Notice at Collection
California's privacy law asks companies to tell people, up front and in one place, exactly what personal information they collect and what they do with it. That law does not currently reach a shop our size. We are giving you the notice anyway, in the form the law describes, because you should not have to be protected by a statute to find out what a company holds about you.
The short version
A plain-words summary for orientation. The detail below is what actually applies.
- We collect your email and sign-in details, the design work you save, your billing record, what you type to the AI assistant, ordinary server logs, and how the site gets used. That is the whole list.
- We have never sold personal information and we never share it for cross-context behavioural advertising. There is no advertising pixel of any kind on this site.
- We do not collect sensitive personal information, so the right to limit its use has nothing here to limit.
- You can see, correct, export or delete your data. Export and account deletion are buttons in your account settings, not a request queue.
- The California Consumer Privacy Act applies to businesses above certain size thresholds, and we are below them. We grant these rights voluntarily and we say so rather than implying an obligation we do not have.
1. Why this notice exists, and whether the law applies to us
We are too small for the CCPA to cover us. We are following it anyway, and we would rather say that plainly than let you assume we are obliged to.
Bespoke Woodcraft Studio LLC, a California limited liability company, operates two design services: CabDesign at cabdesign.app and StackDesign at stackdesign.app. This notice covers both.
The threshold question, answered honestly. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to a for-profit business only if it meets at least one of three tests: annual gross revenue above roughly 25 million dollars, a figure the state adjusts for inflation; buying, selling or sharing the personal information of 100,000 or more California consumers or households in a year; or deriving half or more of its revenue from selling or sharing personal information. We are a small cabinet shop that builds software. We meet none of those three, so we are not a covered business under that law today.
What we do instead. We follow the law's approach voluntarily. This page is written in the form the CCPA prescribes for a notice at collection, the categories below are the real ones taken from our own code rather than a template, and the rights in section 9 are ones we grant as a matter of practice. We are not claiming a legal obligation we do not have, and nothing on this page should be read as a claim that the law obliges us to do any of it.
One law that does apply regardless of size. The California Online Privacy Protection Act applies to any commercial website that collects personal information from Californians, whatever the company's size. Our Privacy Policy is the conspicuously posted policy that satisfies it, and this notice is a companion to it, not a replacement. Where the two describe the same fact, they are meant to agree; if you ever find them disagreeing, tell us and we will fix it.
2. What we collect, by category
The table uses the law's own category names, so you can compare us to any other company's notice. Half of them are things we do not collect at all, and those rows say so.
The categories below are the ones the California statute defines. For each we say whether we collect it, and if we do, exactly what is in it and where it comes from. Nothing here is padded to look thorough and nothing is left out because it is awkward.
| Category | Do we collect it? | What is in it, and where it comes from |
|---|---|---|
| Identifiers | Yes | Your email address, and your name and profile picture reference if you sign in with Google. An internal account identifier and session records. Your IP address, which reaches our host's server logs on every request. The random identifier our product analytics keeps in your browser, but only if you accepted the cookie banner. From you, from Google if you use that sign-in, and automatically from your browser. |
| Personal information under California's customer records law | Yes, partly | Your name and email address, and the billing record described below. If you set a password we store only a salted hash of it, so nobody here can read it. We never receive or store your card number, which goes to Stripe directly. From you, at sign-up and at checkout. |
| Protected classification characteristics | No | We do not ask for or infer race, colour, national origin, religion, age, sex, gender, sexual orientation, disability, veteran status, citizenship, marital status, or any other protected characteristic. |
| Commercial information | Yes | Your plan, subscription status, start and renewal dates, the identifiers our payment processor gives us for your customer and subscription records, and any promotion code or beta credit on your account. During the open beta this is a zero-cost subscription record rather than a purchase history. From our payment processor and from your use of the product. |
| Biometric information | No | We collect no fingerprints, faceprints, voiceprints or any other biometric identifier. |
| Internet or other electronic network activity | Yes | Which pages you requested and when, which features you opened and in what order, the page you arrived from, your browser and device type, and error diagnostics when something fails. A cookieless page count runs on every visit. The fuller product analytics, which stores identifiers in cookies and in your browser's local storage, runs only if you accepted the cookie banner and never if you declined. Automatically, as you use the site. |
| Geolocation data | Coarse only | Country and city, inferred from your IP address by our page-count service. We do not collect precise geolocation, we never ask your browser for your location, and no product feature uses one. |
| Audio, electronic, visual, thermal, olfactory or similar information | No | We record no audio, no video and no picture of your screen. Our product analytics runs with session recording switched off deliberately, so there is no screen capture even for people who accepted cookies. If you attach a screenshot to a bug report, that image is something you chose to send us, and it is held with the report. |
| Professional or employment information | Yes, if you enter it | Your company name and the shop details you choose to put into your company standards or onto a quote, such as a business address or a licence number you want printed. These are fields you fill in, not facts we gather. From you. |
| Education information | No | We collect none. |
| Inferences used to build a profile | No | We do not build a profile of your characteristics, preferences, behaviour or aptitudes. Product analytics tells us which features get used and where people get stuck, in aggregate; we do not turn that into a picture of you, we do not score you, and we do not use it to make any decision about you. |
| Sensitive personal information | No | See section 3. |
Two things that are not in the table, because they are not really "categories" in the statutory sense but you should know we hold them. The first is your design work: projects, rooms, cabinets, dimensions, material and hardware selections, standards, pricing rules, cut lists and saved outputs. It is attached to your account, so we treat it with the same care as personal information even though most of it is furniture geometry. The second is your AI assistant conversations: the messages you send, the project context needed to answer them, and the replies. The AI Transparency page explains where those go.
