Privacy Policy

Last updated: October 7, 2026

Welcome to GrandpaCAD! We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share your personal information when you use our Service.

The data controller for your personal data is OTIVIA 32, d.o.o., Čufarjeva ulica 15, 2250 Ptuj, Slovenia. You can reach us at vito@grandpacad.com.

Information We Collect

When you use GrandpaCAD, we may collect the following information:

• Account Information: Your email address and name that you provide when you sign up.
• User Content: All the 3D models you generate and the chat messages you create while using the Service.
• Usage Analytics: We collect information about how you use GrandpaCAD to help us improve our product. This data is stored in PostHog, located in the European Union.
• Subscription Information: We store information about your active subscriptions. Payments are processed by Polar.sh, and we do not store your full payment details.

How We Use Your Information

We use the information we collect for the following purposes:

• To Provide and Improve Our Service: We use your information to operate GrandpaCAD, develop new features, and enhance your user experience. For example, usage analytics help us understand which features are most popular and how we can make the Service better. We may also use this data to roll out new features to smaller subsets of users for testing. We don't use your private generations to train AI; models you make public may be used to help improve it.
• To Communicate With You: We may use your email address to send you important updates about the Service or to respond to your inquiries.

We do not sell your personal data to third parties.

Our legal basis

• We process your account and subscription data to provide the Service you signed up for (performance of a contract).
• We use analytics to keep the Service working and to improve it (our legitimate interest in running and improving the product).
• Where we ask for your consent (for example certain analytics or marketing emails), we rely on that consent, and you can withdraw it at any time.

Third-Party Services

We use the following third-party services to help us operate GrandpaCAD:

• PostHog: For product analytics, and for a record of each AI request (what was sent to the AI model and what it returned) so we can fix and improve generations. Data is stored in their EU cloud.
• Polar: For processing payments and managing subscriptions. Your payment information is handled by Polar.sh and is subject to their privacy policy.
• OpenRouter: For running the AI models that design your models. OpenRouter passes your messages and attached images to the provider of the model in use (for example OpenAI, Google or Anthropic).
• Google (Gemini API): For making the reference image a figurine or character is built from, and for looking up datasheets. It receives the description, any reference images and the search.
• Modal: For the GPU servers that run our own models for figurines, characters, rigging and animation. The data is processed there and sent straight back to us; we don't keep anything on Modal, and Modal doesn't use it for its own purposes.
• UploadThing: For storing the files you attach and the model files GrandpaCAD makes.

Some of our providers (OpenRouter and the model providers it uses, Google, Modal, UploadThing, Polar) are based outside the EU. When your data is transferred outside the EU, it is protected by an approved transfer mechanism, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

ChatGPT, Claude and other AI assistants

You can connect GrandpaCAD to an AI assistant, for example as a ChatGPT plugin, a Claude connector or any other MCP client. The assistant then asks GrandpaCAD to make and change models for you. This section covers what that connection adds to the rest of this policy.

What we collect

• The brief your assistant writes for GrandpaCAD, the answers and approvals it passes on, and GrandpaCAD's replies. They're saved as a chat in your account, the same as a chat you start on the website.
• Photos, sketches and 3D files (STL, GLB, 3MF or OBJ) the assistant attaches, and the models GrandpaCAD makes from them.
• Which assistant you connected (the name it registered with), when you allowed it, the workspace its models go to, and the OAuth tokens it uses to act for you. The assistant never gets your GrandpaCAD password.
• Tool-call analytics: which tool was called, by which assistant, whether it worked and how long it took, plus a shortened copy of the call and its result. That copy can include part of the brief and of GrandpaCAD's reply.
• A record of each AI request made while building your model: what was sent to the AI model and what it returned.

We only get what the assistant sends in a tool call, not the rest of your conversation with it. What the assistant does with GrandpaCAD's replies is covered by its provider's privacy policy (OpenAI's for ChatGPT, Anthropic's for Claude).

Why we use it

• To build and change the models you ask for and keep them in your account (performance of a contract).
• To check that each request comes from you, through an assistant you allowed.
• To keep the connection working, limit abuse, find tools that fail or run slowly, and fix generations that go wrong (our legitimate interest in running and improving the Service).

Who receives it

• OpenRouter, and through it the AI model provider in use: the brief, the chat and attached images.
• Google's Gemini API: the description and reference images for a figurine or character, and datasheet searches.
• Modal, whose GPU servers run our own models: the images and 3D files for figurines and characters, and the motion you describe for an animation. Nothing is kept there.
• UploadThing: attached files and the model files GrandpaCAD makes.
• PostHog, in its EU cloud: the tool-call analytics and the AI request records.
• The assistant you connected: GrandpaCAD's replies, the model's size and parameters, and on paid plans a link to the model file.

How long we keep it

• Chats, attachments and models are kept as long as your account exists. Deleting a chat removes it from your account straight away.
• Access tokens expire after one hour and refresh tokens after 30 days. The record of a connection is kept until you disconnect the assistant.
• The live progress shown while a model is being built is deleted after 30 minutes.
• PostHog deletes the content of AI request records (what was sent and returned) after 30 days.
• PostHog keeps other analytics events for up to 7 years, or until you ask us to delete them.

Your controls

• Disconnect an assistant any time in Settings, under Connected apps. That deletes its tokens and permission straight away, and it can't reach your account again until you reconnect it. Models it already made stay in your account.
• You can also remove GrandpaCAD in the assistant's own settings.
• Delete any chat from your dashboard.
• To delete your account and everything in it, contact us through our contact page.

Your rights

Under EU data protection law you can ask us to: see the data we hold about you, correct it, delete it, limit how we use it, object to certain uses, and receive a copy of it in a portable form. Where we rely on your consent, you can withdraw it at any time. To use any of these rights, contact us through our contact page and we will help.

If you think we have mishandled your data, you can complain to the Slovenian Information Commissioner (Informacijski pooblaščenec, www.ip-rs.si), or to the data protection authority in your own EU country.

How long we keep your data

We keep your account and content data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must keep some records longer to meet legal or tax obligations (for example invoices).

Children

GrandpaCAD is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has given us their data, contact us and we will delete it.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically for any changes.

Contact Us

Company: OTIVIA 32, d.o.o., Čufarjeva ulica 15, 2250 Ptuj, Slovenia. Company reg. no.: 7402414000. VAT ID: SI64829723.

If you have any questions about this Privacy Policy, You can contact us:

• By email: vito@grandpacad.com
• By visiting this page on our website: https://grandpacad.com/contact
• By mail: OTIVIA 32, d.o.o., Čufarjeva ulica 15, 2250 Ptuj, Slovenia