Privacy Policy

Effective date: 1 September 2026 Controller: TATUI SAS, 229 rue du Faubourg Saint-Honoré, 75001 Paris, France — SIREN 984863746 ("copperly", "we", "us"). Contact for privacy matters: privacy@copperly.ai

This policy explains what personal data copperly collects when you use the service, why, on what legal basis, how long we keep it, who processes it, and what rights you have.

1. The short version

In plain words: We store your email, your designs and design conversations, and feedback you send. The service is free and we take no payments, so we hold no card, billing or payment data at all. We measure how the product is used, and you can switch that off in your account settings. We set no cookies. Our servers are in the United States. You can download everything we hold as JSON, and delete your account, from your account settings. Nothing you design is published until you publish it. If you do publish a project, its page can stay online after you delete your account — but without your name on it: your handle, email and account are erased and the author line becomes an anonymous credit.

2. What we collect, why, and for how long

2.1 Account identity

In plain words: Your email address and an account ID. You sign in with Google or GitHub, which tells us your verified email address — we never see a password.

• What: email address, a stable user identifier, the identifier of the Google or GitHub account you sign in with, and — if you set one — the display handle you choose for exports. You sign in with Google or GitHub; we have no passwords. From them we receive only your verified email address and that account identifier.
• Purpose: authentication; the identifier is the ownership key for everything you store with us.
• Lawful basis: contract (Art. 6(1)(b)).
• Retention: life of the account; removed on deletion (Section 6). Your handle is removed too, including from the pages of projects you published, whose author line becomes an anonymous credit (Section 2.5). A handle you have released stays reserved to you by a marker that holds no identity of its own, so nobody else can claim it and impersonate you.
• Processor: AWS. Google and GitHub act as independent controllers when you choose to sign in with them.

2.2 Your designs and design conversations

In plain words: Your designs and the conversations that produced them are kept as long as your account is open, and they are visible to you alone unless you publish the project (Section 2.5). To generate a design, what you type may be sent to third-party AI model providers under zero-retention terms — they process it to return a result and do not keep it or train on it. Technical diagnostic records are kept 90 days.

• What: your messages, the generated design and board snapshots, and technical pipeline metadata — keyed to your account.
• Purpose: providing the service and keeping your work available to you; diagnosing failures in generation.
• Lawful basis: contract (Art. 6(1)(b)) for providing the service and storing your designs; legitimate interest (Art. 6(1)(f)) for the diagnostic records.
• Retention: designs and conversations — life of the account. One exception: the design content of a project you published is retained after deletion under Section 2.5. Your conversation is never published and is never retained past deletion — publication does not reach it. Technical diagnostic records — 90 days, deleted automatically.
• Processor: AWS for storage; third-party AI model providers under zero-retention terms for generation.

Before you have an account. You can start a design without signing in. What you type and the design it produces are then stored the same way, under a random identifier your browser tab holds instead of an account ID. When you sign in or sign up from that tab, the design moves to your account and is kept as above. If you never do, the design is deleted automatically after 7 days (diagnostic records after 90), and nothing links it to you: we hold no account, email or name for it. [ADVISOR] confirm that contract (Art. 6(1)(b)) still covers building before an account exists.

Conversations contain whatever you type, so please keep out of them any sensitive personal data (health, political or religious views, and the other special categories in GDPR Art. 9) and anything confidential.

2.3 Feedback you submit

In plain words: When you report a problem, we keep your note and the attached conversation for a year so we can fix the issue. Whether we may email you back is a separate checkbox.

• What: your free-text note, an email-back consent flag, the attached conversation record, your account ID, timestamps.
• Purpose: triaging user-reported problems.
• Lawful basis: consent (Art. 6(1)(a)) — you actively submit the report; emailing you back requires the separate checkbox. Withdraw by asking us to delete the report (Section 6).
• Retention: 365 days, deleted automatically.
• Processor: AWS; GitHub (truncated note previews in a private triage issue).

2.4 Product analytics

In plain words: We measure how people move through the product — signed up, first design, exported — so we can see where it is failing them. These events carry no name, email, or message content. You can turn this off at any time in your account settings, and we stop.

