Privacy Policy

1. Who handles your information

AI diagram agent at aidiagramagent.com is operated by Terence XU, an individual based in China ("we", "us" or "our"). We determine how personal information is processed for this service. Contact [email protected] for privacy questions or requests.

This policy covers our website, Agent workspace, account features and support communications. Other websites you choose to visit, including sign-in and payment providers, also have their own privacy notices. Those notices do not remove our responsibilities for the information we handle.

2. Information we collect

• Account information: your name, email, profile image, authentication records and settings. Google sign-in supplies the identity information needed to access your account, not your Google password.
• Your work: messages, uploaded images and supported documents, extracted text or page images, generated diagrams, revisions, saved versions and sharing settings. Files can contain information about you or other people.
• Personalization: brand palettes, project details, drawing preferences, saved memories and source references, and memory and history settings.
• Billing and usage: plan, subscription status, transaction references, credit grants, reservations, spending and refunds, and model usage needed to calculate charges. Payment details are collected through the payment provider's checkout; do not send full card numbers or security codes to us.
• Technical and support information: IP address or derived rate-limit identifiers, browser and request information, timestamps, errors, session identifiers and your support communications. Infrastructure providers may keep their own security and operational logs.

Provide only information needed for your diagram. Do not upload passwords, API secrets, payment-card details, state secrets, or sensitive personal information such as medical records, identity documents or children's personal information. An anonymized example is usually sufficient. You must have a lawful basis to submit another person's information.

3. Why we process it

We use information to authenticate accounts, accept materials, generate and revise diagrams, preserve versions, provide requested personalization, process subscriptions and credits, answer support requests, maintain security and meet applicable legal obligations.

Where a legal basis is required, core account and generation processing is necessary to provide the service you request; accounting and legally required disclosures rely on legal obligations; optional processing relies on consent where required. Where applicable law permits legitimate interests, these may support proportionate security, abuse prevention and service administration, subject to your rights. We do not use that ground to bypass consent required by Chinese law.

Refusing information essential to a feature may prevent that feature from working. You can decline optional personalization without losing the basic ability to create diagrams. We do not sell your conversations or use them to target advertising.

4. AI processing and service providers

To answer a request, relevant messages, selected files or extracts, diagrams and permitted context are sent to APIMart, our AI gateway, which routes requests to the configured OpenAI models. Generated drafts may be sent back as images for automated layout review. AI processing can therefore involve both your input and the generated result.

• APIMart and its model providers: AI inference and response delivery. See APIMart's privacy notice and service terms.
• Vercel: website hosting, requests and operational processing. See its privacy notice.
• Neon: database hosting for account records, conversations, saved diagram data, memory and billing records. See its privacy notice.
• Cloudflare R2: uploaded files, saved diagram content and temporary exports. Public website assets are stored separately from private user work. See Cloudflare's privacy policy.
• Resend: account verification, password-reset and other service emails. See its privacy policy.
• Google, if you select Google sign-in: authentication and account linking.
• SeeAPI: relevant prompts, conversation context, extracted source text and images are submitted for automated checks before AI processing. Generated text is checked before release, including in buffered streaming segments. Rendered diagrams are checked before saving generated versions and before creating sharing links. Image checks use temporary signed links to private storage; staging copies are deleted after the check, with scheduled cleanup if deletion fails. We keep decision metadata and task references in server logs, without raw prompts or signed image links. See its privacy policy.
• Waffo and the providers shown at checkout: payments, recurring billing, fraud checks and payment records when you make a purchase.

We do not train our own general-purpose AI models on your private conversations or files. APIMart states in its service terms that it does not use submitted data to train models. That is not a promise from us of zero retention across every upstream system. Provider logging, retention and processing follow the applicable service arrangements; contact us before submitting material that requires a specific retention or hosting commitment.

We have not obtained specific contractual commitments from SeeAPI about moderation-input retention periods, processing regions or use for model training. We therefore cannot promise zero retention, processing in a particular country, or exclusion from provider training. Do not submit material that requires those guarantees.

Operator or provider access is limited to purposes such as operating the service, investigating an issue you report, protecting security or complying with law. We may disclose necessary information in response to a valid legal requirement or to protect legal rights, subject to applicable safeguards.

