Replanar Data Processing Agreement

As of: November 3, 2026.

This agreement under Art. 28 GDPR is part of the Terms and Conditions for Replanar and is entered into with them. It applies between the customer as controller and Softmax AI GmbH, Kantstr. 6, 84032 Altdorf, Germany ("we"), as processor. The Terms apply to everything else; if they conflict on a data protection question, this agreement prevails. If the customer is not subject to the GDPR, this agreement is our contractual commitment for the processing on its behalf, and the references to the GDPR then describe the standard we apply.

1. Subject matter and duration

This agreement covers the processing of personal data contained in the customer's content: uploaded drawings, instructions and follow-up messages, and the results, intermediate states, previews, exports and suggested document titles generated from them. It applies for as long as we process such data for the customer.

We process account, usage and billing data as a controller in our own right; our Privacy Policy applies to that data.

2. Nature, purpose and data concerned

We store the content, use automation to convert drawings into CAD files, refine results on instruction, provide previews and downloads, and notify members by email of finished or failed conversions. Providing these services also includes fixing technical errors and preventing abuse.

• Types of data: names, addresses, contact details and signatures, and other information contained in drawings, title blocks or instructions.
• Data subjects: in particular building owners, plan authors, clients and other project participants, as well as the customer's employees.

Special categories of personal data under Art. 9 GDPR are not needed for Replanar and should not be uploaded.

3. Instructions

We process the data only on the customer's documented instructions, unless the law requires us to process it; in that case we tell the customer about the legal requirement before processing, unless the law prohibits this. The customer's instructions are the Terms, this agreement and the use of the app's features by the customer and its members. The customer gives further instructions in text form.

We do not use the data for our own purposes, in particular not to train AI models. We look at individual content only as far as needed for a customer request, to fix errors or to prevent abuse. If we consider an instruction unlawful, we inform the customer without delay.

We do not sell the data or share it for cross-context behavioral advertising. We do not retain, use or disclose it for any purpose other than those named in the Terms and this agreement or outside the direct business relationship with the customer, and we do not combine it with personal data from other sources, except as needed to provide the services. Where US data protection law applies to the processing, such as the California Consumer Privacy Act, we act as a "service provider" or "processor" within the meaning of that law. If we can no longer meet these commitments, we tell the customer, who may then take reasonable steps to stop unauthorized use.

4. Confidentiality and security

People with access to the data at our company are bound to confidentiality. We take the technical and organizational measures under Art. 32 GDPR described in the annex. We may develop them further as long as the level of protection does not fall.

5. Subprocessors

The customer approves the use of the following subprocessors:

• Hetzner Online GmbH, Gunzenhausen, Germany: hosting of the app, database, file storage and backups; processing in Germany.
• OpenRouter, Inc., USA: routing of conversion requests exclusively to OpenAI or Anthropic, without fallback routes; processing in the USA.
• OpenAI, USA, as a subprocessor of OpenRouter: automated processing of drawings and instructions; processing in the USA.
• Anthropic, PBC, USA, as a subprocessor of OpenRouter: automated processing of drawings and instructions; processing in the USA.
• Plus Five Five, Inc. (Resend), USA: sending of notifications with the conversation title; processing in the USA.

We bind each subprocessor by contract to data protection duties that match this agreement. Requests to OpenRouter are limited to providers that neither use transmitted data for training nor publish it. For processing outside the European Economic Area, we ensure appropriate safeguards under Art. 44 et seq. GDPR, in particular EU Standard Contractual Clauses.

If the customer is based in a third country without an adequacy decision, the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914), Module 4 (transfer from processor to controller), are deemed agreed for the transfer of the data to the customer, with us as data exporter and the customer as data importer; they are governed by German law, and the courts of Landshut, Germany, have jurisdiction.

We notify the customer in text form at least four weeks before any intended change of subprocessors. The customer may object in text form for a significant data protection reason. If we cannot offer a reasonable solution, either side may terminate the affected services effective when the change takes effect; we then refund the pro rata purchase price of purchased credits that have not been used.

6. Support for the customer

We support the customer with appropriate measures in meeting the rights of data subjects. The customer can view, download and delete content in the app itself. If data subjects contact us directly, we refer them to the customer.

We also support the customer with its duties under Art. 32 to 36 GDPR, in particular on security, on reporting personal data breaches and on data protection impact assessments, as far as the information available to us allows. We report a personal data breach affecting the customer's data to the customer without delay after becoming aware of it.

7. Deletion and return

The customer can download results at any time and delete conversations in the app; we then delete the associated files. We delete uploads that were not sent after 24 hours. We delete the intermediate states of a conversion, which we use to resume an interrupted conversion, seven days after it ends, even if the conversation was deleted earlier. When this agreement ends, in particular because the organization or the account is deleted, we delete the content unless the law requires us to keep it. Deleted data may remain in backups until it is overwritten in the limited backup cycle.

For retention at OpenRouter, OpenAI and Anthropic, Section 5 of the Privacy Policy applies.

8. Proof and audits

On request, we provide the customer with the information needed to show compliance with this agreement. The customer may carry out audits itself or through an auditor bound to confidentiality, with timely notice, during normal business hours and without disproportionate disruption of operations. Where possible, proof is provided through documents and information, and for subprocessors through their certifications and reports.

9. Liability

Art. 82 GDPR governs liability where applicable. Otherwise, the liability rules of the Terms apply.

Annex: Technical and organizational measures

Hosting and physical access. The app, database, file storage and backups are located in Hetzner Online GmbH data centers in Germany, the file storage in Nuremberg. Hetzner ensures physical access control and protection of the data centers.

System access. The database and queue can be reached only from within the server environment, not from the internet. Only designated staff have administrative access to servers, database and file storage.

Access in the app. Signing in requires a confirmed email address and a password of at least eight characters; passwords are stored only as hashes. Sessions end at the latest seven days after the last use. Sign-in attempts are limited. In the app, every access to content is checked against membership of the organization; administrator rights are limited to the organization's administrators. Downloads use signed links that expire after five minutes.

Staff access. For the purposes named in Section 3, authorized staff view content through an internal admin interface. It can be reached only over a VPN, requires a separate sign-in with a personal account whose sessions end after twelve hours without use, and does not allow changes. Every opening of content and every file retrieval there is logged with the person, the time and the content concerned.

Separation. Content is stored logically separated by organization, in the database and in file storage.

Transmission. Connections to the app, file storage, OpenRouter and Resend are encrypted with TLS.

Data minimization. Requests to OpenRouter, OpenAI and Anthropic contain no names, email addresses, file names, document titles, or account or payment data of the customer. OpenRouter may route requests only to OpenAI or Anthropic, and only to providers that neither use transmitted data for training nor publish it.

Availability. Servers and the database are backed up several times a day.

Deletion. Deleted conversations, organizations and accounts are deleted including the associated files; uploads that were not sent after 24 hours, and intermediate states of conversions seven days after they end.

Traceability. Every conversion is logged with the member, time and usage; administrators see their organization's usage.