And anything you send us directly. Three forms reach a person here, and each carries what you typed into it:
- The support form takes your name, your email address, a topic, and your message, and relays it to our support inbox. Our replies and the rest of the thread live in that inbox.
- The newsletter signup takes your email address and, if you give it, a first name. Nothing else, and you can unsubscribe from any message we send.
- The bug report button inside the product sends what you wrote, with your account attached and the technical detail about the page you were on that the report carries. It is held so we can reproduce the problem, fix it, and decide whether the report earned the beta reward.
3. Sensitive personal information
We do not collect any, so there is nothing here for you to limit.
California treats a short list of data types as sensitive: government identifiers such as a driver's licence or passport number, financial account credentials, precise geolocation, racial or ethnic origin, religious beliefs, union membership, the contents of your mail or messages where we are not the intended recipient, genetic data, biometric data used to identify you, health data, and data about your sex life or sexual orientation.
We collect none of it. We do not ask for it, no field in either product is for it, and we do not want it. Please do not enter it, and please do not paste it into the AI assistant.
Because we collect no sensitive personal information, the right to limit its use and disclosure has nothing to operate on here. We are naming the right anyway so you can see we have not quietly skipped it.
4. Why we collect it
To sign you in, save your work, run the assistant, keep the service up, and answer you when you write.
- To run your account. Signing you in, keeping you signed in, and syncing your work between your devices.
- To provide the tools. Storing and computing your designs, cut lists, materials and standards, so the product does what you asked it to.
- To run the AI assistant. Sending your message and the project context needed to answer it to our AI provider, and returning the reply.
- To handle billing. Creating and maintaining your subscription record, applying beta credits and promotion codes, and keeping the tax and accounting record the law makes us keep. Both products are free during the open beta, so today this mostly means holding a zero-cost subscription so your account exists in the payment system when billing starts.
- To keep the service working and secure. Diagnosing errors, preventing abuse, applying rate limits, and protecting accounts.
- To learn what to fix next. Counting page views, and, if you accepted the cookie banner, seeing which features get used and where people get stuck.
- To handle bug reports and the beta reward. Reading what you sent, reproducing it, fixing it, and deciding whether it qualified.
- To communicate with you. Service, billing and security notices, replies to your support messages, and the newsletter if you asked for it.
- To meet legal obligations and to respond to lawful requests.
We do not use your personal information for any purpose that is materially different from these without telling you first.
5. How long we keep it
While your account is open, plus whatever the law makes us keep afterwards. Deleting your account deletes the live data straight away.
We do not set an arbitrary number of days for everything, because different data has different reasons to exist. Here are the criteria we actually apply:
| What | How long |
|---|---|
| Your account, your designs, your standards and your customer records | For as long as your account is open. Deleting your account removes them from the live database at once. |
| AI assistant conversations and the project facts they produced | They live in your workspace so the assistant has continuity between sessions. You can delete them, and they go when your account goes. |
| Billing and tax records | Kept after account deletion for as long as tax and accounting law requires, and no longer. |
| Bug reports and the reward record | Kept while the beta runs and while any reward earned from them is unredeemed, so we can honour it. |
| Server logs | Kept for the short operational window our hosting provider retains them for, then discarded on its schedule. |
| Product analytics | Only collected if you accepted the cookie banner. Retained on our analytics provider's schedule, and you can clear your cookie choice at any time from the Privacy Policy. |
| Encrypted backups | Deleting from the live database does not instantly erase every backup copy. Our database provider keeps daily backups for seven days, so a deleted record leaves the backups within about a week as they age out. We do not restore deleted data from a backup except to recover from a genuine system failure. |
6. Who we disclose it to
A short list of service providers who run parts of the product for us, and nobody else unless the law makes us.
We disclose personal information for a business purpose to the service providers that run the product: our database and identity provider, our payment processor, our two AI providers, our hosting provider, our email provider, our rate-limiting provider, and our two analytics providers. Each is bound to process it only for the purpose we engaged them for. The Privacy Policy names every one of them, says exactly what each holds, and is the list we keep current.
