Privacy policy
Your drawings are your clients’ confidential documents. This page says exactly what we hold, where it sits, who else can touch it, and how to get it back or have it destroyed.
It is written against the system we actually run. Where something leaves the UAE, clause 4 names it rather than leaving you to find out.
- Last updated
- 6 October 2026
- Applies to
- trueqty.com · app.trueqty.com
1Who we are
TrueQty is operated by AI Agentiva FZC LLC, a company licensed by the Ajman Free Zone Authority in the United Arab Emirates.
Registered address: CWS-2V-321457, 26th Floor, Amber Gem Tower, Ajman, United Arab Emirates
Trade licence: 262906536888, issued by the Ajman Free Zone Authority
For anything in this policy — a question, a correction, a request to export or delete your data — write to enquiries@trueqty.com. A person reads it.
We are the controller for account and billing data. For the drawings and documents you upload, you are the controller and we are your processor — they are your clients’ material, held on your instructions.
2What we collect
What you give us
Your name, work email and company when you open an account. Your billing details when you subscribe. The names and email addresses of colleagues you invite.
And the work itself: the drawings, specifications, bills of quantities and schedules you upload, together with the project and client names you type against them.
What the platform produces
Counts, device positions, cable lengths, bills of quantities, priced lines and generated proposals — everything derived from your drawings.
And an audit trail: who uploaded, who corrected a classification, who approved a sheet, who ran pricing, who exported a document, and when. This is deliberate and is the point of the product — a quantity that cannot be traced back to a person and a mark on a drawing is not a quantity anybody should sign.
What we collect automatically
Standard server logs: the request, the time, the response, and the address it came from. We use them to diagnose faults.
We also count sign-ups and analysis runs against a hashed form of the caller’s IP address, to stop abuse. The hash uses a secret that rotates daily, so the counters cannot be turned back into a list of who visited, and they are swept after about two days.
What we do not collect
We never see your card number. Card details are entered directly with Stripe and never reach our servers; we hold only the brand and last four digits Stripe reports back, so you can recognise your own card.
We do not use advertising or analytics trackers on the application. There is no third-party advertising pixel on app.trueqty.com.
3Where it is stored
The application, the database and every file you upload run on Oracle Cloud Infrastructure in the Dubai region (me-dubai-1). That is where your drawings, your quantities, your bills and your proposals sit, at rest, in the United Arab Emirates.
Backups are encrypted before they leave the database and are stored in the same region. The encryption key is held separately from the servers, so a backup cannot be read by anyone who gains access to the machine that wrote it.
This website — trueqty.com — is served from a global edge network and is separate from the application. It carries no project data.
4What leaves the UAE, and when
We do not claim that your data never leaves the country, because that is not true of any system that takes card payments and sends email. Here is every flow that leaves, and what each one carries.
| Who | What they get | Where | When |
|---|---|---|---|
| Oracle Cloud InfrastructureRuns the application, the database and the object storage | Everything you upload and everything the platform derives: drawings, documents, counts, bills of quantities, proposals, account records | UAEUAE — Dubai region (me-dubai-1) | Whenever the service is used |
| StripeTakes payment and holds the subscription | Your billing email, your company name, your card details (entered directly with Stripe — they never reach our servers), and your invoices | Outside UAEUnited States and Ireland | Whenever the service is used |
| ResendSends transactional email — verification, receipts, invitations | The recipient address and the contents of that message. No drawings and no quantities | Outside UAEOutside the UAE (Amazon SES, Asia-Pacific) | Whenever the service is used |
| VercelServes this marketing website only | Standard web request logs for trueqty.com. The application at app.trueqty.com does not run on Vercel and no project data passes through it | Outside UAEGlobal edge network | Whenever the service is used |
| OpenAI (or the configured model provider)Sorts uploaded files into drawings, specifications, bills and schedules | The file name and a short text excerpt from the first page — only for files our own rules could not classify | ConditionalOutside the UAE | Only when a model is configured, and only for files the deterministic classifier could not place. No image is sent on this path. |
| OpenAI (or the configured model provider)Reads a scanned drawing when no other method can | Image tiles of that drawing sheet, and a crop of the symbol being searched for | ConditionalOutside the UAE | OFF BY DEFAULT. Only runs if your deployment enables the scan fallback, and only on raster sheets where the in-region detector found nothing. |
| OpenAI (or the configured model provider)Reads a riser diagram's topology when our own reader cannot | Text labels from that sheet with their coordinates. No image and no file | ConditionalOutside the UAE | OFF BY DEFAULT. Only runs if your deployment enables the topology fallback. |
The three model flows, in plain words
Two of them are off unless your deployment turns them on. If they are off, no part of a drawing — no image, no geometry — is sent to any model outside the UAE.
