Privacy Policy

Effective: 28 October 2026 · Version 3.0

1. Who we are

Cadvix is a partnership established in Israel, VAT registration 558585436, at Edar 35, Modi'in 7177072, Israel. We make CADVIX, software for joiners, cabinet makers and kitchen designers: a Windows application that runs a business's clients, quotes and documents, and the CADVIX designer, which draws the kitchens. In this policy "we" and "us" mean Cadvix, and "you" means the business that subscribes and the people who work there.

Data protection contact: Itay Zilberschmidt, support@cadvix.com

We are the controller of the personal data this policy describes. For the records you keep about your own clients, you are the controller and we act for you, except where section 15 says otherwise.

Representatives. As we are established outside the United Kingdom, we are appointing a UK Representative under Article 27 of the UK GDPR, and will publish their details here. Before we offer CADVIX to businesses in the European Union, we will appoint an EU Representative under Article 27 of the EU GDPR.

As an Israeli business we are also subject to Israel's Protection of Privacy Law, 5741-1981.

2. The short version

Your client records live in an encrypted database on your own computer. We hold no key that opens it. What travels between your own computers is sealed on your machine first, and we cannot open it.
Some things do leave your computer and reach us readable. Section 5 lists each one: daily usage counts, crash reports, the problems and ideas you send us, session packages from the designer, and Cadvix AI. For each it says what it carries, when it travels, how long we keep it and the switch that stops it.
Cadvix AI sends your conversation, with a picture of the design you are working on, to our AI provider, so that it can answer you. Our Sub-processor List names it.
Our own services are in London, on Amazon Web Services. The desk that receives reports and session packages is hosted in London by Vercel and Supabase. Our AI provider and some of our other providers process data in the United States (section 12).
We do not sell personal data, and nothing in the software is used for advertising.

The rest of this policy sets that out precisely.

3. What stays on your computer

The following is held in an encrypted database on your Windows computer, opened with a key kept in that computer's own secure store. We hold no readable copy of it.

Your clients: names, addresses, telephone numbers, email addresses, contacts, installation sites, delivery and installation dates, and meetings with them.
Notes, tasks and everything written in free text about a client.
Quotes, and the documents attached to a client, a design or a quote.
Your business's settings, including the addresses of your automations and their signing secrets.

Kitchen designs, and every saved version of them, are kept as files beside it. A design file holds no client's or designer's name, but it holds whatever a person typed into it, such as a note or a view's name.

We cannot read it, and we cannot recover it for you. The key that opens a business's data is created on its first computer and is never sent to us.

Your backup is yours. It goes to a folder you choose, or to your own Google Drive (section 7). In it, the database is sealed with your key, but the designs and the files attached to kitchens, quote documents included, can be read by anyone who can open that folder or that Drive.

Every business has a recovery copy of its key, split into two halves. One half sits in your own backup. We hold the other, a random value that opens nothing on its own. Only the business's owner, or someone the owner authorised, can ask for it, and the whole business is told when it is released.

How long a client is kept is your choice. In Settings, Privacy, Old clients, a manager can have CADVIX delete clients nothing has happened with for a period the manager picks. It is off until a manager chooses a period.

What someone at your business typed about a client can still leave the computer in two ways: in the reports, session packages and Cadvix AI conversations of section 5, and in what your business chooses to send to its own tools and accounts (section 7).

4. What we hold to run your account

We need these details to provide CADVIX. Without them a business cannot have an account.

