Privacy at Ductly
Ductly builds software for sheet-metal shops: an AI that reads fitting drawings, and an ERP that runs quoting, orders, and invoicing. This page says what data we handle, where it goes, and what your choices are — in plain English, because that is how we write everything.
If you visit this website
- Company-level analytics. We use Apollo's website-visitor service to identify the company a visit likely comes from. It works off your browser's IP address — that is the signal — matched against Apollo's database of company IP ranges, and it is configured not to identify you personally. The script normally loads from Apollo directly; if a browser extension blocks that, our own server relays the same signal, including your IP address, to Apollo instead, so our count of visiting shops stays accurate. It stores identifiers in your browser's local storage, including a random anonymous ID; clearing this site's data in your browser removes them.
- Standard web logs. Our hosting provider sees the usual server logs (IP address, pages requested) to serve and protect the site. We keep web logs and site-analytics identifiers only as long as needed to run, secure and count visits to the site, then they are deleted.
- We run no advertising networks and we do not sell data.
If you email drawings to our trial inbox
- When you send drawings to quote@ductly.ai, we receive your email, its attachments, and your address. Our AI reads the drawings and emails you back what it read, usually in one message. If the trial inbox is at its daily limit when you write in, you get a short note first and the read follows automatically once the limit resets — and if it cannot get through within a few days, we say so instead of going quiet. We also notify ourselves internally that someone tried it.
- Drawings sometimes carry project details about other people — a job-site address, a name written on the page. By sending a drawing you confirm you are able to share it, and we use what is on it only to produce your read.
- Your drawings are processed on our US servers, with Anthropic as our AI provider (US). Under our agreement, Anthropic does not use our API data to train its models, and deletes it from its systems on its published retention schedule.
- We keep what you sent for up to twelve months after your last contact with us, or delete it sooner the moment you ask. Reply saying you want no more email — in any words — and every Ductly email to that address stops, including follow-up from our team.
If your shop is a Ductly customer
- Your shop's data — drawings, quotes, orders, invoices, customer records — is processed to run your ERP, and it is your data. We build each shop's data to be kept separate from every other shop's.
- The same processing applies: US servers, Anthropic for the AI reading, and email infrastructure for the messages your shop sends its own customers.
- Helping the reader get better — only if you switch it on. We want to use drawings and your estimators' corrections to improve how Ductly reads drawings for every shop. It is off unless you switch it on, you can switch it off at any time, it changes nothing about your account or what you pay, and switching it off stops any further use of your material. We never apply it to anything you sent before you switched it on.
- What never leaves your shop, whatever you switch on: your rate card, labour rates and hours, allowances, margins, quoted prices, order values, project names, and who your customers are. None of it is used, shown or reproduced in another shop's system, and none of it is pooled with another shop's data. Learning how to read a drawing is not the same as learning what you charge, and we only do the first. A correction that reflects the way your shop does things, rather than how drawings are drawn generally, stays in your own system. Before any drawing is used this way we strip the names, addresses, phone numbers, emails and signature or seal blocks off it.
- Anthropic does not train on your data at all under its commercial terms, and deletes what passes through on its published retention schedule.
- Work already built into the system stays in it — retraining to remove one shop's contribution is not something anyone can do reliably today, and we would rather say so than promise otherwise. We do not build the system to store or reproduce your drawings, and none of your commercial information goes into it.
- When an engagement ends, your shop's data stays available to export for 90 days, then we delete it from our active systems within 30 days after that — sooner if you ask.
If you're a shop's customer using their portal or a payment link
Some shops give their own customers a login to view quotes and invoices, or send a payment link. Exactly how that looks can differ from shop to shop, but the rules are the same everywhere: we process your login and the invoice details involved so the feature works, the data belongs to the shop you do business with, we build it to be kept isolated, and it is never sold. We do not see or store card or banking details. We keep that information for as long as the shop keeps it in their account; like their other customer records, it is erased when they ask.
Where processing happens
The processing described above runs on US-based services. While your information is there, it is subject to US law and could be accessed under that country's legal process — the same as for any Canadian company running on US cloud infrastructure. If that matters for your shop, ask us: ryan@ductly.ai.
Security
Everything moves over encrypted connections (HTTPS/TLS). Access is login-gated — your team's logins, your customers' portal logins, and our own admin console are three separate systems, and we build every shop's data to be kept isolated. Role-based staff permissions (what the owner sees vs. a team member) are set up during your onboarding. No system is perfect; if something ever affects your data we will tell you plainly.
Your rights
We are a Canadian company and follow PIPEDA. Ryan Cho, President, is our privacy officer and the person accountable for this policy — he reads every request himself, and you'll hear back within 30 days. You can ask what we hold about you, ask us to correct it, ask us to delete it, or withdraw consent, by emailing ryan@ductly.ai. Withdrawing consent may mean we can't keep providing whatever that consent was for — we'll tell you if so. If you are unsatisfied, you can complain to the Office of the Privacy Commissioner of Canada — priv.gc.ca, 1-800-282-1376.
If we've emailed you: in Canada our email follows Canada's Anti-Spam Legislation (CASL) — every unsubscribe is honoured within 10 business days, and CASL complaints go to the CRTC; in the US, opt-outs are honoured per CAN-SPAM.
If we reached out to you first using a business email or phone number we found — through Apollo, for example — that is business-contact information PIPEDA lets us use to talk shop. The rights above still apply, and a reply stops us.
Changes
Updates get posted here with a new effective date.