This Privacy Policy explains how Ironclad Thor Industries LLC, doing business as IronCAD ("IronCAD," "we," "us"), collects, uses, and shares personal data when you visit ironcad.tech, create an account, or use the IronCAD application and related services (the "Service"). Our mailing address is PO Box 307, Linthicum Heights, MD 21090, United States. Contact: contact@ironcladthor.com.
1. Information We Collect
Information you provide. Account details (name, email address, password), organization name if you provide one, billing details, and any content you upload to or create in the Service ("User Content"), plus communications you send us (support requests, feedback).
Payment information. Payments are processed by Stripe, our payment processor. Your full card number is provided directly to Stripe and is not stored on our systems; we receive limited billing information such as card brand, last four digits, expiration status, and transaction outcomes. Stripe's handling of your data is described in Stripe's own privacy policy.
Information collected automatically. When you use the Service we collect log and device data (IP address, browser type, operating system, pages viewed, timestamps, referring URLs) and product usage data (features used, session activity, error reports). We use cookies and similar technologies for sign-in, session management, security, preferences, and basic analytics. You can control cookies through your browser settings; disabling essential cookies may break sign-in.
We collect only what we need. We limit collection of personal data to what is reasonably necessary to provide and maintain the Service you request, consistent with the data-minimization standard of the Maryland Online Data Privacy Act (MODPA), Md. Code Ann., Com. Law § 14-4601 et seq.
2. How We Use Information
We use personal data to: provide, operate, secure, and maintain the Service; create and administer your account; process subscriptions and payments; send transactional messages (receipts, renewal reminders required by law, security alerts, service announcements); respond to support requests; monitor performance, debug, and improve the Service; enforce our Terms of Service and protect against fraud, abuse, and security threats; and comply with legal obligations. If we send marketing email, each message will include an unsubscribe mechanism, and opting out will not affect transactional messages.
3. What We Do Not Do
- We do not sell your personal data, and we do not process or share it for targeted advertising.
- We do not collect or process sensitive data (such as health, biometric, or precise geolocation data) as part of the Service, and we do not sell sensitive data.
- We do not use your User Content for any purpose other than operating, securing, backing up, and improving the Service for you, except with your consent or as required by law.
4. How We Share Information
We share personal data only with: service providers (processors) that help us run the Service — payment processing (Stripe), application hosting (Render), content delivery and network security (Cloudflare), database and authentication (Supabase), and email delivery (Google Workspace) — each bound to use the data only to provide services to us; professional advisors (lawyers, accountants) where reasonably necessary; authorities when required by law, subpoena, or to protect rights, safety, or the integrity of the Service; and a successor entity in connection with a merger, acquisition, or sale of assets, in which case this Policy will continue to apply to previously collected data unless you are notified otherwise.
5. SMS and Text Messaging
IronCAD sends one-time passcodes by SMS to users who enable two-factor authentication and who provide their own mobile number. A passcode is sent only when that user starts a sign-in or a security-sensitive account action.
We do not share or sell mobile information to third parties or affiliates for marketing or promotional purposes. Mobile opt-in data and consent are never shared with third parties for those purposes. Phone numbers are disclosed only to the messaging carrier and to our messaging provider (Twilio), for the sole purpose of delivering the message you asked for.
Message frequency: one message per sign-in or security-sensitive account action. Message and data rates may apply. Reply STOP to any message to opt out, or HELP for help. Opting out of SMS does not close your account; verification codes fall back to email.
SMS consent is given per user inside the IronCAD application and is never entered on a user's behalf by an agency administrator. Consent is not a condition of any purchase.
6. Data Retention
We retain personal data for as long as your account is active and as needed to provide the Service. After account termination, User Content is available for export for thirty (30) days and is thereafter deleted in the ordinary course of our backup cycles. We retain billing and transaction records as required for tax, accounting, and legal purposes, and we may retain limited data as needed to resolve disputes, enforce agreements, and comply with law. When personal data is no longer needed for these purposes, we delete or de-identify it.
7. Security
We use reasonable administrative, technical, and physical safeguards appropriate to the nature of the data, including encryption in transit, access controls, and segregated payment processing through Stripe. No system is perfectly secure; if we learn of a breach of security affecting your personal information, we will notify you as required by the Maryland Personal Information Protection Act, Md. Code Ann., Com. Law § 14-3501 et seq., and other applicable law.
8. Your Privacy Rights
Depending on where you live, you may have the right to: confirm whether we process your personal data and access it; correct inaccuracies; delete personal data provided by or obtained about you; obtain a portable copy; and opt out of targeted advertising, sale of personal data, or certain profiling (we do none of those three). Maryland residents have these rights under MODPA. To exercise any right, email contact@ironcladthor.com with the subject line "Privacy Request." We will authenticate your request, respond within the time required by law (generally 45 days, extendable once), and will not discriminate against you for exercising your rights. If we decline a request, you may appeal by replying to our decision; if the appeal is denied, Maryland residents may contact the Maryland Attorney General's Consumer Protection Division.
9. Children
The Service is a professional tool, is not directed to children, and may not be used by anyone under 18. We do not knowingly collect personal data from children under 13; if you believe a child has provided us personal data, contact us and we will delete it.
10. International Users
The Service is operated from the United States. If you use the Service from outside the U.S., you understand your data will be processed in the U.S., where privacy laws may differ from those of your jurisdiction.
11. Changes to This Policy
We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, provide notice by email or in-product message before the change takes effect.
12. Contact Us
Ironclad Thor Industries LLC d/b/a IronCAD — PO Box 307, Linthicum Heights, MD 21090 — contact@ironcladthor.com.