Version 2026-10-12

Privacy policy

CPDG Engineering, San Francisco, California, operates CPDG Traffic Control. Contact help@cpdgengineering.com for privacy questions, access, correction or deletion requests.

Information we process and why

We process your email, name, company and account records to provide access and administer the service. We store a salted password verifier, verification/reset token digests, session records and terms acceptance. We process project names, site addresses, drawings, uploaded files, exports and recovery data to provide drafting, saving and recovery. We process security logs, limited usage counters and hashed rate-limit identifiers to protect the service and enforce capacity limits. Support correspondence is used to investigate and respond to your request.

If you enter a job description on the landing page, we retain the draft for up to 24 hours unless it becomes part of your saved project or assistant conversation. Sending a message to the optional assistant transmits the prompt and relevant drawing/tool context to your connected model provider. Its account login and conversation state are stored privately on our host so the connection can survive a restart. You can use drawing tools without connecting an assistant.

Providers and sharing

The application is hosted by Hetzner, with encrypted recovery backups stored separately. Resend processes account email and verification/reset links; Google Workspace processes support email. Cloudflare provides operational monitoring infrastructure. Your chosen model provider processes assistant requests when you use that feature. Google processes addresses, map locations and browser/map requests if Google Maps is enabled. Provider policies and account controls govern their independent processing; deleting a CPDG account does not automatically delete records held by another provider.

We do not sell personal information or use the application for cross-context behavioral advertising. The application does not include advertising trackers. We disclose information to providers as needed to operate the service, to authorized workspace users for shared work, and when reasonably necessary to comply with law, protect rights or investigate misuse. Providers may process information in countries other than your own. We do not promise that every provider keeps all information in a single country.

Cookies and browser settings

We use necessary cookies for sign-in and for carrying your landing-page request through account creation. Browser storage also remembers interface preferences. We do not use advertising cookies. The app does not change its operation in response to Do Not Track or Global Privacy Control because it does not sell information or share it for behavioral advertising.

Retention and deletion

Active account and project records are retained while needed to provide the service. The project Delete action moves a drawing to trash; it is not a promise of permanent erasure. Request permanent deletion through support. Deleting an individual account does not remove company drawings owned or used by others. After verifying identity and scope, we aim to complete deletion within 30 calendar days or explain delays or lawful exceptions. Applicable legal deadlines take precedence.

Encrypted backups follow a schedule of seven daily, four weekly and three monthly snapshots. Copies may remain until snapshots expire and pruning succeeds. Separately retained incident snapshots are reviewed monthly and kept only while justified for recovery, security or legal needs. Minimal hashed deletion records are kept while relevant backups exist to prevent deleted accounts or companies from being restored to active use. Support correspondence is reviewed after 12 months from closure and removed unless still needed. Provider delivery records, recipient mailboxes and provider account histories have separate retention and controls; we review applicable stores when handling a request instead of promising automatic erasure everywhere.

Your choices and changes

Contact support to request access, correction, export or deletion. We may ask you to verify identity and authority over shared company data; do not email passwords, API keys or reset links. We respond to applicable privacy rights without unlawful discrimination. The service is for adults and is not directed to children. We use technical and organizational safeguards but cannot guarantee absolute security. We will update this notice when practices change and communicate material changes through the service or account contact details.