What	Details
Your business	Its name, branch, sign-in identifier and the date it was created
The people who work there	Name, business email address, role, whether they are active, and the dates on their record. Who owns the business, who is named to take it on, and who may act for the owner
Signing in	Your password, stored only as a salted scrypt hash. Your sessions, stored only as a hash. Counts of failed attempts, so that guessing is slowed. We no longer ask for a code from an authenticator app: a secret set up before 27 October 2026 is kept but not used, and a version of CADVIX that is not up to date may still ask for a code. When signing in with Google is offered and you use it, Google sends our service a token carrying your Google account's identifier and email address, which we check and keep to recognise you
Computers and seats	Each computer approved into the business, who approved it, which person holds which seat on which computer, and the version of CADVIX each runs
Your subscription	Paddle's customer and subscription identifiers, the subscription's state, seats, next billing date and the email address that bought. If an email to that address bounces or is reported as unwanted, the date it happened
The activity log	Which person did which action to which object, and when, written in identifiers from a closed list, with no free text
Sealed parcels	Changes on their way between your computers, through our relay in London. We see that a parcel exists, its kind, size and addressing, and nothing inside it
Technical logs	Like any hosting service, the services we use record technical request logs, which can include IP addresses. We do not join them to your account's records

Email we send. From our service in London, through Amazon SES: the invitation that connects a purchase to a business, password-reset codes, notices to a business when something exceptional happens to it, a colleague's starting code, a note that a client was handed to someone, and letters about who owns the business. From support@cadvix.com, through Google Workspace: a receipt when you send us a report, and one email when it is closed. If an email bounces or is reported as spam, Amazon SES keeps the address on our account's suppression list, so that nothing more is sent to it.

5. What the software sends to us, and how to stop it

Each item below leaves your computer only as described. The switches are in CADVIX, Settings, Privacy, unless the item says otherwise, and only a manager can change them, for the whole business. Anyone at your business, including a person who cannot change the switches, can object by writing to us (section 16).

5.1 Daily usage counts

Since 21 September 2026. CADVIX counts, for your whole business and one day at a time, how often things happen: a sign-in, a client added, a kitchen opened, a quote printed, and a few more from a closed list. Settings, Privacy shows exactly what is counted, with the current numbers.

What reaches us: one package a day from each computer, carrying the date, the CADVIX version, the operating-system family, the count for each event, and a random identifier of the package itself, so that a package sent twice is counted once.
What it never carries: names, text anyone typed, addresses, telephone numbers, email addresses, prices, file names, the contents of designs, any identifier of a person, a computer or a session, any time finer than a day, and the order in which things happened.
How: to our own service in London, as your signed-in business. The counts of your computers are added together per business and per day.
Switch: turning counting off stops it at once, deletes what your computers hold, and deletes what we hold about how your business uses CADVIX the same day.

5.2 Crash reports from the designer

Since 24 October 2026. When the designer starts after it crashed, it sends a crash report by itself, and a small note tells you it was sent.

What it carries: a report on the computer (its model, processor, graphics card and driver, memory, Windows version, screens and free disk space, and the designer's version), where it crashed, the last hundred or so actions by the product's own names, the session log of the run that crashed, and who sent it: your business's name, your name and your email address. It carries no picture and no design.
The session log has the Windows user name removed and every design's file name replaced by an identifier, but it can still hold other text a person typed, or the name of a file the person exported.
Switch: in the designer's own Settings, on each computer. After a crash, the session package of the run that crashed also goes at the next start, unless "Session data to Cadvix" is off (5.4).

5.3 Problems and ideas you send us

Since 24 October 2026 in the designer, and since 25 October 2026 in CADVIX. The Feedback button sends us a problem or an idea. It leaves only when you press Send, and you see everything it carries first.

From the designer: your words, a picture of the designer's window (the client's name on a drawing's title block is hidden, and you can remove the picture), the last hundred or so actions, the computer report described in 5.2, the design if you leave its box ticked, the session log, and who sent it.
From CADVIX: your words, which screen you were on, a snapshot of the computer made only of numbers, versions and closed words, and who sent it. CADVIX refuses words that contain one of your clients' names, a postcode, an email address or a telephone number. It sends no picture, no design and no log.
Cadvix AI can fill the Feedback window for you when you ask it to. You still press Send.

5.4 Session packages from the designer

Since 27 October 2026. At the end of every design session, the designer sends a session package by itself, without showing it first: when a design is replaced by another, at Save and exit, at Exit without saving, and when the window is closed. After a crash it sends the package of the run that crashed at the next start.

