VerSketch

The approved legal text is provided in English.

Privacy Policy

Effective date: 2026-08-22

This Privacy Policy explains how Jittapol Prukpatarakul (จิตรพล พฤกษ์ภัทรกุล) (“VerSketch,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects personal data when you use versketch.xyz and related VerSketch services (the “Service”).

1. Data Controller

The controller responsible for the processing described in this Policy is:

  • Legal name: Jittapol Prukpatarakul (จิตรพล พฤกษ์ภัทรกุล)
  • Registration details: Operated by an individual resident in Thailand. Not registered as a separate juristic entity (company or partnership).
  • Address: 133 Moo 8, Ban Na Yao, Thung Samo Subdistrict, Khao Kho District, Phetchabun Province 67270, Thailand
  • Privacy contact: privacy@versketch.xyz
  • Data Protection Officer, if applicable: Not appointed. VerSketch has not appointed a Data Protection Officer; the current scale and nature of processing (an invite-only pre-launch beta) do not require one at this time.
  • EU representative, if applicable: Not applicable. VerSketch does not currently offer the Service to, or monitor the behaviour of, individuals located in the European Union, the European Economic Area, or the United Kingdom.

2. Scope

This Policy applies to the VerSketch website, editor, cloud project storage, AI-assisted conversion features, read-only sharing, billing integration, and support services.

AIVerID, Stripe, and other third-party services have their own privacy notices for processing they perform independently.

3. Personal Data We Process

3.1 AIVerID account and authentication data

VerSketch uses AIVerID OAuth for login. We do not create or store your AIVerID password.

Depending on the claims supplied by AIVerID, we may receive and process:

  • a stable AIVerID account identifier;
  • email address and email-verification status;
  • display name, given name, and family name;
  • profile image;
  • account creation or registration date;
  • optional AIVerID profile identifiers; and
  • OAuth access and refresh tokens required to maintain your authenticated session.

Authentication claims and tokens are stored in an encrypted, HTTP-only session cookie. The current session duration is up to seven days. Temporary OAuth state and PKCE data are used to complete sign-in and normally expire within ten minutes.

3.2 Projects and drawing data

When you save a project to the VerSketch cloud, we process information such as:

  • project name and thumbnail reference;
  • floor-plan and drawing specifications;
  • levels, geometry, rooms, classifications, furnishings, annotations, and user-entered text;
  • schema version, revision number, and mutation identifiers;
  • project creation and modification timestamps;
  • project history, snapshots, autosaves, handoff snapshots, and export-related snapshots; and
  • deletion status and project promotion or migration identifiers where applicable.

Current cloud history is generally capped to the latest 30 snapshots per project, with older history pruned as newer snapshots are created.

3.3 Data stored locally on your device

VerSketch can store projects, drafts, recovery copies, and preferences in your browser’s localStorage, sessionStorage, and IndexedDB. This may include:

  • full local project specifications;
  • local and cloud draft copies;
  • recent recovery or quarantine copies;
  • onboarding and interface preferences;
  • label-size and editor settings;
  • saved 3D views, camera positions, north orientation, and view names; and
  • DXF underlay names, parsed geometry, transforms, and import settings.

Local data remains on the device and browser profile where it was created unless you choose a feature that uploads or synchronizes it. We cannot normally access or restore local-only data.

Clearing browser storage, using private-browsing mode, resetting the browser, or losing the device may permanently remove local-only projects.

For professional-size local work, VerSketch mirrors project state into IndexedDB and automatically makes that atomic copy primary if localStorage reaches its quota. The application may request persistent browser storage and display aggregate usage and quota information reported by the browser. These operations remain on the device.

3.4 AI-assisted conversion data

VerSketch allows users to provide text, images, project context, or edit instructions for AI-assisted conversion into drawing specifications.

Conversion inputs are processed on VerSketch servers. When the active rail uses an external AI-model provider, VerSketch sends the necessary input to the current provider, Anthropic, PBC, for processing on servers located in the United States; the official current list of AI providers is available at https://versketch.xyz/subprocessors. When the active rail uses the built-in solver, no external model provider receives the input, but the input is still processed on VerSketch servers rather than staying in the browser. The interface identifies the rail that served each successful conversion.

What the provider receives is limited to what the conversion needs: the text you write, any image you supply, the portion of the project specification being edited, and the instructions our software adds to describe the required output format. It is used only to produce your requested result and to detect misuse. Under our agreement with the provider, your input is not used to train its models. The provider may retain input and output briefly for abuse detection, after which it is deleted; it does not become part of any model.

Because the provider processes this data in the United States, an input you send from another country is transferred internationally. We rely on the provider's contractual data-protection commitments, including standard contractual clauses where those apply, as the safeguard for that transfer. If you do not want your input processed outside your country, do not use AI-assisted conversion.

A data-processing agreement with our AI provider (Anthropic) is in place, incorporated automatically into Anthropic's Commercial Terms of Service, which we accepted when creating our API account.

