1.Who we are
Pickbox is made by Opulentity LLC, an Arizona limited liability company, at 7552 East Wethersfield Road, Scottsdale, Arizona 85260 (“Opulentity”, “we”, “us”). You can reach us about anything in this policy at wadehunter@opulentity.com.
This policy covers Pickbox, meaning the Pickbox Companion app, the Pickbox plug-in for Civil 3D, the web console and our cloud API, and our website, pickboxcad.com. Pickbox is a product for businesses, and this policy is written for the firms and professionals who use it.
For personal data inside a firm’s content, such as names in a title block or a prompt, we act on the firm’s behalf as its processor and service provider under our Data Processing Addendum. For account, billing and website information, we decide how it is used, as this policy describes.
2.The short version
- Your drawing files stay on your computer. To do a task, Pickbox sends what it reads from them to an AI model provider, through our cloud API.
- Our cloud API records details about each model request, such as the model, timing, tokens and cost, for billing. It does not store what you asked or what the model replied.
- Content sharing is off by default. Your firm can turn it on, which sends conversation histories, drafting examples and project memory to us.
- There are no analytics or advertising cookies on our website, and we do not sell personal information or share it for advertising.
3.Account and billing information
When your firm signs up and you use Pickbox, we keep:
- Account details: your name, email address, firm name and role. You sign in with an email and password through Supabase Auth.
- Firm details: the plan, seats, billing email, content-sharing and retention choices, and any firm standards you set up with us.
- Workstation enrollment records: for each enrolled workstation, a label (“Civil 3D workstation”), a hashed device token, the data-sharing choices acknowledged at activation and when, and the last time it connected. We do not store the computer’s name or its IP address.
- Audit records of administrative and enrollment actions on your account.
- Billing records: Stripe processes payments, and we never receive or store your card number. We keep your Stripe customer and subscription IDs, your plan status, and records of usage and credit.
4.What Pickbox sends to do a task
This applies to every account, every time Pickbox does a task. Pickbox reads from your open drawing and the project files you point it to, and sends that context through our cloud API (the “gateway”) to an AI model provider. The context can include:
- your prompts and the conversation so far;
- data about selected or relevant drawing objects, such as layers, text and coordinates;
- screenshots (“snips”) and plot images;
- text and page images from PDFs;
- the results of the tools Pickbox runs in your drawing; and
- notes from your project memory, which can include file paths.
Pickbox sends what it reads, not your drawing files themselves.
AI model providers
The default models come from OpenAI. If you select a Claude model in the app, the request goes to Anthropic instead. We send OpenAI requests with storage turned off (store: false).
The providers process this content to produce a response, under their commercial API terms. Under those terms they do not use API content to train their models by default, and they may keep it for a limited time to monitor for abuse. See the OpenAI and Anthropic privacy policies.
What our gateway keeps
For each model request, the gateway records metadata: the model, the provider, the status, timing, token counts and cost, for billing. It does not store the contents of prompts or responses. Model-request metadata is deleted after 90 days. The billing and usage records built from it are kept as long as we need them for billing, tax and legal purposes. Our hosting logs record request IDs, routes and status codes, not request contents.
5.Basic diagnostics
On paid accounts, Pickbox sends basic diagnostics: allow-listed counters and timings, such as app start, a periodic heartbeat, the name of a tool that ran, its outcome, an error code, timings and the model used. Diagnostics never include free text, file paths or drawing content.
Diagnostics are deleted after your firm’s retention period, which is 90 days unless your firm changes it.
6.Content sharing
Content sharing is off by default for new accounts. A firm’s administrator can turn it on, and each workstation acknowledges it when it is activated. When content sharing is on, Pickbox may send us:
- Conversation and action histories: prompts, model requests and replies, tool inputs and results, and drawing evidence and images. Credentials and the model’s reasoning are filtered out before upload.
- Drafting examples and corrections: label text, styles, nearby geometry and coordinates.
- Project memory: project lessons, standing rules, earlier requests and replies, drawing paths and script source, synced so that your firm’s workstations share them.
Project memory syncs to our servers only when content sharing is on. Otherwise it stays on your computer.
We use shared content to support you, diagnose problems and improve Pickbox, including using reviewed examples to improve the AI models Pickbox uses.
