Privacy
How Clayproof handles personal data. Last revised 5 October 2026.
Who is responsible
Clayproof is a product of ArcGabriel Ltd (Carlile Institute Business Centre, 54 Huddersfield Road, Meltham, Holmfirth HD9 4AE). For your account, ArcGabriel Ltd is the controller of the personal data described here. For the content you put into the service, your datums, directions and the outputs made from them, it acts on your instructions as a processor for you or your organisation. Questions and requests go to [email protected].
What is held, and why
If you sign in, Clayproof holds your email address, when you signed in, the organisations you belong to and your role in each, and the work you create there: vehicles with their datum (dimensions) and direction (the words you wrote and three tone settings), and every generation made from them with its views, forms, measurements, notes and packages; the colour and finish you choose on a form; any reference images you upload to a vehicle; and the inside you describe and the views drawn of it. It holds these to provide the service to you and your organisation, under the contract you enter by using it. Directions, reference images and interior descriptions are treated as commercially confidential: they are never written to logs or to the audit record.
If you buy a download, Clayproof holds a record of the purchase: which pack, for which design, the amount, when, and Stripe's identifiers for the session and payment. It never holds your card details; those go to Stripe's own page. The record exists so the download stays yours, and as the accounting record the law requires.
It also keeps an audit record that things happened (a sign-in, a vehicle created, a member added), with an identifier and never the content, and a cost ledger of each call to the AI providers below, by organisation and generation, with no content.
Cookies
One cookie, set only when you use sign-in or the application, keeps you signed in. It is strictly necessary, lasts up to 30 days and carries no tracking. The public pages set none, and there is no analytics or advertising.
Who else handles it
When you draw a vehicle, your direction, framed as a design request with the datum in words, is sent to fal.ai (Features and Labels Inc., USA) to draw the three views, and the drawn views are sent to fal.ai once more to make the 3D form. The inside and the screens go the same way: your words framed as a design request, and for the screens the drawn picture sent back once to read and remove invented lettering. Nothing else about you goes with any of these: not your name, your address or your organisation. Views, forms and packages are kept privately, on the service's own storage or in Cloudflare R2, and are only ever sent to members of your organisation.
If you email us at [email protected], your message is received through Resend and kept in our inbox, as text, until we delete it or you erase your account.
Sub-processors
| Who | What for | What they receive | Where |
|---|---|---|---|
| fal.ai (Features and Labels Inc.) | Draws the three views, the inside and the screens; makes the 3D form; reads the screens' pictures for invented lettering | Your directions framed as design requests, the datum in words, and the drawn pictures; nothing that identifies you | USA |
| Railway Corporation | Runs the service and its database | Everything the service holds | EU (Amsterdam) |
| Cloudflare, Inc. | The domain's DNS; private storage of views, forms, packages and encrypted backups (R2) | Connection details; stored files | EU jurisdiction for storage |
| Resend (Plus Five Five, Inc.) | Sends sign-in and invitation emails; receives mail to [email protected] | Email addresses, the messages themselves | EU (Ireland) |
| Stripe Payments Europe, Ltd. | Takes card payments for the downloads, works out VAT and issues the receipt | The paying person's email, the billing address and card details, entered on Stripe's own page; the design and pack identifiers | EU (Ireland), with transfers to Stripe, Inc. (USA) |
Transfers to the USA (fal.ai, and Stripe, Inc. when used) rest on the UK International Data Transfer Addendum to the EU standard contractual clauses, and on each provider's own participation in the UK Extension to the EU–US Data Privacy Framework where it holds one. The data sent to fal.ai carries nothing that identifies a person.
How long
Your account and your work are kept until you erase them. Spent sign-in links are cleared within hours. Verified backups of the database are kept for up to 30 days. Our purchase record goes with your account when you erase it; Stripe keeps its own record of the payment, as the accounting law that binds it requires.
Your rights
You can erase your account and everything held about you yourself, at any time, from Settings (/account/erase). An organisation where you are the only member goes with it. You can download a copy of everything held about you from Settings (Download my data). You may also ask for it to be corrected by writing to the address above, and you may complain to the Information Commissioner's Office.