Privacy Notice.

1. Who is responsible

The controller under data protection law (the UK GDPR and, for people in the European Union, the EU GDPR) is D3, Suite 301, 116 Baker Street, London, England, W1U 6TS (Not applicable (sole trader), Not applicable), the maker of D3rive ("we"). Further company details are in the Imprint. For anything about your data, write to privacy (at) getd3rive.com.

This notice covers this website (getd3rive.com), your D3rive account and the licence service your installed application talks to. Your engineering models, projects and files stay on your own computer: this service never receives them.

2. What we collect

• Account: your name or company, what we should call you (only if you tell us; it greets you in our emails), email address, a one-way hash of your password, and whether you confirmed your email.
• Your profile: your role (asked at sign-up), and, only if you choose to give them, your company or university, the country your company is based in, industry, company size, your biggest challenges, the tools you use today and how you heard about us. Everything but the role is optional; the application asks once and you can skip it. You can change or clear these answers at any time on the Security & data page or in the application (Settings → Profile). Each change is kept in a history of your profile (which answer changed, from what to what, when, and whether it was made on the website, in the application or at sign-up), so we can see how the people who use D3rive change over time; the history is kept while your account exists and is deleted with it.
• Sign-up and sign-in details: the IP address, browser and operating system (user agent), preferred language and time zone at sign-up, and the IP address and browser of your latest sign-in.
• Activity on this site: sign-up, email confirmation, downloads (which file and version), upgrade requests, each with date, IP address, browser and the country derived from the IP address. Website download records link to your signed-in account; in-app update requests link to the licence and its owner. These server records support delivery, security, support and download statistics independently of optional Google Analytics, without additional tracking cookies.
• Your licences and installations: plan, status and renewal date; for each installation its name, application version, licence mode, whether it is a genuine signed release, the IP address of its licence checks, the number of named users and agents it reports, and the labels of those seats.
• Technical facts about the computer: Windows version and build number, processor model and number of cores, memory, total and free space on the drive holding the application data, screen resolution, display language and time zone. These describe the machine, not you.
• A machine fingerprint: a one-way code calculated on your computer from stable hardware identifiers. The identifiers themselves never leave your computer and the code cannot be turned back into them; it only lets us recognise the same machine again.
• A database identifier: a one-way code calculated from a random number stored in the application's own database. It contains nothing from your projects, no names and no paths; installations that work on the same database report the same code.
• What we never collect from your computer: your Windows user name, the computer's name, your name or company as set on the computer, file or folder names, project names and model content. Who you are comes only from your D3rive account.
• Usage of the application: how long the application runs per day, measured from its regular licence check-ins, the last time it checked in, aggregated feature counters (feature names and counts only), and a notice when the application is uninstalled. This never includes model content, project names or file paths.
• Monthly usage totals: for each person using an installation (identified by an internal number and their D3rive account name), how many operations, exports, solver runs, AI copilot turns and tokens and imports they used in the current calendar month, how many of the operations an AI agent made, and how many projects they have. Counts only: never what was done, project names or model content.
• Feedback you send: bug reports, ideas and feedback, with your name and email if you include them.
• Payments: our reseller Paddle handles payment (see section 5). We receive the subscription and customer reference, country, amounts, tax and invoice number, never your card or bank details.
• Your choices: which version of the Terms and of this notice you were shown and when, and whether you want product-update emails.

Business contact data about customer organisations. When we sell to or support an organisation, we keep a record of it (name, country, size, industry, website and our notes), of its business contacts (name, job title, work email and phone number, whether they decide on a purchase, and our notes), and of which D3rive users we have linked to it. We do this on the basis of our legitimate interest in business-to-business sales and support. The record is visible only to D3rive staff in our internal console; it is never shown on this site and never passed to anyone. We keep it while the business relationship lasts and delete it, or a single contact or link, on request. Deleting your account removes your link to an organisation.

