Legal

1. Who We Are and What This Covers

FabCommand, Inc. ("FabCommand", "we", "us") makes shop management software for steel fabricators. This Privacy Policy explains how we handle personal information when you visit fabcommand.com, sign up for or use the FabCommand Services, contact support, or book a demo.

Two roles. For our website, marketing, and the accounts and billing of our customers, FabCommand decides how personal information is used. Under laws like the GDPR, that makes us the "controller".

For the data a customer company puts into FabCommand, such as projects, drawings, and employees' names and time records ("Customer Data"), we act on that company's instructions. That makes us its "processor" or "service provider", and our Data Processing Addendum governs that data. If you use FabCommand through your employer and have a question about your data in it, please contact your employer first. We will help them respond.

2. Information We Collect

Information you give us

• Account information: name, email address, password (stored only as a one-way hash), company name, and optional profile details such as phone number, job title, and profile photo.
• Google sign-in: if you sign in with Google, we receive your name, email address, and profile picture. We request only the basic "openid email profile" permissions. We do not get access to your Gmail, Drive, or Calendar.
• Customer Data: anything your company enters or uploads. This includes project, drawing, model, and material data, and people's names, roles, and time and task records. Station accounts use a PIN, which we store only as a hash.
• Billing information: when your company subscribes, our third-party payment processor collects your card or bank details directly. We do not receive or store full card numbers. We keep records of your plan, Seats, invoices, and billing contact.
• Support requests: name, email address, company, phone number if you give it, the details of your request, and any files you attach.
• Demo bookings and messages: your name, email address, and chosen time. We use these to create a calendar invite and to reply to you.

Information collected automatically

• Log and device data: IP address, browser and device type, pages and features used, dates and times, and error information. This is recorded when you use the website or Services.
• Cookies and similar technologies: see Section 6.

We do not knowingly collect sensitive categories of information such as health or biometric data, and we ask customers not to upload it. We do not collect precise location data.

3. How We Use Information, and Our Legal Bases

Some privacy laws, including the GDPR and UK GDPR, require us to state the legal basis for each use.

We do not use personal information for decisions based solely on automated processing that have legal or similarly significant effects on you.

4. How We Share Information

• Service providers (subprocessors): companies that provide services to us in these categories: cloud hosting and database infrastructure, file storage, payment processing, transactional email delivery, business email and calendar, sign-in, and bot and spam protection. They are bound by written agreements and may use the data only to provide their services to us. Customers may request the current list of subprocessors by emailing contact@fabcommand.com.
• Within your company: your company's owners and administrators can see and manage the accounts and data in their company.
• Companies you share with: when a customer shares a project with another company, the shared data becomes visible to that company.
• Legal and safety: when required by law or valid legal process, or to protect the rights, property, or safety of FabCommand, our customers, or others.
• Business transfers: in a merger, acquisition, financing, or sale of assets, subject to this Policy's protections.
• With your direction or consent.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under California law. We have not done so in the past 12 months.

5. International Transfers

FabCommand is based in the United States, and our primary hosting is in the United States. If you use FabCommand from outside the U.S., your information will be transferred to, stored in, and processed in the U.S. and in other countries where our subprocessors operate.

For personal information from the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. These are included in our DPA and our agreements with subprocessors. We also use supplementary measures such as encryption in transit.

6. Cookies and Similar Technologies

You can change your choice at any time with the "Cookie settings" link in our website footer. We treat a Global Privacy Control signal from your browser as a request to turn analytics off. Our website does not respond to "Do Not Track" signals, because there is no common standard for them. Instead, analytics stays off unless you opt in, or where GPC is sent.

7. How Long We Keep Information

• Account information and Customer Data: for as long as the customer's account is active. After a subscription or trial ends, we keep it for 30 days so it can be exported or restored, then delete it. Backup copies are overwritten within 35 days after that.
• Support tickets: up to 3 years after the ticket is closed, so we can help with recurring issues. Deleted sooner on request.
• Billing records: as long as tax and accounting laws require, typically 7 years.
• Server logs: generally up to 90 days, unless needed longer to investigate a security issue.
• Terms acceptance records: for as long as the account exists and for a reasonable period afterward, as evidence of the agreement.

8. Security

We protect personal information with measures that include encryption in transit (HTTPS), encryption at rest provided by our cloud infrastructure, hashed passwords and PINs, separation of each company's data, role-based access, and limited staff access. No method of transmission or storage is completely secure. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.

9. Your Privacy Rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy of it, including in a portable format;
• correct inaccurate information;
• have your information deleted;
• object to or restrict certain processing, including processing based on legitimate interests and direct marketing;
• withdraw consent at any time, where we rely on consent. This does not affect processing already done; and
• not be treated differently for exercising these rights.

These rights come from laws including the EU and UK GDPR, the California Consumer Privacy Act (CCPA) and other U.S. state privacy laws, Canada's PIPEDA, Brazil's LGPD, and Australia's Privacy Act. We extend them to all users regardless of where they live, subject to legal exceptions.

How to make a request: email contact@fabcommand.com with the subject "Privacy request".

• We will verify your identity, usually by confirming your account email.
• We will respond within 30 days. If the law allows an extension, we will tell you.
• You may use an authorized agent, with proof that they are authorized.
• If we decline your request, you may appeal by replying to our decision. U.S. residents may also contact their state attorney general.

Complaints: if you are in the EEA, UK, or Switzerland, you may lodge a complaint with your local data protection authority. We would appreciate the chance to address your concern first.

Data in your employer's account: for Customer Data, we will pass your request to the customer company that controls it and help it respond.

10. Additional Information for California and Other U.S. States

In the past 12 months we have collected these categories of personal information:

• identifiers, such as name, email, and IP address;
• commercial information, such as plan and purchase history;
• internet or network activity;
• professional or employment-related information, such as job title and work records in Customer Data; and
• account login credentials, a category of sensitive personal information.

The sources, purposes, and recipients are described in Sections 2 through 4, and retention in Section 7. We use sensitive personal information only to provide the Services and keep accounts secure, as the law permits. We do not sell or share personal information, and we do not knowingly sell or share the personal information of anyone under 16.

11. Children

FabCommand is a business service and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

12. Changes to This Policy

We may update this Policy from time to time. We will post the new version here with a new effective date. If we make material changes, we will notify customers by email or in the Services before they take effect.

13. Contact Us