Privacy Policy

Enginuity Labs Inc., a Delaware corporation (“Enginuity Labs,” “we,” “us,” or “our”), provides Enginuity Design Studio, an AI engineering design platform. We are responsible for the personal data described in this policy; depending on where you live, we may be called its “controller” or “Data Fiduciary.” Our subsidiary, Enginuity Labs Private Limited (CIN U62091TN2026PTC190895), develops, operates, and supports the Service for us under our instructions.

This policy covers the Service: our desktop application and its add-ins, our cloud services and AI agents, and our website at enginuitylabs.org. It does not cover third-party software you connect, which is governed by its own policy. If you have signed a separate agreement with us that addresses data, that agreement controls where it conflicts with this policy.

Account information

Your name, email, profile picture, and an account identifier, which we receive from Google or Microsoft when you sign in. We never receive your password for those accounts. We also collect your organization and access records, the plan and usage limits on your account, and which version of our Terms, EULA, and this policy you accepted, and when.

Your content

Your prompts, messages, and conversations with our AI agents; images and files you attach and CAD files you import; and, when you turn on voice features, your voice input, which is streamed to our voice provider for real-time processing and may be saved as transcripts in your conversation history.

Design and workspace data

To carry out your instructions, the desktop software reads information from the engineering applications you connect and sends it to our servers, including model and document state (features, sketches, geometry, dimensions, and parameters), images of your model views, the code and commands the Service generates, the results and errors from running them, and simulation setups, meshes, and results.

Connected platform credentials

When you connect a platform such as Onshape, you authorize access through its own sign-in, and the resulting credentials and add-in pairing keys are stored on your device, not on our servers.

Information we collect automatically

Technical data such as your IP address, operating system, and application version; and service logs such as requests, errors, and performance data that our servers generate as you use the Service. Our website counts page views in aggregate using Vercel Web Analytics, without cookies.

We do not seek sensitive data such as health, biometric, or government-identifier data. Please keep it out of your prompts and files.

We use your data to:

• ·Provide the Service: authenticate you, carry out your design requests, generate responses and code, store your conversations and projects, and support you
• ·Keep the Service safe: enforce limits, prevent abuse, and secure our systems
• ·Improve and develop the Service, our products, and our AI models, including by analyzing how the Service is used and the Output it produces, and by creating de-identified and aggregated data
• ·Train and fine-tune our AI models, as described in the next section
• ·Communicate with you about the Service, including changes to our terms, and respond to your messages
• ·Meet our legal obligations and establish or defend legal claims

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases: performance of our contract with you, to provide the Service and communicate about it; our legitimate interests, to secure, improve, and develop the Service and our models, balanced against your rights and subject to your right to object; your consent, where we ask for it, which you can withdraw at any time; and compliance with our legal obligations. If you are in India, we process your data on the consent you give when you accept this policy and for the legitimate uses the Digital Personal Data Protection Act, 2023 allows; you can withdraw consent as described below, though we may then be unable to provide the Service.

The Service works by sending your prompts, design data, and model images to AI model providers, which generate the responses and code it returns to you. We use these providers under terms that let them use your data only to provide their services to us, not to train their own models; some may keep it for a short period to monitor for abuse.

We use Your Content, including your conversations, design data, and Output, to improve and to train and fine-tune our own AI models and products. Where the law requires your consent to use identifiable personal data for training, we rely on the consent you give when you accept this policy, which you can withdraw at any time; where consent is not required, we rely on our legitimate interests, and you can object. We can always use de-identified and aggregated data, which does not identify you, your organization, or your designs, for any purpose. If you sign a separate agreement with us that limits how we use your data, that agreement controls.

We do not sell your personal data or share it for cross-context behavioral advertising. We share it only as needed, under contracts that require protection.

If an organization gives you access, its administrators may view and manage content in its workspace. When you connect an engineering platform, we send code and commands to run in your environment, and that platform processes them under its own terms. We may disclose data where we believe in good faith the law requires it, or to protect the rights, property, or safety of our users, the public, or Enginuity Labs. If we are involved in a merger, acquisition, or sale of assets, data may transfer as part of it, and the recipient will remain bound by this policy or we will notify you first.

We store your data mainly in the United States. Our team, including our subsidiary’s staff in India, may access it from India to operate and support the Service, and our providers may process it in the United States and other countries where they operate. Where the law requires, we protect transfers with safeguards such as the European Commission’s Standard Contractual Clauses and their UK equivalent. We do not transfer personal data to any country to which the Government of India has restricted transfers.

We keep your account data and content while your account is active. After you close your account or ask us to delete your data, we remove it from our active systems within 30 days, and from backups within six months as they are overwritten in our normal backup cycle. We keep service logs for up to six months, unless we need them longer to investigate a security incident. Where a law requires us to keep certain data longer, we keep it only for as long as that law requires, and no longer. De-identified and aggregated data, which does not identify you, may be kept without this limit.

We protect your data with encryption in transit (TLS) between the desktop software, our servers, and our providers; encryption at rest for our database and file storage; private storage for your attachments and model images; and access controls that limit access to staff who need it. Because you sign in through Google or Microsoft, we do not store passwords. No system is completely secure, and we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant authorities, including the Data Protection Board of India, as the law requires.

Wherever you live, you can ask us to give you a copy of your personal data, correct it, or delete it, and withdraw consent you have given. Email privacy@enginuitylabs.org with the subject “Privacy Request.” We may need to verify your identity, and we respond within 30 days, or sooner where the law requires. We will not discriminate against you for exercising your rights.

If you are in the EEA or UK, you can also ask us to restrict or object to processing based on our legitimate interests, and to port your data, and you can complain to your local data protection authority.

If you are in India, under the Digital Personal Data Protection Act, 2023 you can get a summary of the data we hold and whom we have shared it with, have it corrected or erased, withdraw consent as easily as you gave it, nominate someone to exercise your rights if you die or become incapacitated, and have grievances addressed. Raise grievances first with our Grievance Officer, Jaayanth Srrinivas Kumaran, Chief Executive Officer, at privacy@enginuitylabs.org (subject “Grievance”); if you are not satisfied, you may complain to the Data Protection Board of India.

If you are in California or another U.S. state with a privacy law, you can ask what personal data we hold and how we use and disclose it, access, correct, and delete it, and opt out of any sale or sharing or targeted advertising. We do not sell or share personal data or use it for targeted advertising.

Our website does not use advertising or tracking cookies, and our analytics do not use cookies. Our access portal uses one essential cookie to keep you signed in. The desktop software stores your session and settings on your device. If you block the essential cookie, the portal will not keep you signed in.

The Service is for adults aged 18 and over. It is not directed to children, and we do not knowingly collect data from anyone under 18. If you believe someone under 18 has given us data, email privacy@enginuitylabs.org and we will delete it.

We may update this policy. We will post changes here with a new “Last updated” date and notify you of material changes by email or in the Service at least 14 days before they take effect. Where the law requires, we will ask for your consent again.