3. Why, and on what legal basis

• To provide the service you signed up for (contract): your account, licences, activation, licence checks, downloads, payments and support.
• Security and preventing abuse (legitimate interest): IP addresses, browser details and the human check on sign-up protect accounts and stop scripted sign-ups and licence misuse.
• Enforcing the licence and protecting it from misuse (legitimate interest): the machine facts, the machine fingerprint, the database identifier and the places of licence checks and sign-ins let us notice modified or unsigned builds, copied installations, one account used on more machines than its seats, single-user licences sharing one database, sign-ins from places too far apart for the time between them, and repeated or shared Trials. These checks only raise a flag for a person at D3rive to look at; nothing is blocked automatically, and a person decides what, if anything, to do.
• Applying your plan's limits (contract): the monthly usage totals let us apply the allowances of the plan you have, on every installation of your licence, and show you and us how much of them is used. A total reported lower than one we already received is kept at the higher figure and raises a flag for a person at D3rive to look at.
• Understanding and improving the product (legitimate interest): sign-up, download, activation and usage statistics, country statistics, and feedback, so we can see where D3rive is used, fix problems and decide what to build. You can object at any time (section 8).
• Understanding who uses D3rive (legitimate interest): your profile answers, so we know which roles, industries and company sizes use the product and can shape it, and its documentation, for them. We look at them in aggregate and beside your account for support; they are never used for advertising or passed to anyone. You can object at any time (section 8), or simply clear them.
• Optional website analytics (consent): Google Analytics measures page visits, approximate location, browser and device information, referral sources, verified sign-ups and download clicks, only after you allow analytics. It receives a browser identifier, not your account identity. We do not send names, email addresses, form contents, account identifiers, or URL query strings and fragments. Downloads here mean clicks or starts, not proof that a file finished downloading.
• Product-update emails (consent): only if you ticked the box. You can switch them off on your Security & data page or with the link in each email.
• Quoting your feedback on our website (consent): only if you ticked the box allowing it in the app's feedback, we may quote what you wrote on getd3rive.com with your name and company. We record the exact wording you agreed to and when; you can withdraw at any time by writing to privacy (at) getd3rive.com, and we then remove the quote.
• Legal obligations: records we must keep, such as evidence of the Terms you accepted and payment records.

4. Cookies and similar technology

The following cookies are necessary for the site to work:

• d3_portal_session: keeps you signed in to your account (up to 30 days).
• d3_preview: only during the private preview, remembers the tester password (30 days).

The human check on the sign-up, password-reset and verification forms is Cloudflare Turnstile. It assesses your browser to tell people from scripts and does not set advertising or tracking cookies. Google Analytics loads only after you choose Accept. Choosing Essential only leaves it off and does not restrict access. Your choice is saved in this browser in local storage (d3_analytics_consent) for 180 days. Analytics uses _ga and _ga_* cookies, configured to expire after 180 days. Use Analytics preferences in the footer to change or withdraw your choice; withdrawal removes these cookies and reloads the page to stop tracking. We disable Google Signals and advertising personalisation. We do not load analytics on the private operator console or in the desktop application.

5. Who else processes your data

• OVHcloud hosts this service on a server in Canada. Both the UK and the European Commission recognise Canada as providing adequate protection for commercial organisations.
• Brevo sends our emails (confirmation, password reset, notices).
• ImprovMX forwards email sent to our @getd3rive.com addresses to our mailbox.
• Cloudflare runs the human check (Turnstile).
• Google provides optional Google Analytics after your consent. It processes analytics data on its infrastructure, which may include countries outside the UK and EEA, including the United States. See Google’s Privacy Policy and how Google uses information from sites that use its services.
• Paddle (Paddle.com Market Ltd) is the merchant of record for online purchases: it sells you the licence on our behalf and is responsible for the payment data it collects under its own privacy notice.

The country of an IP address, and for our support and security staff its approximate place (city and region), is looked up in a database stored on our own server (provided by DB-IP); no address is sent anywhere for that, and the place is shown when needed, not stored. We do not sell your data and do not use it for advertising.

6. How long we keep it

• Account and licence data, including your profile: while your account exists. Deleting your account removes it (section 8), with your profile's change history; clearing an answer on Security & data or in the application removes it from your profile at once, and the history keeps the earlier answer until your account is deleted.
• IP addresses and browser details: 12 months, then deleted.
• Machine facts, the machine fingerprint and the database identifier: while the installation is registered; they are replaced with each new report and deleted with the licence. Records of where and on which machine an installation was seen: 24 months, their IP addresses 12 months.
• Misuse flags: until a person has reviewed them, then for 24 months after the last evidence; deleted with the licence.
• Optional Google Analytics data: user-level and event-level retention follows the property’s data-retention setting; aggregated reports may remain longer. Withdrawing consent stops future collection and removes this browser’s analytics cookies; it does not erase reports already collected.
• Site activity and usage statistics: 24 months; after account deletion they remain only without any link to you. Aggregate download counts per file, containing no account, IP address or other personal identifier, may be kept longer.
• Feature counters from the application: 30 days.
• Monthly usage totals: as long as the licence exists, so allowances can be applied and disputes answered; they are deleted with the licence.
• Evidence of accepted Terms: until the end of the seventh calendar year after your account ends.
• Feedback: until it is resolved and deleted by us; after account deletion it remains without your name and email.

7. Where your data is

Our server is in Canada (adequate protection, see section 5); our email and forwarding providers may process data in the EU or the United States, under recognised safeguards: the UK and EU data privacy frameworks with the United States, the UK International Data Transfer Agreement, or the European Commission's standard contractual clauses.

8. Your rights

You can ask for a copy of your data, for corrections, for deletion, to restrict or object to processing (including the statistics in section 3), and for your data in a portable format. You can delete your account yourself on the Security & data page. Write to privacy (at) getd3rive.com for anything else; we answer within one month.

You may also complain to the data protection authority responsible for us (Information Commissioner's Office (ico.org.uk)), or to the data protection authority where you live or work.

9. Changes

When this notice changes, the version above changes and we tell registered users about significant changes by email.