is available on request.
Retention. Twenty-four months from receipt.
4. Verification of non-commercial use
The Free Tier is licensed for personal, non-commercial use only. Verifying that term requires identifying installations that are not personal.
Data. In addition to the data in section 3: which indicators of commercial use were present and, where the computer is joined to an organisational domain, the domain name and the operating system account name. The account name of a domain-joined computer is commonly the user's work email address.
When. Only where several independent indicators concur, and at most once in any thirty-day period. Installations operating under a Paid Tier are never assessed and never report this data.
Legal basis. Article 6(1)(f) GDPR, the legitimate interests of the Controller in enforcing the terms on which a free licence is granted. The assessment recorded that the data is collected only from free installations, only where several indicators concur, never includes the content of a user's work, and is not used for advertising, profiling, or any purpose unrelated to licence enforcement.
Retention. Twenty-four months from receipt. The domain name and operating system account name are erased after twelve.
5. Record of conversions
The software keeps a record of each conversion it performs, so that a file produced by it can later be matched to the installation that produced it. This is how a licence term is enforced against a file, rather than against a machine.
Data. For each conversion: the identifier written into the resulting file's header, the time of the conversion, the licence tier in force, and the application version, together with the installation identifier from section 3. No file name, no folder path, no file size, and no content of any kind is recorded, on the computer or on receipt.
Purpose. To establish which installation produced a given output file, and under which licence.
Frequency. Each record is sent when the conversion is made. One that cannot be sent then is kept on the computer and sent at the next opportunity; an installation that is never online keeps at most the five thousand most recent and discards the rest.
Legal basis. Article 6(1)(f) GDPR, the legitimate interests of the Controller in enforcing the terms on which a licence is granted. The assessment recorded that the record cannot reveal what a user was working on, and that the identifier in the file is meaningless to anyone who does not hold this record.
Retention. Twenty-four months from receipt. After that a file's identifier leads nowhere.
The viewer. The Cadyon Viewer at cadyon.com/viewer keeps the same record for each drawing it exports as STEP, and only when someone chooses to export. In place of an installation identifier it uses a random identifier made by the browser on the first export and kept in that browser's storage. The record is sent when the export happens. As above, no file name, no file size and no content of any kind is recorded; the drawing itself never leaves the device.
6. Update check
On starting, the software requests a file stating the current version. The request contains no identifier and no personal data.
7. Website statistics
The website counts how often its pages are opened. Each view adds one to a total kept for the day, the page, the visitor's country, and the site that linked to it. No cookie is set, no identifier is assigned, no IP address is stored, and no record is kept of an individual visit.
8. What is not done
The Controller does not carry out advertising, profiling, or automated decision-making producing legal or similarly significant effects, does not use analytics or tracking services other than the website statistics described in section 7, and does not sell or otherwise disclose personal data other than as stated in section 2.
9. International transfers
Data processed under section 2 is transmitted to the payment provider, which may process it outside the European Economic Area under the safeguards described in its own privacy terms.
10. Your rights
You have the right to request access to the personal data held about you, its rectification or erasure, restriction of its processing, and its portability, and to object to the processing described in sections 3, 4 and 5, which is carried out on the basis of legitimate interests.
To exercise any of these rights, write to privacy@cadyon.com, quoting your installation identifier. The identifier is displayed by the software on the first-launch screen under "show what is sent". The Controller will respond within one month.
You may also lodge a complaint with the supervisory authority of the country in which you reside or work.
11. Changes
Where this notice changes materially, the software will present the revised version for acceptance before continuing.