Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account Information: When you create an account, your email address is collected and managed by our authentication provider, Clerk. We do not collect or store passwords — authentication is handled via email-based one-time passcodes. On our servers, we only store your Clerk user identifier and organization tokens to associate your account with your data.
• Payment Information: When you subscribe to a paid plan, payment details (such as credit card number and billing address) are collected and processed by our payment processor, Stripe. We do not store your full payment card details on our servers.
• User Content: Wiring harness designs, projects, and other content you create and store within the Service.
• Communications: Information you provide when you contact us for support or otherwise communicate with us.
• Mailing List: If you subscribe on the changelog page, the email address you submit is collected. It is stored with our email provider, Resend, and is used only to send you the emails you subscribed to. Subscribing signs you up for our release notes. You will also get occasional product updates, unless you have already turned them off. The unsubscribe link on every one of them opens a preference page where you can turn either kind off on its own, or stop all of them. Subscribing does not create an account. If you have an account, your email address is also held by Resend as a contact, together with the first and last name and the account identifier we hold for you, so that we can send you occasional product updates. That happens whether or not you have ever used the subscribe form, and it does not put you on the release-notes list. Those emails carry the same unsubscribe link and preference page as any other.

1.2 Information Collected Automatically

• Usage Data: We collect information about how you interact with the Service, including pages visited, features used, actions taken, and the date and time of your activity.
• Device and Browser Data: IP address, browser type and version, operating system, device type, screen resolution, and language preferences. In the desktop application this also includes your operating system version, processor architecture, the installed application version, and the version of the underlying Electron and Chromium runtime.
• Update Checks: The desktop application contacts our update server shortly after it starts and every six hours while it is running, to check whether a newer version is available. That request tells the server your IP address, operating system, processor architecture, and installed version. It does not carry your account identifier or any project data.
• Error and Performance Data: Crash reports, error logs, and performance metrics collected through our error monitoring service (Sentry) to help us identify and fix issues. In the desktop application this also includes native crash reports (minidumps) generated by your operating system when the application closes unexpectedly. Where you are signed in, error reports from the desktop application are associated with your account identifier and email address so that we can follow up on a specific report. Our MCP server reports faults of its own — a misconfigured deployment, for instance — tagged with your account identifier alone; the requests a connected MCP client makes, and the project data they carry, are not part of those reports. We never capture screenshots of the application.
• MCP Usage Data: When you connect an MCP client and it calls one of our tools, we record that the call happened: the tool's name, whether it succeeded, whether a rate limit refused it, how long it took, and an identifier for the client application you authorized. We also record when a client starts a session, together with the name and version that client reports for itself. This is associated with your account identifier. We do not record the arguments of the call, the project data it read or wrote, or the text of any error it produced.

1.3 Information from Third-Party Services

Authentication is provided by Clerk. When you sign in, Clerk manages your email address, authentication tokens, and session data. We receive a user identifier and organization tokens from Clerk to link your account to your data within the Service. For details on how Clerk handles your information, see Clerk's Privacy Policy (opens in a new tab).

1.4 Information Processed by AI Features

Our AI features are optional, and none of them runs unless you start it. Excel import sends the contents of the workbook you upload to OpenAI, which reads it to build the harnesses, components and wiring in your project — so whatever that file happens to contain leaves our systems. In the parts library, the description lookup sends the manufacturer and part number you enter, and the image search sends those together with the category and runs a web search for that part number; both go through OpenRouter to Google and OpenAI models. Drawing import sends the photo of a hand-drawn sketch that you upload to OpenRouter, which passes it to a Google (Gemini) model that reads it to draw a rough draft on your sheet. We keep the photo only for that import: we delete it once the import succeeds, or, if the import fails, keep it so you can retry until you dismiss the failed import. Where you ask for a cleaned-up part image, the image itself goes through OpenRouter to a Google model, which returns the rendered version — whether you uploaded that image from your device, sent it from your phone, pasted its address, or accepted one the image search found. None of these features sends your wider project data, and we do not use your content to train any model.