What it carries: the session log of that run, the design as it stood when the session closed, unsaved changes included, the session's Cadvix AI conversation in the words of both sides, who it is from (your business's name, your name and your email address), the designer's version, and how the session ended. It carries no picture.
Client details can reach us in it. Telephone numbers and email addresses are removed from the conversation by pattern, but a name is not. A name typed into a design, the log or the conversation can therefore reach us. Please keep clients' details out of the conversation.
Why: to find the problems nobody reported, and to improve the designer and Cadvix AI.
Switch: "Session data to Cadvix". It is on unless a manager turns it off. It governs a designer started by CADVIX 1.18.0 or later; with an older CADVIX the designer follows its own setting, which is on, so keep CADVIX up to date. Turning it off stops the packages that would follow. It does not delete those already sent: ask us and we will (section 16).

Reports and session packages reach Cadvix's report desk, hosted in London by Vercel and Supabase. The people who work on CADVIX for us read them there to understand and fix what they show, working with our AI provider's model, which reads a report to reproduce and explain it. A person decides what is done.

5.5 Cadvix AI

Cadvix AI is the assistant in the designer. It answers questions and, when you ask it to, changes the design. It is on for every business unless a manager turns it off in CADVIX, Settings, Business. Each seat adds a monthly allowance of AI design changes, shared across the business and shown in the software.

What is sent with each message: the conversation so far, what you wrote, what is on your screen in the designer, a description of the scene and of the catalogue items you starred, a picture of the design, and what the designer's tools answered. It goes through our own service in London to our AI provider, which produces the answer. Apart from the learning record below, our service keeps none of these words in a log, a file or a table.
What we keep of each message: a record with no words in it (the business, the day, the model, how much was used, how long it took and how it ended), kept 400 days; and the counts against your allowance.
The learning record: for each message, its words, the answer and the steps taken, with your client's name as CADVIX knows it, telephone numbers and email addresses removed first, kept under a pseudonym of your business in London for twelve months, to improve Cadvix AI. A name typed in a way CADVIX does not know can survive that removal. It is collected unless a manager answers no in Settings, Privacy, the same answer as in 5.6, and answering no deletes what was kept.
Our AI provider processes each request to produce its answer, and may keep it for a limited period under its own terms, for example to check for misuse.
The conversation also travels in session packages (5.4), unless that switch is off.

Cadvix AI's answers can be wrong. Check every dimension and every change before you rely on it.

5.6 Design records for learning

Since 22 September 2026, when a kitchen is saved, CADVIX builds a record of the design on that computer, with every name and all free text removed. None has been sent to us yet. If and when they are, they will follow these rules: a record is made from a closed list of signals; all free text is dropped; no identifier of a client travels in any form; location travels only as a coarse area and price only as a band; and the business is known only by a pseudonym we mint, so that a change of mind can be honoured. Because of that pseudonym, a record is pseudonymised rather than anonymous. A business that has not answered is contributing, and Settings, Privacy says so. Answering no excludes the business from every export and deletes the records waiting on its computers. We will update this section before any record leaves a computer.

6. De-identified design and usage data

We may create de-identified data from the designs made in CADVIX, the requests sent to Cadvix AI and the way the software is used, by removing names, contact details, addresses and other details that identify you, your business or your clients. Examples are room layouts, dimensions, cabinet configurations, material choices, the kinds of requests made and which features are used.

We use it to operate, maintain, secure and improve CADVIX; to develop new features, products and services, including training, testing and evaluating machine-learning models; to produce aggregated insights about how the product is used; and for research, benchmarking and statistics. Once data is de-identified so that no one can reasonably be identified from it, it is no longer personal data, and we may keep and use it after your account ends. The answers and switches in section 5 decide what is collected in the first place. We never use data received from Google's services for this (section 7).

7. Your own accounts and tools

Some features connect CADVIX on your computer directly to an account or a tool of your own. What they exchange goes between your computer and that provider, never through our servers, and the provider is your own supplier. What the software holds for a connection to Google or Microsoft is kept on that computer only, in a file encrypted by Windows for that Windows user, and is never sent to us, copied to your other computers or put in your backup. These connections become available as Google and Microsoft approve Cadvix's applications. Until then the software says so.