• What: funnel events (signup, first prompt, first preview, iteration, export, walkthrough steps) with a per-conversation identifier and event properties (outcome, cost of the turn, product version, which starter chip you clicked). Events may be joined to your account identifier so your funnel is consistent across devices. No name, email address, or message content is ever sent.
• Purpose: measuring activation, conversion, and retention to find and fix where the product loses people.
• Lawful basis: legitimate interest (Art. 6(1)(f)) — we cannot improve a product we cannot measure, the data is limited to product events, it is never used for advertising, never enriched, never sold, and never combined with data from other sites. We have documented the balancing test and will provide a summary on request. You have an absolute right to object: the switch in your account settings stops all analytics for your account, browser-side and server-side, with no effect on your use of the service.
• Retention: 13 months, per CNIL guidance. [ADVISOR] confirm the setting has been applied in the Amplitude project.
• Processor: Amplitude, using its EU data-residency endpoint.

We set no analytics cookie and no persistent device identifier on your machine for this purpose (Section 3), and IP-based geolocation is disabled in our Amplitude configuration.

2.5 Projects you publish

In plain words: Nothing is published until you publish it. When you do, the project gets a public page carrying your handle — and that page can stay online after you delete your account, without your name: the author line becomes an anonymous credit. Your conversation is never on it. Search engines and AI crawlers are allowed to read it, because being found is what publishing is for.

• What: the project content listed exhaustively in ToS §5 — the name, title and description you wrote, the board images, the design source and compiled circuit, the fabrication package and firmware, the bill of materials and cost estimate, the build instructions, the licence, the part number, the publication date, the like and download counts — plus your author handle, the only personal data among them. Also, if you like or download another maker's project, one record that you did (your account identifier and the project, no IP address and no device data).
• Purpose: publishing the project as you asked, and keeping published pages reachable so that a board someone already holds does not lose its instructions.
• Lawful basis: contract (Art. 6(1)(b)) for publishing at your request and for the like and download records; legitimate interest (Art. 6(1)(f)) for keeping a published page online after your account is gone — the interest being the recipients who hold a board built from it and the integrity of a public archive, weighed against you by removing your identity from the page rather than the page itself.
• Retention: the like and download records you created — life of the account. The published project content — retained after your account is deleted, under the irrevocable licence in ToS §5 and for its stated purpose. Your handle is not: the author line becomes an anonymous credit. Deleting a project takes the page off the public web and erases the design behind it, but cannot recall copies already taken, and does not undo the open-hardware licence the recipients already hold. [ADVISOR] confirm this split under GDPR Art. 17 — the design, title, description and instructions treated as content rather than personal data and retained, the handle erased — and confirm that the notice shown before publication is clear enough to be relied on.
• Processor: AWS (storage and delivery of the page).

Third parties that read a published page. A published page is on the open web and we admit search-engine and answer-engine crawlers to it, including Googlebot, Bingbot, GPTBot, ClaudeBot and PerplexityBot. Our own promise not to train general-purpose AI models on your designs binds us and cannot bind them: a third party that reads a published page may use what it finds under the licence you published under and its own law, including to train an AI model, and we neither control nor are responsible for that. This includes your author handle, which is on the page. Nothing prevents it but not publishing; an unpublished project is served to nobody. [ADVISOR] confirm this disclosure is sufficient here, given the handle is personal data on a deliberately crawled page.

2.6 How you heard about us

In plain words: After you first sign in we ask how you heard about copperly, from a short list. Answering is optional — skip it and we only note that you skipped, so we don't ask again.

• What: the answer you picked (for example "YouTube" or "Friend or coworker"), or that you skipped; if you picked "Other", the few words you typed; the time you answered; your account ID.
• Purpose: knowing which channels bring people to copperly, counted across all answers.
• Lawful basis: consent (Art. 6(1)(a)) — the question is optional and skipping it changes nothing. Withdraw by asking us to delete the answer (Section 6).
• Retention: life of the account; erased with it.
• Processor: AWS.

2.7 Parts you asked to be told about

In plain words: When we can't build a board because we don't stock a part yet, you can ask us to tell you when we do. We keep the part, our explanation and your account ID until then, and email you at your account address.

• What: the parts we said we don't stock, the sentence we showed you, the conversation it happened in, the time you asked, your account ID.
• Purpose: telling you when the part is supported, and knowing which missing parts people are waiting on.
• Lawful basis: consent (Art. 6(1)(a)) — nothing is recorded unless you press the button. Withdraw by asking us to delete it (Section 6).
• Retention: life of the account; erased with it.
• Processor: AWS.