Beyond those providers, we disclose personal information only where we have to: to professional advisers under confidentiality, in response to a lawful legal request, to protect the rights or safety of people or of the service, or to a successor if the business is sold, in which case we would tell you first.
We do not disclose personal information to a third party for that third party's own purposes.
7. We do not sell or share it
No sale, no advertising sharing, no ad pixels. Not now, and not in the twelve months before this page was written.
- We have not sold personal information, and we do not sell it. That includes your details and your customers' details.
- We do not share personal information for cross-context behavioural advertising, which is the specific thing California's opt-out right is aimed at.
- We run no advertising or marketing trackers of any kind. There is no advertising pixel, tag manager or ad network script anywhere on either site.
- We do not use your designs, dimensions, conversations or customer records to train AI models, and we do not permit our AI provider to do so.
- None of this changed in the twelve months before the effective date at the top of this page.
Because there is no sale and no sharing, there is nothing for an opt-out to switch off, and a "Do Not Sell or Share My Personal Information" link would be a control wired to nothing. We would rather tell you that than install a button for appearances. The same goes for the Global Privacy Control signal: we honour the intent behind it by never selling or sharing in the first place.
If that ever changes, this page changes first, and an opt-out that genuinely works arrives with it.
8. Records you store about your own customers
When a shop saves its customers' details here, those are the shop's records. We hold them for the shop and do nothing else with them.
Our products let a business store contact records and job notes about its own customers. That is personal information about people who are not our users, so it is worth being exact: the business decides what to collect and why, and we process it only on that business's instructions. In California terms we act as a service provider to that business, not as a business collecting for our own purposes.
We do not use those records for our own purposes, we do not market to the people in them, and we do not sell or share them. If you are one of those customers and want to see, correct or delete your record, ask the shop that holds it, because they control it. If you cannot reach them, write to us and we will do what we can to help you get to the right people.
Business users: the Use Policy sets out your side of this, and the Privacy Policy explains the controller and processor relationship in full.
9. Your rights, and how to use them
Ask us for it, correct it, take it with you, or delete it. Two of those are buttons you can press yourself right now.
We grant the following rights to everyone who uses our products, wherever you live, and voluntarily rather than because a statute compels us:
- To know. Ask us what personal information we hold about you, which categories it falls into, where it came from, why we have it, and who we disclosed it to.
- To a copy. Get your data in a portable format. You can export it yourself from your account settings.
- To correct. Fix anything that is wrong. Most of it you can edit directly in the product.
- To delete. Delete your account and the personal information attached to it. There is a button for this in your account settings, and it works without a support ticket.
- To opt out of sale or sharing. Named for completeness. We do neither, so there is nothing to opt out of.
- To limit the use of sensitive personal information. Named for completeness. We collect none, so there is nothing to limit.
- To be treated the same either way. We will not deny you service, charge you a different price, or give you a worse product because you exercised any of these.
How to make a request
Email support@cabdesign.app for CabDesign, or support@stackdesign.app for StackDesign, and say which right you want to use. You can also write to the postal address in section 12. We reply within one business day and complete the request as quickly as we can, normally well inside 45 days.
Verifying it is you. Write from the email address on your account where you can, because that is the fastest way for us to match you to your records. If we cannot reasonably confirm that a request comes from you, we may not be able to act on it. That is a protection for you rather than an obstacle, and we will tell you what we need instead of going quiet.
Someone acting for you. An authorised agent can make a request on your behalf. We will ask for written permission signed by you, and we may still ask you to confirm it directly.
If we say no. We will tell you why, in plain words, and what you can do about it.
10. People under 18
These are professional shop tools. They are not for children, and we do not knowingly collect anything from one.
Our products are not directed at children, and you must be at least 18 to hold an account. We do not knowingly collect personal information from anyone under 18. We have never sold or shared the personal information of a minor, because we have never sold or shared anyone's.
If you believe a child has given us personal information, write to support@cabdesign.app for CabDesign, or support@stackdesign.app for StackDesign, and we will delete it.
11. If our size ever changes
If we grow into the law, we will say so here instead of quietly leaving this page as it is.
The thresholds in section 1 are about the size of the business, and businesses grow. If we ever cross one of them, the CCPA will apply to us as an obligation rather than a choice, and some of the wording on this page will have to change: the voluntary framing, the response deadlines, and the formal request channels a covered business has to offer.
We will update this page and the Privacy Policy when that happens, and we will date the change. We will not leave a page saying "we are below the threshold" standing after it stops being true.
12. How to reach us
Two ways, both of which reach a person.
Bespoke Woodcraft Studio LLC, a California limited liability company
688 N Rimsdale Ave
Covina, CA 91722, United States
Email: support@cabdesign.app for CabDesign, or support@stackdesign.app for StackDesign, answered within one business day.
We keep this notice one click from the Privacy Policy so you can reach it before you give us anything, and we link it wherever we ask you for personal information.