7.1 Google Drive, Gmail, Google Calendar and Google user data

Cadvix can back up your work to your own Google Drive, import clients from a sheet it makes in your Drive, send quotes to your clients from your own Gmail account, and keep the meetings you go to in your own Google Calendar. Each is off until you connect your Google account for it from inside the software, and you can disconnect at any time.

What we ask Google for. These permissions, and no others:

Files created by Cadvix (drive.file), for the backup and the client sheet: Cadvix can see and change only the files it created in your Drive. It cannot see, open or list any other file you keep there.
Send email on your behalf (gmail.send), for quotes: Cadvix can send a message from your Gmail address. It cannot read, search, change or delete any email in your mailbox.
Events in the calendars you own (calendar.events.owned), for your meetings: Cadvix uses your primary calendar alone, and nothing of your mail, contacts or files or of calendars others share with you.
Your account's basic identity (openid and email), with the backup and with Gmail: the email address of the account you connected, so that the software can show which account it is using, and for the backup, whether the account belongs to a Google Workspace organisation.

Anything wider that comes back is refused and not kept.

What we do with that access. The backup writes into a folder you can see in your Drive, and reads it back when you restore: your sealed database and the wrapped key that opens it, daily restore points of both, the saved versions of your designs, every file attached to a kitchen, quote documents included, a note naming your business, and a folder holding your half of the recovery copy. The client sheet is read on your computer when a manager presses Import. A quote is sent as one email, to the recipients you entered, with the words you wrote and the quote document. Your calendar receives one event for each meeting you go to, with what it is for, its day and time, and the client's name, telephone number and the place, and no guest is invited; CADVIX reads your own events for the days your Dashboard shows, from today and for at most 93 days, and keeps them on that computer only. That is the only use we make of this access.

Where it goes. All of it travels between the software on your computer and your Google account. It does not pass through our servers, and we do not keep a copy.

What we never do. We do not sell data obtained from Google, share it with or transfer it to anyone, use it for advertising, or use it to develop or train artificial intelligence or machine learning models. Nobody at Cadvix reads it.

Cadvix's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Stopping it. Disconnect your Google account in the software, or remove Cadvix's access at myaccount.google.com/permissions. Either stops access straight away. The files already in your Drive are yours: they stay there until you delete them. Emails already sent stay in your Sent folder, and events already written stay in your calendar until you delete them.

7.2 Microsoft and other mailboxes

A quote can also be sent from a Microsoft mailbox (Outlook.com or Microsoft 365), for which CADVIX asks Microsoft for Mail.Send, the account's own profile for its address (User.Read) and permission to stay connected (offline_access), and nothing that reads the mailbox. A Microsoft calendar asks for Calendars.ReadWrite and offline_access. Any other mailbox is connected through the mail server your provider gives you, and the server's name, your user name and your password are kept on that computer only, as above.

7.3 Your automations

A manager can set up to five automations, in Settings, Automations: web addresses of tools your business uses, such as Make, Zapier, n8n or a system of its own. Nothing is sent until one is set up. Then CADVIX sends each event the manager chose (a client added or changed, a note written, a task, a kitchen's stage, a price set, a quote document produced, a meeting set, and similar) from the computer it happened on straight to that address, and never through us. What is sent is readable by your tool, because that is what it is for, and can include a client's name, telephone number, email address, installation address and notes. It is signed with a secret your business keeps, and travels over HTTPS, or over plain HTTP to an address on your own office network. Deleting a client permanently sends one last event carrying only identifiers, so your tools hear that the client is gone.

8. This website

Cookies and measurement. Analytics and advertising measurement run only with your consent, each under its own choice. Our Cookie Policy lists every cookie and how to change your mind.
Enquiries. If you write to us, we keep your name, email address and message to answer you.
Our mailing list. If you asked to hear from us, Kit holds your email address, and your name and company where you gave them.
The checkout. Paddle's checkout (section 9) is loaded when you press a buy button, or when you open our buy page or a payment link Paddle sent you. If you arrived through an invitation link, your browser remembers that, so that the checkout opens for you.
Hosting. The site is hosted on AWS Amplify in London and delivered through Amazon CloudFront, whose servers record technical request logs, including IP addresses.