2.8 Your public page and its picture

In plain words: Every handle has a public page at copperly.ai/<handle>/ listing the projects you published. You can add a picture to it; anyone can see that picture, and you can change or remove it whenever you like.

• What: the picture you upload, cropped to a square and re-encoded by us (which strips any metadata it carried, such as location), stored under your account ID. The page itself shows only your handle, your picture and the projects you published — never your email address.
• Purpose: showing who made the projects on your page.
• Lawful basis: consent (Art. 6(1)(a)) — there is no picture unless you upload one. Withdraw by removing it from your page, which deletes it.
• Retention: until you remove or replace it, or delete your account.
• Processor: AWS.

2.9 While you wait for the alpha

In plain words: While copperly is invite-only, we keep what you tell us while you wait and use it to decide whom to let in.

• What: the board you want to make and our assessment of it; your optional sign-up answers; if you tell us where you share your work, information published on that public profile; the country you connect from; how and when you were let in; your account ID.
• Purpose: deciding whom to let in, and improving what copperly can build.
• Lawful basis: steps taken at your request before you use the service (Art. 6(1)(b)); consent for your optional answers (Art. 6(1)(a)), which you can withdraw (Section 6); our legitimate interest in choosing whom to invite, for information from a public profile you name and the country you connect from (Art. 6(1)(f)), which you can object to (Section 6). [ADVISOR] confirm these bases.
• Retention: life of the account; erased with it.
• Processor: AWS; third-party AI model providers under zero-retention terms.

2.10 Referral links

In plain words: You get a link to share; sign-ups through it move you up the waiting list. We show you how many joined, never who.

• What: your referral link, the link you signed up through, if any, and the number of sign-ups yours brought.
• Purpose: ordering the waiting list, and knowing which links bring people to copperly.
• Lawful basis: performance of the contract (Art. 6(1)(b)).
• Retention: life of the account; erased with it.
• Processor: AWS.

3. Cookies and browser storage

In plain words: We set one sign-in cookie and run no third-party trackers. Your browser also keeps a handful of values so the app works — your place in the sign-in flow, and a note that you have seen the walkthrough. None of them track you.

We set two cookies, both on our API domain and both strictly necessary for signing in: a session cookie that keeps you signed in for up to 30 days and is deleted when you sign out, and a ten-minute cookie that secures the sign-in redirect and is deleted as soon as the sign-in completes. Neither can be read by scripts on the page. No advertising, pixel, or tag-manager scripts are loaded. The webapp keeps a small number of values in your browser's local and session storage, all strictly necessary for the service to function: a note that this browser has signed in, the prompt you typed before signing in, your analytics preference, and a flag recording that the first-run walkthrough was dismissed. The temporary ones are removed as soon as they have been used.

Under ePrivacy these are strictly necessary and require no consent banner. During sign-in, Google's or GitHub's own sign-in page sets cookies on its own domain, under its own policy.

4. Where your data lives — international transfers

In plain words: Our servers are in the United States. If you are in Europe, that is an international transfer, covered by the standard contractual clauses in our agreement with AWS.

Server-side data (Sections 2.1–2.4) is hosted with AWS in Oregon, United States. Analytics data uses Amplitude's EU data-residency endpoint.

For users in the EU, UK, and Switzerland, transfers to the United States are made under the European Commission's Standard Contractual Clauses (Implementing Decision 2021/914, Module Two), incorporated in the AWS Data Processing Addendum, supplemented by the UK International Data Transfer Addendum and the Swiss addendum as applicable. AWS Inc. is also certified under the EU–US Data Privacy Framework. AWS encrypts data in transit and at rest and publishes its practice on government access requests. [ADVISOR] confirm the AWS DPA is countersigned and on file before publication.

5. Subprocessors

Google and GitHub are independent controllers, not our subprocessors, when you choose to sign in with them.

No fabrication partner receives your data. Ordering is manual: you download your files and order from a fabricator of your choice. No design data flows from us to any manufacturer.

We will update this list before adding a subprocessor.

6. Your rights

In plain words: You can download everything we hold about you as JSON, and delete your account, from your account settings. Deletion is immediate and cannot be undone; if a step of it fails, the retry is enforced within 30 days. Pages of projects you published can stay online — with your name taken off them.

You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time without affecting processing already carried out.