Shared histories and examples are kept for your firm’s retention period: 90 days by default, adjustable from 7 to 365 days. Shared project memory is kept until your firm deletes it or closes its account. If your firm turns content sharing off, new content stops being sent, and content already shared is deleted on this schedule, or sooner if you ask.
7.What stays on your computer
Pickbox keeps these under your Windows user profile:
- the app itself;
- its sign-in token, encrypted with Windows DPAPI;
- conversation files and project memory;
- a queue of items waiting to upload;
- update downloads; and
- copies of the drawing taken before each scripted change, for undo and checkpoints.
We cannot access these files. Uninstalling Pickbox, or deleting these folders, removes them.
8.Our website and demo bookings
- Demo bookings are handled by Cal.com. A booking collects your name, firm, email and team size, and optionally your Civil 3D version and notes. We copy these into our list of leads.
- The contact form stores your name, firm, email, Civil 3D version, number of seats and message.
We use these to reply to you, arrange a demo and follow up about Pickbox.
Cookies. Our website uses no analytics and no advertising cookies. The console uses sign-in cookies only, to keep you signed in. Our hosting providers process standard technical information, such as IP addresses, to deliver and protect the site.
9.How we use information
We use the information described above to:
- provide Pickbox, including running tasks and keeping your firm’s settings in step;
- meter usage, bill you and collect taxes;
- secure Pickbox, by authenticating workstations, preventing fraud and abuse, and enforcing usage limits;
- support you and diagnose problems;
- improve Pickbox, using diagnostics, and shared content only when your firm has turned content sharing on;
- send you messages about your account, billing and changes to Pickbox or these policies, and respond to inquiries and demo requests; and
- comply with the law and enforce our Terms of Service.
We do not sell personal information, and we do not share it for targeted or cross-context behavioral advertising.
11.How long we keep information
| Information | Kept for |
|---|---|
| Account, firm and workstation records | While your account is open. We delete them when you ask us to close it, except the records below that we must keep. |
| Billing, usage and credit records | As long as we need them for billing, tax and legal purposes. |
| Model-request metadata | 90 days. |
| Basic diagnostics | Your firm’s retention period (90 days by default). |
| Shared histories and examples | Your firm’s retention period (90 days by default, adjustable from 7 to 365 days). |
| Shared project memory | Until your firm deletes it or closes its account. |
| Demo bookings and contact form entries | Until we no longer need them to follow up, or until you ask us to delete them. |
| Files on your computer | Until you delete them or uninstall Pickbox. |
12.Security
We protect information with these measures:
- HTTPS on every connection;
- row-level security on the database, with no direct access from browsers; all access goes through our authenticated API;
- device tokens stored only in hashed form, expiring after 90 days and revocable at any time;
- administrative access that is restricted and audited;
- signed updates: update manifests are RSA-signed and installers are code-signed by Opulentity; and
- encryption at rest, provided by our hosting providers.
No system is perfectly secure. If you find a security problem, please tell us at wadehunter@opulentity.com.
13.Your choices and rights
Firm controls. Your firm’s administrators decide whether content sharing is on and how long shared content and diagnostics are kept.
Access, correction and deletion. You can ask us for a copy of your personal information, or ask us to correct or delete it, by emailing wadehunter@opulentity.com. To delete an account, email us from the account’s address. We delete the account data, except records we must keep for billing, tax and legal reasons.
US state privacy rights. Depending on where you live, state laws such as California’s may give you the right to know what personal information we hold about you and how we use it, to get a copy, to correct it, to delete it and to opt out of its sale or sharing for targeted advertising. We do not sell or share personal information in that way. To make a request, email us. We will confirm your identity, usually by matching your account email, before we act on it. You can use an authorized agent, who must show us your permission. We will not treat you differently for using these rights. If we decline your request, you can appeal by replying to our decision.
If your request concerns personal data that we process for a firm under the DPA, we will pass it to that firm and help it respond.
14.Where information is processed
We and our subprocessors process information in the United States. If you use Pickbox from outside the United States, your information is transferred to and processed in the United States.
15.Children
Pickbox is a business product and is not for anyone under 18. We do not knowingly collect personal information from children. If we learn that we have, we will delete it.
16.Changes to this policy
We may update this policy. The version and effective date appear at the top of this page. If we make a material change, we will tell you by email or in the console before it takes effect.
Related documents
Questions about this document: wadehunter@opulentity.com, or Opulentity LLC, 7552 East Wethersfield Road, Scottsdale, Arizona 85260.