9. Payments

Paddle.com Market Ltd is the merchant of record for every purchase, and is the controller of the payment information it holds. Card details are entered into Paddle's own checkout, and we never receive, process or store them. We hold the purchase information listed in section 4. Paddle's own privacy policy governs what Paddle holds.

10. Why we process it, and on what basis

Activity	Lawful basis
Running your business's account, seats and subscription, moving sealed parcels between your computers, the recovery copy, the email we send about the account, Cadvix AI's answers to what you ask, and the reports you choose to send us	Contract with your business, Article 6(1)(b). For the people who work at a business, our legitimate interest in providing the service the business bought, Article 6(1)(f)
Security, preventing misuse, the activity log, technical logs, and Cadvix AI's allowance	Legitimate interests in keeping CADVIX secure and in billing fairly for what is used, Article 6(1)(f)
Crash reports	Legitimate interests in finding and fixing faults, Article 6(1)(f)
Usage counts, session packages, learning records, design records for learning and de-identified data	Legitimate interests in finding problems and improving CADVIX, Article 6(1)(f). You can object at any time with the switches in section 5, or by writing to us
Website analytics and advertising cookies, and our mailing list	Consent, Article 6(1)(a)
Purchases through the checkout, and answering your enquiries	Contract, or steps before one, Article 6(1)(b)
Keeping financial records	Legal obligation, Article 6(1)(c)

Where we rely on consent, you may withdraw it at any time, with the unsubscribe link in any email, the cookie preferences on this site, or by writing to us. Withdrawal does not affect what was lawful before it.

11. Who else is involved

We do not sell personal data. Our full list of providers, what each one does and where, is on our Sub-processor List. In summary: Amazon Web Services in London runs our own services; Vercel and Supabase host the report desk in London; our AI provider provides Cadvix AI and the model we read reports with; Paddle is our merchant of record; Google Workspace carries our internal email and the report desk's email; and website, marketing and internal providers serve this site, our mailing list and our own work, and cannot reach the software or your client records.

12. Where it is processed

United Kingdom. Our own services, on Amazon Web Services in London, and the report desk, hosted in London by Vercel and Supabase.
Israel. We are established in Israel, which holds adequacy decisions from both the United Kingdom and the European Commission, so no additional safeguard is required.
United States. Our AI provider, which processes Cadvix AI's requests and the reports we read with its model; Google, for Workspace, Analytics and Tag Manager; Meta; Kit; and Airtable. Vercel and Supabase are US companies, although the report desk's data is stored in London.
Ireland and the United Kingdom. Paddle.

Where personal data goes outside the UK and the European Economic Area, we rely on an adequacy decision where one exists, on the EU-US Data Privacy Framework and its UK Extension where the provider is certified, or on the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum for UK data. You can ask us for a copy of the safeguards that apply.

13. How long we keep things

What	How long
Account and staff records	While the business has an account with us, including after a subscription ends, so that it can come back to the same business. A business can ask us to close its account and delete them
Financial records	7 years, for tax law
Sealed parcels	While the business subscribes, and until 90 days after its subscription ends
Our half of the recovery copy	Until the business asks us to destroy it
The activity log	While the business has an account with us
Usage counts	While the business has an account with us, or until it turns counting off, when they are deleted the same day
Crash reports, and the problems and ideas you send	Until 90 days after the report is closed
Support cases sent before 25 October 2026, when Support was retired	90 days from their last activity
Session packages	12 months from the day the report desk receives each one
Cadvix AI's record of each message, with no words in it	400 days
Cadvix AI's learning records	12 months, or until a manager answers no
Enquiries to us	Until the enquiry is closed, and up to 2 years after, unless it becomes part of an account
Our mailing list	Until you unsubscribe, or 2 years without opening anything
The suppression list of addresses that bounced or complained	Until a person at Cadvix removes the address
Technical logs of our hosting providers	As each provider keeps them under its standard log retention

You can ask us at any time to delete your business's reports, session packages and learning records together. Your designs and client records are on your own computer and are yours to keep or delete. Closing your account does not reach into your computer and remove them.