Export your data. Account settings → Export my data gives you an immediate JSON download of your account record and export handle, your conversations and designs, each design's published state, your feedback reports, your analytics preference, your answer to how you heard about us, the parts you asked to be told about, your profile picture, your activity record, your alpha access (Section 8), what you told us while waiting for it (Section 2.9) and your referral link (Section 2.10). That is everything we hold about you: there is no billing or payment record to include.

Delete your account. Account settings → Delete my account, then type delete account to confirm. There is no waiting period and no way back: when you confirm, your account is closed and your data — sign-in, conversations, designs, feedback reports, analytics preference, how you heard about us, the parts you asked to be told about, your profile picture — is erased immediately, and a confirmation email follows. Should a step of the erasure fail, we retry it, so erasure completes in all cases within 30 days. Export your data before you confirm: afterwards there is no account left to export from. Nothing is held back for accounting reasons — we take no payments, so there are no invoice records to keep.

What deletion does to a project you published. Publishing is not reversible as to copies already taken, and the open-hardware licence you granted at publication (ToS §5) runs to the world, is perpetual and is irrevocable — we could not undo it if we wanted to. So deletion works on the two things separately:

• Your identity goes. Your handle, your email, your account and every record keyed to you are erased, and the author line on each published page becomes an anonymous credit. We do not treat your erasure right as satisfied by anything less.
• The published project content may stay. The page, its copy, its images, the design source and the instructions can remain online for the purpose in Section 2.5 and under the licence in ToS §5. If you want a published page taken off the web as well, delete it from the project page before you delete your account, or email privacy@copperly.ai afterwards and we will withdraw it — either stops further public use, but cannot recall a copy already taken.

Nothing you did not publish survives: your conversations, your unpublished designs, your diagnostics, your feedback, your analytics preference, your answer to how you heard about us, the parts you asked to be told about and your profile picture are erased in every case.

Everything else — rectification, restriction, objection, or a complaint about how we handled a request: privacy@copperly.ai. We respond within one month (Art. 12(3)).

Complaints. You may lodge a complaint with the CNIL (www.cnil.fr), our lead supervisory authority, or with the data protection authority where you live.

7. Security

In plain words: Data is encrypted in transit and at rest, stored in private systems, and access is limited to what is needed to run the service and answer your requests.

Traffic is encrypted in transit (TLS) and data is encrypted at rest. Server-side stores are private and reached through scoped machine credentials, not shared logins. Passwords are handled entirely by our authentication provider — we never see them. Diagnostic records have no user-facing read path and are accessible only to authorised personnel, for diagnosis. We take no payments, so no card or bank data exists anywhere in our systems to be protected in the first place.

8. Operational logs

In plain words: Standard server logs, kept 30 days. They can contain your account ID next to an operation such as a refused rate limit, but never your email, messages, or passwords.

• What: application logs — account ID on rate-limit decisions, conversation IDs, generation outcomes, authentication failures. We log no email addresses, no message content, no tokens. We collect no web-server access logs. Your IP address is used only when you are not signed in — reading a public project page, or designing before you have an account — as the key of a rate-limit counter, which is deleted within a day; it is not logged and is linked to nothing else.
• Purpose: operating, debugging, and securing the service.
• Lawful basis: legitimate interest (Art. 6(1)(f)).
• Retention: 30 days, deleted automatically.
• Processor: AWS.

Activity record. Apart from the logs, we keep one record per key action — downloading a project's fabrication files, a firmware build queued for your board, uploading firmware to a board and the result of its boot self-test (including which part of the board failed) — with your account ID, the project and the time. It is how we answer "my board does not work" and find the parts of a design that fail on real boards. Legitimate interest (Art. 6(1)(f)); kept 90 days, deleted automatically, included in your data export and erased with your account. Processor: AWS.

Alpha access. While the alpha is invite-only, we record that your account was let in, and when, and email you once at that moment to say so. Your address is read from your account for that email and is not copied anywhere. Performance of the contract (Art. 6(1)(b)); kept for the life of the account, included in your data export and erased with your account. Processor: AWS.

9. Children

The service is not directed at children. You must be at least 18 years old to create an account.

10. Changes to this policy

We will update this policy when data flows change, and give notice by email or in-product notice before material changes take effect. The version and effective date appear at the top; previous versions are archived at www.copperly.ai/legal/archive.

Questions about privacy: privacy@copperly.ai