The providers involved are listed in section 5 and on our Subprocessors page.

1.5 Information Shared with a Connected MCP Client

Wiring Studio can be connected to an MCP (Model Context Protocol) client — an AI assistant such as Claude Code — through our MCP server. This is optional and does nothing until you connect a client and authorize it against your account, and no project data leaves for a client you have not connected. Once connected, that client acts as you: it can read and change the projects, sheets, components, wiring, cables, labels and parts your account already has access to, and run design rule checks and reports over them. One of its tools renders a sheet as an image by opening the application in a headless browser on Cloudflare's network, signed in as you for the length of that render and signed out afterwards, and returns the image to the client that asked for it. That client is third-party software you choose and run: once data reaches it, what happens to it is governed by that tool's own terms rather than ours, and you can disconnect it at any time.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service, including storing your wiring harness designs and project data.
• Process payments and manage your subscription through Stripe.
• Send you transactional communications such as account confirmations, billing notices, and support responses.
• Send the release-notes and product-update emails to the addresses on those lists, until they unsubscribe.
• Analyze usage patterns to improve the Service's functionality, performance, and user experience.
• Monitor and fix errors and performance issues via Sentry.
• Run the AI features you choose to use — Excel import and the parts library's description lookup, image search and image generation — as described in section 1.4.
• Deliver updates to the desktop application and check whether the version you are running is current.
• Detect, prevent, and address fraud, abuse, and security issues.
• Comply with legal obligations and enforce our Terms of Service.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Contract: Processing necessary to perform our contract with you (e.g., providing the Service, processing payments).
• Legitimate Interests: Processing necessary for our legitimate interests, such as improving the Service, ensuring security, and preventing fraud, provided these interests are not overridden by your rights.
• Consent: Where you have given consent, such as for analytics tracking or subscribing to our release-notes and product-update emails. You may withdraw consent at any time — for the mailing list, by using the unsubscribe link in any of those emails.
• Legal Obligation: Processing necessary to comply with applicable laws and regulations.

4. Cookies and Tracking Technologies

We use cookies and similar tracking technologies through our third-party service providers. The Service itself does not set first-party tracking cookies beyond what is necessary for authentication and session management.

Third-Party Cookies

• Google Analytics: Used on our marketing website to understand traffic sources and visitor behavior. Google Analytics may set cookies to distinguish users and throttle request rates. See Google's Privacy Policy (opens in a new tab).
• PostHog: Used within the application, and on our MCP server, for product analytics to understand feature usage and improve the user experience. Our backend also records a completed subscription purchase (plan, billing interval, and which in-app upgrade prompt led to it) against your account. See PostHog's Privacy Policy (opens in a new tab).
• Clerk: Sets cookies for authentication and session management. See Clerk's Privacy Policy (opens in a new tab).
• Stripe: May set cookies as part of payment processing and fraud prevention. See Stripe's Privacy Policy (opens in a new tab).

The desktop application does not run in a web browser and does not use cookies. It holds the equivalent authentication, session, and product-analytics data in its own application storage, and Google Analytics is not used in it at all.

You can control cookies through your browser settings. Disabling cookies may affect the functionality of the Service. Our Cookie Notice sets out in more detail what is stored, what the consent banner controls, and how to change your choice.

5. Third-Party Services

We use the following third-party services that may receive or process your data:

• Clerk — Authentication, user identity management, and session handling. Clerk's own product telemetry is disabled in the desktop application.
• Stripe — Payment processing and subscription management. Checkout and plan management open in your own web browser, including from the desktop application.
• Convex — Cloud database for storing your account data and user-created content.
• Cloudflare — Website hosting, content delivery, security, and distribution of the desktop application and its updates. It stores the 3D model files you attach to parts in your library. It also hosts our MCP server, and its Browser Rendering service runs the headless browser that produces sheet images for a connected MCP client.
• Resend — Delivery of our release-notes and product-update emails. It holds the addresses we send those emails to, stored as contacts: the ones submitted through the subscribe form on our changelog page, and those of account holders, whose name and account identifier are held alongside the address. Every one of those emails carries an unsubscribe link that lets you turn either kind off on its own, or stop all of them.
• Google Analytics — Website traffic analytics (marketing website only; not used in either application).
• PostHog — Product analytics (web and desktop applications, and our MCP server). Session recording is not used in the desktop application, and the MCP server has no browser to record. What the MCP server sends is a record that a tool was called: which tool, whether it worked, and how long it took. Our backend also records a completed subscription purchase against your account: the plan, the billing interval, and which in-app upgrade prompt led to it.
• Sentry — Error monitoring and crash reporting. The web application, the desktop application and our MCP server each report to a Sentry project of their own.
• OpenAI — AI processing for the Excel import feature. The contents of a workbook you upload are read by an OpenAI model to identify the harnesses, components, wiring and pin assignments to create in your project.
• OpenRouter — Routes the parts library's AI features and drawing import to the underlying model providers, currently Google and OpenAI. It receives the manufacturer, part number and category of the part you are looking up, and, where you ask for a cleaned-up part image, the image you supplied or the one the search found. For drawing import it receives the photo of the hand-drawn sketch you upload, which goes on to a Google (Gemini) model.

These providers process your data in accordance with their own privacy policies and applicable data protection agreements. We do not sell, rent, or trade your personal information to any third parties.

The role and processing location of each provider is set out on our Subprocessors page, which is where changes to this list are published.

6. Data Storage and Security

6.1 On our servers

Your data is stored on cloud infrastructure provided by Convex and Cloudflare. We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL.
• Secure authentication and access controls for user accounts.
• Regular review of data collection, storage, and processing practices.

6.2 On your device

Both the web application and the desktop application keep a working copy of your projects, parts library, and interface preferences on the device you are using, so that your work opens without a round trip to our servers and survives a dropped connection. In the browser this uses local storage, IndexedDB, and origin-private file storage. The desktop application keeps the equivalent data, together with a cache of part images, in its own application data directory. Our Cookie Notice describes what is held there and how to remove it.

This is a copy of data that is already in your account rather than separate information we collect, and it stays on your device. Because it is stored there, protecting it is a shared responsibility: we recommend you use your operating system's disk encryption and screen lock. Uninstalling the desktop application does not by itself remove this directory.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with the Service. Specifically:

• Account data and user content are retained for the duration of your account. Upon account deletion, your data will be permanently deleted within 30 days, except where retention is required by law.
• Payment records are retained as required by applicable tax and accounting regulations.
• Analytics data is retained in accordance with the retention policies of our analytics providers.
• Error and performance logs are retained for up to 90 days.

8. International Data Transfers

WHY NOT SIA is based in Latvia (European Union). Your data may be transferred to and processed in countries outside the EEA where our third-party service providers operate, including the United States. When such transfers occur, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or the service provider's participation in recognized data protection frameworks.

9. Your Rights

9.1 Rights Under GDPR (EEA, UK, Switzerland)

If you are located in the EEA, the United Kingdom, or Switzerland, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete personal data.
• Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Restriction: Request restriction of processing of your personal data in certain circumstances.
• Data Portability: Request a copy of your data in a structured, machine-readable format.
• Objection: Object to processing of your personal data based on legitimate interests.
• Withdraw Consent: Where processing is based on consent, withdraw your consent at any time.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

9.2 Rights Under CCPA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: Request information about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out: We do not sell or share your personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

9.3 Exercising Your Rights

To exercise any of these rights, please contact us at support@wiring.studio. We will respond to your request within 30 days (or within the timeframe required by applicable law). We may ask you to verify your identity before processing your request.

10. Children's Privacy

The Service is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support@wiring.studio and we will take steps to delete such information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date shown on this page. If we make material changes, we will notify you by email or by posting a prominent notice on the Service prior to the change becoming effective. We encourage you to review this Privacy Policy periodically.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Company: WHY NOT SIA (registration number: 40103918314)
• Address: Dzelzavas 74/1 - 79, Riga, Latvia, LV-1082
• VAT Number: LV40103918314
• Email: support@wiring.studio