Privacy Policy

Who is responsible

Howard TechWorks controls account, licensing, subscription and support information for its service. For content uploaded on behalf of a customer organization, that organization ordinarily controls the purposes and Howard TechWorks processes hosted content on its instructions. A self-hosted operator controls its local installation; its own privacy notice applies to that operation. Contact support@howard-techworks.com with the subject Privacy Request.

Information and purposes

We use name, email, organization, account roles and authentication records to create accounts, secure access and support customers. Passwords are stored as hashes. Optional profile fields are not required for subscription acceptance.

Customer content can include photographs, video and audio, documents, annotations, EXIF timestamps and GPS coordinates, models, orthomosaics, flight logs, device serials, operational telemetry and live streams. We process it to perform the storage, viewing, mapping, inspection, sharing and controller features requested by the customer.

Licensing uses installation identifiers, license state and validation records. Managed hosting also uses deployment status, storage usage and management logs. Free-plan abuse prevention records normalized email, source IP and a user-agent hash; these are not anonymous identifiers.

Stripe processes card and payment information. We retain customer/subscription identifiers, invoice and payment status, and purchase details; DDC checkout does not collect card numbers. We retain terms acceptance, policy snapshots, timestamps, plan and renewal disclosures to evidence the agreement. Acceptance records do not add keystroke logs, advertising identifiers, a date of birth or a copy of a drawn signature.

Security and operational records may include account IDs, IP addresses, browser information, audit events, resource access and errors. Collection must be limited to operating, protecting and diagnosing the service. Support messages are processed to answer the request. Business contact names, business email addresses, company names, campaign delivery records and unsubscribe status may also be processed for DDC business-to-business marketing outreach. Unsubscribe and suppression records are retained as needed to honor opt-out requests and prevent future marketing sends.

Tracking and external requests

The supplied DDC website and app do not include advertising pixels, session replay, or a keystroke-recording service. Keyboard events used for shortcuts and form editing are not sent as a typing history. Google Fonts are not requested by the supplied pages. Optional maps, geocoding, imagery, identity, AI, email and streaming integrations can contact their configured providers when their features are used. Their requests may reveal IP addresses and feature-specific data. Hosting/CDN security services also process requests. See Cookies and Local Storage and Service Providers. Operators must separately assess any scripts or services they add.

Legal bases and choice

Where GDPR or UK GDPR applies, account and subscription processing is needed to perform the contract; fraud prevention and proportionate security rely on legitimate interests; accounting and legally required records rely on legal obligations. Customer-content processing follows the customer’s instructions and its lawful basis. Consent is used for optional processing when required, and may be withdrawn without affecting earlier lawful processing. Acknowledging this notice is not blanket consent to every use of personal data. We do not sell personal data or share it for cross-context behavioral advertising in the supplied service, and do not use customer content for general AI-model training without a separate agreement.

Sharing and transfers

We disclose information to service providers needed to operate the selected service, authorized members of your organization, recipients you choose through sharing, and authorities when legally required. A corporate transaction may involve protected transfer of service records with appropriate notice. Services may process data in the United States or other countries used by the selected providers. International transfers require an applicable legal mechanism; we do not claim that every deployment is EU-only or certified. Request the applicable processing agreement and transfer information before uploading data with such requirements.

Retention

Retention depends on the purpose and deployment. Active customer content is retained while the customer uses it, subject to the customer’s instructions and applicable holds. Deleting content may leave protected backup copies until those backups rotate. Billing and agreement evidence may be kept for legal, accounting and dispute obligations after cancellation. We do not promise immediate deletion from every backup. Contact support for a deployment-specific retention schedule, export or deletion request. See Data Processing and Retention.

Your rights

Depending on applicable law, you may request access, a copy, correction, deletion, portability, restriction, or objection; withdraw optional consent; or appeal a decision. Contact support@howard-techworks.com. We verify identity using proportionate information and will not ask for your password. Organization users may need to contact their organization’s administrator. We respond within applicable deadlines and explain any lawful exception. You may complain to your privacy regulator. We do not penalize users for exercising applicable rights. Global Privacy Control does not enable tracking: the supplied service has no advertising sale/sharing to opt into.

Children and sensitive information

DDC accounts are restricted to adults. The service is not directed to children under 13. If we learn we collected personal information directly from a child under 13 contrary to this policy, we will restrict the account and address deletion or other legally required steps; report concerns to support. An age checkbox is not parental consent. Do not upload health records, biometric identification templates or other specially regulated data without a separate review and agreement. Passkeys use device/platform authentication; DDC stores public-key credentials, not your fingerprint or face scan.

Updates

We publish a version and effective date for this notice, retain the policy snapshot associated with acceptance, and provide material-change notices when required.