Where an image workflow requires a temporary upload, the image may be held in private Supabase storage solely to provide that workflow. Temporary upload grants normally expire within two hours, and uploaded source images are scheduled for deletion within 24 hours.

When server-side AI processing is used, VerSketch may record operational metadata such as:

  • input type;
  • project identifier;
  • processing adapter, vendor, or model;
  • retry and validation status;
  • build success or failure;
  • token counts; and
  • estimated processing cost.

If we change or add an AI provider, we will update this Policy and our service-provider information before the change takes effect, and provide any additional notice or choice required by applicable law.

Do not upload personal data, confidential plans, biometric images, government identifiers, or sensitive information unless you have the legal right and a genuine need to do so.

3.5 Billing and subscription data

Payments are processed by Stripe. Stripe may collect payment-card and billing details under its own privacy policy.

VerSketch does not store complete card numbers or card security codes. We may receive and store:

  • Stripe customer and subscription identifiers;
  • subscription tier and status;
  • billing-period end date;
  • education eligibility or expiry information;
  • checkout price identifier; and
  • account identifier associated with the purchase.

We may provide Stripe with your email address and VerSketch account identifier to create and manage your customer record, checkout session, subscription, and billing portal.

3.6 Read-only sharing data

A project owner can create a read-only share link. Anyone who obtains a valid share link may access the shared project without signing in until the link expires or is revoked.

The shared response may include the project name and the drawing content required to render the shared plan, including geometry, room or space names, classifications, furnishings, annotations, and other visible plan content.

VerSketch does not intentionally expose the owner’s AIVerID identifier through the public share response.

To prevent abuse, VerSketch may temporarily process the requesting IP address and store an HMAC-derived IP hash in a short-lived rate-limit record. Current rate-limit hashes are designed to expire approximately 24 hours after the most recent request associated with the hash. We do not use these hashes for advertising or cross-site tracking.

3.7 Technical and support data

When you access the Service, Vercel and other infrastructure providers may process standard request information such as IP address, browser or device type, requested URL, timestamp, response status, and security-related logs.

If you contact support, we process the information you submit, including your contact details, project or account identifiers, diagnostic information, screenshots, and correspondence.

VerSketch does not currently use advertising trackers or sell personal data.

When privacy-first reliability telemetry is enabled, VerSketch records one operational session row for a browser tab and whether that session experienced a client crash. The row contains only a coarse route group (for example, editor or pricing), coarse device class (phone, tablet, or desktop), release identifier, timestamps, and crash category. It does not contain an AIVerID, project identifier, share token, exact URL, drawing content, error message, stack trace, raw IP address, or browser fingerprint.

The random per-tab identifier is kept in sessionStorage. Before storage in Supabase, it is transformed with a deployment-specific HMAC; the raw identifier is not stored server-side. A separately domain-separated, short-lived HMAC of the requesting IP is used only to rate-limit this public endpoint under the same retention controls as other public rate-limit buckets.

4. How We Use Personal Data

We use personal data to:

  • authenticate users and maintain secure sessions;
  • create, save, synchronize, recover, export, and share projects;
  • provide AI-assisted conversion requested by the user;
  • process subscriptions and provide billing management;
  • prevent fraud, abuse, unauthorized access, and excessive automated requests;
  • diagnose errors and protect the reliability of the Service;
  • respond to support, privacy, security, and legal requests;
  • comply with legal, accounting, and regulatory obligations; and
  • improve the Service using operational information that is reasonably necessary for that purpose.

We do not use project content to train a general-purpose AI model unless we first provide a separate, clear notice and obtain consent where required.

Depending on the activity and applicable law, including Thailand’s Personal Data Protection Act B.E. 2562 (“PDPA”) and the EU/UK General Data Protection Regulation (“GDPR”), we rely on:

  • Performance of a contract: to provide login, project storage, sharing, conversion, exports, subscriptions, and support requested by you.
  • Legitimate interests: to secure the Service, prevent fraud and abuse, maintain reliability, and understand operational failures, balanced against your rights.
  • Legal obligations: to maintain required tax, accounting, payment, security, and compliance records and respond to lawful requests.
  • Consent: where required for optional processing, sensitive data, non-essential storage technologies, or a future AI-provider workflow.
  • Establishment, exercise, or defence of legal claims: where reasonably necessary and permitted by law.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing already lawfully completed.

6. Cookies and Browser Storage

VerSketch currently uses:

  • an encrypted authentication-session cookie, normally lasting up to seven days;
  • a short-lived OAuth state cookie, normally lasting up to ten minutes;
  • a language-preference cookie, which may last up to one year; and
  • localStorage and IndexedDB for projects, drafts, recovery data, and editor preferences; and
  • sessionStorage for a random per-tab reliability-session identifier when telemetry is enabled.

Authentication and security cookies are necessary to provide the Service. Local project storage is used to provide the editing and recovery features selected by the user.

