The data controller is the operator of ourCAD [LEGAL REVIEW: company name, ID, registered office, contact e-mail]. Sign-in and account management is provided by ourPortal (www.ourportal.cloud) within the same ecosystem.
| Category | Data | Purpose · legal basis |
|---|---|---|
| Account | e-mail, name, avatar, roles, plan and quotas (from ourPortal) | providing the service · contract |
| Content | documents, models, drawings, comments, version history (git) incl. change author | providing the service · contract |
| Operational logs | HTTP request records (path, time, result) including the signed-in user's e-mail | security and diagnostics · legitimate interest; retention given by system log rotation (weeks) |
| Internal diagnostics | request tracing (OpenTelemetry/Jaeger — paths and latencies), aggregated metrics (Prometheus, no identity) | operations and performance · legitimate interest; internal infrastructure only |
| Audit trail | who changed a document and when, acceptance of the Terms (version + time) | accountability and collaboration · legitimate interest / contract |
| Telemetry (optional) | anonymous usage aggregates: names of used features, performance metrics (ms), error counts — no identity, no stored IP, never document contents | improving the service · consent ("Analytics" category in the cookie banner); withdrawable in Settings → Privacy |
We use only essential authentication cookies plus browser local storage for UI preferences — details including the cookie table in the Cookie Policy. Your telemetry consent choice is stored in the browser and, for signed-in users, with the account.
Data is processed on our own infrastructure. Static pages load the Bootstrap library from the jsDelivr CDN (the CDN sees your browser's IP address, as with any website). We do not share data with third parties for commercial use.
You have the right of access, rectification, erasure, restriction, portability and objection; for telemetry, the right to withdraw consent at any time (Settings → Privacy). The application provides a personal data export (GDPR Art. 15) and an account deletion request (Art. 17) directly — Settings → Privacy. Complaints can be lodged with the Czech DPA (uoou.cz).
We announce substantial changes in the application. The current version is always available at this address.