- Sorting uploaded files. When you drop a folder in, we work out which files are drawings and which are specifications or bills. Our own rules settle almost all of them. For the few they cannot, the file name and a short text excerpt from the first page are sent to the configured model. No image is sent on this path.
- Reading a scan. Where a sheet is a scan or a flattened export with nothing machine-readable left in it, and our in-region detector finds nothing, image tiles of that sheet can be sent to a vision model to locate symbols. This is off by default. What comes back is positions you then review and approve — never a bare number.
- Reading a riser. Where our own reader cannot resolve a riser diagram’s racks, the sheet’s text labels and their coordinates can be sent to a model. No image and no file. This is off by default.
Every one of these calls is logged with what was sent, to which model, for which file. If you need to know whether anything of yours has ever left, we can tell you from that record.
What the model provider does with it
Under OpenAI’s API terms, data submitted through the API is not used to train their models. It may be retained by them for up to 30 days for abuse monitoring, after which it is deleted.
We state the 30-day window because that is the arrangement we have today. We are not claiming a zero-retention arrangement, and we will not until one is in place and we can evidence it.
If your deployment is configured with a different model provider, their terms apply instead and this paragraph does not. Ask us which is configured for your account and we will tell you.
5Who can see your work
Nobody outside your workspace. Every project, drawing, count and bill is scoped to your tenant and enforced at the database, not merely filtered in the application. One customer’s tender is never visible to another.
Inside your workspace, access follows the role you give each person. Who may review a drawing and who may approve it for pricing are separate permissions, and both are recorded.
Our own staff do not browse customer projects. Access to production is limited to the people who operate it and is used for fault diagnosis and for work you have asked us to do. Where we need to look at a specific project to help you, we ask first.
6How long we keep it
| What | How long | Why |
|---|---|---|
| Your projects, drawings and quantities | For as long as your workspace exists | They are the work. We do not expire them on you. |
| A deleted workspace | 30 days, then permanently destroyed | So a cancellation made in haste can be undone. After 30 days nobody can recover it, including us. |
| A data export you request | 7 days, then the archive is deleted | An export is a complete copy of your workspace in one file. It should not sit in storage indefinitely. |
| The audit trail | For the life of the workspace | It is what lets a quantity be opened backwards and attributed. Deleting it would remove the record the product exists to keep. |
| Invoices and payment records | As required by UAE tax and company law | We are required to keep them, and so are you. |
| Abuse-prevention counters | About 2 days | Enough to stop a flood of sign-ups; too short to be a record of who visited. |
| Server logs | Typically 30 days | Diagnosing a fault, and nothing else. |
The thirty-day window on a deleted workspace is a real window, not a figure of speech: inside it the workspace is read-only and you can restore it yourself. After it, the data and the files are destroyed and no one can bring them back.
7Getting your data out, and getting it deleted
Export
Any workspace owner can request a full export from the account screen. It produces one archive containing every file you uploaded, every proposal generated, and the figures as CSV — projects, drawings, counts, bills of quantities and priced lines.
The CSVs are deliberately readable in Excel without TrueQty. An export that only works inside the product it came from is not an export.
Deletion
Also from the account screen, and it does what it says: every project, drawing, count, bill and proposal is destroyed, along with the files in storage. There is a thirty-day window first, during which you can change your mind.
If you would rather we did it, write to enquiries@trueqty.com.
Your other rights
You can ask us what we hold about you, have it corrected, object to a particular use, or ask us to restrict processing. Write to the same address. We will answer within 30 days, and sooner where we can.
Where you are the controller and we are your processor — which is the case for everything your clients’ drawings contain — we act on your instructions and will help you answer a request made to you.
8Security
Data is encrypted in transit and at rest. Backups are encrypted independently, with the key held off the server that writes them.
The drawing-analysis service has no public route: it is reachable only by the application, on an internal network, and is not exposed to the internet. Credentials are held in a secret store rather than in configuration files or images.
We will tell you about a breach affecting your data without delay, with what we know and what we are doing — not after we have finished investigating.
A fuller account of what is implemented, and of what we are deliberately not yet claiming, is on the Security & data page.
9Cookies
The application uses one cookie, to keep you signed in. It is not used for tracking and there is no advertising network involved.
This marketing site sets no advertising or analytics cookies. If that changes, this clause changes with it and the date at the top moves.
10Changes
When this policy changes in substance we update the date at the top and, where the change affects how your data is handled, email the workspace owner before it takes effect.
We do not quietly widen what we are allowed to do with your data and rely on a date change to cover it.
Related: Terms of service · Refunds & cancellation · Security & data