7. Service Providers and Disclosures

We may disclose limited data to:

  • AIVerID, for identity and OAuth authentication;
  • Vercel, for website and application hosting;
  • Supabase, for the database and private object storage, currently hosted in Tokyo, Japan (ap-northeast-1);
  • Stripe, for checkout, subscription, payment, and billing-portal services;
  • future AI-processing providers, only after the notices described in Section 3.4 have been completed;
  • professional advisers and auditors subject to confidentiality obligations; and
  • courts, regulators, law-enforcement authorities, or other parties where disclosure is legally required or necessary to protect legal rights and safety.

Our current service-provider list is available at https://versketch.xyz/subprocessors.

We do not sell personal data or share it for cross-context behavioural advertising.

8. International Transfers

The Supabase project used for VerSketch is hosted in Tokyo, Japan. Vercel, AIVerID, Stripe, support providers, and future approved providers may process data in other countries.

Where personal data is transferred outside Thailand, the EEA, the United Kingdom, or another jurisdiction that restricts international transfers, we will use an available lawful transfer mechanism and appropriate safeguards.

Current transfer mechanisms and safeguards: Vercel, Supabase, Stripe, and Anthropic each incorporate the 2021 EU Standard Contractual Clauses (and, where applicable, the UK International Data Transfer Addendum) into the standard agreements that apply to our accounts with them, without requiring separate execution. AIVerID's transfer safeguards are governed by AIVerID's own privacy policy.

9. Retention

We retain data only for as long as reasonably necessary for the purposes described in this Policy:

  • Local-only projects and preferences remain until you or the browser removes them.
  • Active cloud projects remain while your project or account is active.
  • Project deletion is initially recorded as a soft deletion. A verified privacy request may be required to complete permanent erasure from active systems.
  • Project snapshots are pruned as new history is created; current history is generally capped at 30 snapshots per project.
  • Temporary AI image uploads are scheduled for deletion within 24 hours, and upload grants normally expire within two hours.
  • Share records remain until revoked, expired, deleted with the project, or no longer required.
  • Share rate-limit IP hashes are designed to expire approximately 24 hours after the most recent request associated with the hash.
  • Privacy-first session/crash telemetry is retained for up to 90 days and then removed by the scheduled cleanup process.
  • Authentication sessions normally expire within seven days, OAuth state within ten minutes, and language preferences within one year.
  • Subscription and transaction records may be retained as required for accounting, fraud prevention, taxation, disputes, and legal compliance.
  • Support correspondence and security records are retained only as long as needed to resolve the matter and meet applicable obligations.

Deletion from backups and provider systems may take additional time, during which the data will remain protected and unavailable for ordinary use.

10. Your Rights

Subject to applicable law and exceptions, you may have the right to:

  • request access to your personal data;
  • receive information about how it is processed;
  • correct inaccurate or incomplete data;
  • request deletion or anonymisation;
  • restrict processing;
  • object to processing based on legitimate interests;
  • receive portable data in a structured, commonly used, machine-readable format;
  • withdraw consent;
  • object to or request review of a qualifying automated decision;
  • appoint an authorised representative; and
  • lodge a complaint with Thailand’s Personal Data Protection Committee, an EEA data-protection authority, or another competent regulator.

VerSketch does not currently make decisions that produce legal or similarly significant effects based solely on automated processing.

To exercise a right, contact privacy@versketch.xyz. We may need to verify your identity and authority before acting. We will respond within the period required by applicable law.

Some data may be retained where deletion would conflict with a legal obligation, the rights of another person, fraud prevention, security, or the establishment, exercise, or defence of legal claims.

11. Security

We use administrative, technical, and organisational safeguards designed to protect personal data, including encrypted authentication cookies, access controls, private storage, row-level database protections, signed upload URLs, rate limiting, and separation of public share data from account identifiers.

No online service can guarantee absolute security. You are responsible for keeping your device, AIVerID account, exported files, and share links secure.

If a personal-data breach creates a legally reportable risk, we will notify the competent authority and affected individuals as required by applicable law.

12. Children

The Service is not directed to anyone below 18, except where use is lawfully authorised by a parent, guardian, school, or other responsible organisation. We do not knowingly collect a child’s personal data without the authorisation required by applicable law.

13. Changes to This Policy

We may update this Policy when the Service, providers, or legal requirements change. We will publish the revised version with a new effective date and provide additional notice where a change materially affects your rights or introduces a materially different use of personal data.

14. Contact

For privacy questions or rights requests:

  • Email: privacy@versketch.xyz
  • Address: 133 Moo 8, Ban Na Yao, Thung Samo Subdistrict, Khao Kho District, Phetchabun Province 67270, Thailand
  • DPO, if applicable: Not appointed. VerSketch has not appointed a Data Protection Officer; the current scale and nature of processing (an invite-only pre-launch beta) do not require one at this time.
  • EU representative, if applicable: Not applicable. VerSketch does not currently offer the Service to, or monitor the behaviour of, individuals located in the European Union, the European Economic Area, or the United Kingdom.