14. How we protect it

Your database is encrypted whole, with a key held on your computer and wrapped by your operating system's secure store.
What travels between your computers is sealed on your computer first, and everything that travels to us, or between your computers, goes over encrypted connections.
Passwords are never stored, only a salted scrypt hash, and session tokens only as a hash.
Businesses are separated by key, not only by permission.
Updates to CADVIX and the designer are signed with our own key and checked on your computer before they are installed.
Reports, session packages and learning records are open only to the people who work on CADVIX for us, and learning records only through a read-only door.

No system is perfectly secure. If you find a vulnerability, please tell us at support@cadvix.com and we will treat it seriously.

15. If you keep client records in CADVIX

You are the controller of the information about your own clients, and you are responsible for having a lawful basis to hold it and for telling those people how it is handled. For that information we act as your processor, under our Data Processing Agreement.

Most of it never reaches us readable. A client's details can reach us only where someone at your business typed them into something section 5 sends: a report, a session package or a Cadvix AI conversation. Where we use what those carry to find and fix problems and to improve CADVIX, we do so as a controller in our own right, on the basis of our legitimate interests, and for as long as section 13 says. Please tell your clients this when you tell them how you handle their details. We can give you wording. And please ask your team to keep clients' details out of reports and conversations.

16. Your rights

Under UK and EU data protection law, and Israeli law, you may ask us to:

give you a copy of the personal data we hold about you
correct anything inaccurate or incomplete
erase your personal data
restrict what we do with it while a question is resolved
give it to you in a portable, machine-readable form
stop processing based on legitimate interests, including the uses in section 5, or stop direct marketing

Write to support@cadvix.com with your name, the email address on your account, and what you would like us to do. We reply within one month. Anyone can write to us, including a person at a business who cannot change the switches in section 5.

Your designs and client records are encrypted on your own computer with keys we do not hold, so we cannot produce copies of them: you already have them. What we can read of them, in reports, session packages and learning records, we can find and delete at your request.

17. Automated decisions

We do not make decisions about you by automated means that produce legal or similarly significant effects. Cadvix AI changes a design only when a person asks it to, and the change can be undone.

18. Children

CADVIX is a professional tool sold to businesses. It is not intended for anyone under 18, and we do not knowingly collect their data.

19. Complaints

Please come to us first, at support@cadvix.com. We acknowledge a complaint within 30 days, look into it without undue delay, keep you told how it is going, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office, at ico.org.uk, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; if you are in the European Economic Area, to the data protection authority where you live or work; and to Israel's Privacy Protection Authority.

20. Changes

We publish every version at this address, with the date it took effect. Where a change matters to you, we tell you by email at least 30 days before it takes effect. Corrections and clarifications take effect when they are published.

Date	Version	Change
January 2026	1.x	First publication
9 September 2026	2.0	Rewritten to describe the software as built. Removed statements that we collect anonymised usage data and crash reports, that designs are stored in the cloud, and that our support team can access your projects. None of those was true then. Removed the hardware identifier. Corrected the list of providers and the processing locations.
28 October 2026	3.0	Rewritten again to describe the software as it now runs. Added the daily usage counts (sent since 21 September 2026), crash reports and the problems and ideas you send (since 24 and 25 October), session packages (since 27 October), Cadvix AI and our AI provider, design records for learning, de-identified data, and your own Google and Microsoft connections and automations, with the permissions each asks for. We no longer ask for an authenticator code. Added the report desk's hosts, the website's hosting on AWS Amplify, EU rights, the right to complain to us and Israel's law. Corrected retention periods to what the software keeps. Removed the statements that the software sends nothing about how you work, has no crash reporting, and runs nowhere in the United States, which stopped being true on those dates.