5. Memory, projects and brand colors

When enabled, saved memory can retain drawing preferences and facts you explicitly state about your industry. History reference can retrieve relevant material from earlier conversations. These are separate controls in Memory settings. Switching them off stops the corresponding future use but does not itself erase stored conversations or memory entries.

You can inspect, correct and delete memories, manage palettes in Brand colors, and organize materials in Projects. Project-only memory limits reuse of that project's context; it does not remove the hosting or AI processing needed for requests inside the project.

Delete a memory and its source conversation if you want both removed. Deleting a source conversation also removes memories linked to that source in our application. Independently saved information or another conversation containing the same facts may need separate deletion. Disabling personalization cannot recall information already sent for a completed request.

6. Private work and sharing links

Account work is private by default. Creating a sharing link makes the selected saved version accessible to anyone who has that link. It does not publish your entire conversation or source attachments. Recipients may pass the link on or keep a copy of the result.

Revoking a share stops future access through our service. It cannot delete screenshots, downloads or copies held by recipients. A temporary export download expiring does not revoke a separate sharing link or delete the saved diagram.

7. Retention and deletion

• Guest work: guest access has a 24-hour window. Expired unclaimed work is scheduled for cleanup. Signing in and successfully claiming eligible work moves it into your account.
• Saved account work: conversations, files and versions are kept to support continued access until you delete them, delete your account or retention must otherwise end by law. Cancelling a subscription or not logging in does not by itself delete saved work. Storage limits may prevent new uploads.
• Memories and palettes: retained until deleted individually, through relevant source or project deletion, or with your account, subject to the scope described above.
• Temporary files: short-lived uploads and export copies expire according to their operational purpose. Scheduled cleanup removes expired objects; a cleanup delay differs from continued authorized access.
• Moderation reviews: we keep restricted operator records containing case references, the applicable rule version, processing dates and outcomes. Source content is not copied into that register. Closed register entries are eligible for deletion after 180 days and removed during the weekly maintenance review, unless a documented legal hold applies. Unresolved cases and legal holds are reviewed for continued necessity. Related support correspondence and hosting-provider logs have separate retention controls; deleting a register entry does not delete those copies.
• Billing, support and security records: kept as long as reasonably necessary to resolve requests, protect the service, establish or defend claims and meet applicable accounting or other legal retention duties.

Use the deletion controls for conversations, diagrams and projects, or account deletion. Application access is removed before queued storage cleanup necessarily finishes. Provider backups or legally retained records may take longer to remove; deletion is not instantaneous erasure from every system. Ask us for an explanation of any information we must retain.

8. International processing

The operator is based in China. Hosting, storage, email, payment and AI services may process information in other countries. Your content can therefore be processed outside your country of residence and outside mainland China, where protections may differ.

International processing remains subject to applicable transfer requirements. Where law requires a specific recipient notice, separate consent or another transfer safeguard, general acceptance of this policy does not replace that requirement. Contact [email protected] for information about recipients, processing locations, transfer arrangements or exercising rights against an overseas recipient. Do not assume a particular data-residency location or a certified transfer arrangement.

9. Your rights and requests

Depending on applicable law, you may request access or a copy, correction, deletion, restriction, portability where available, or an explanation of processing. You may withdraw consent for processing that relies on it and object where the law provides that right. Withdrawal does not make earlier lawful processing unlawful.

Use the account controls above or email [email protected] from your account address. Explain your request and identify the relevant content. We may request proportionate verification of ownership; do not send passwords or full identity documents unless a secure, necessary verification method has been agreed. We will respond within the period required by applicable law and explain any lawful refusal or extension.

You may complain to the competent data-protection or other supervisory authority or seek a judicial remedy. Contacting us first is welcome but is not a condition for exercising those rights.

10. Security and children

We use authenticated access, ownership checks, private file storage and time-limited file access where appropriate. No online service eliminates every security risk. Report suspected unauthorized access to [email protected]. We will address incidents and provide notifications where required by law.

The service is not directed to children under 14, and we do not knowingly collect their personal information. Contact us if you believe a child has supplied information so we can investigate and take appropriate protective steps. Older minors need a parent or guardian's involvement where required to use the service or purchase lawfully.

11. Changes to this policy

We update this notice when processing changes. The revision date identifies this version. Material changes will be brought to your attention through an appropriate service notice or email; further consent will be requested where required. An update does not retroactively authorize a new use of your information.

Read our Cookie Policy for browser storage and our Terms of Service for commercial terms.