Topdraw.

Privacy

Topdraw privacy policy.

Last updated: 02 July 2026

1. About this policy

This privacy policy explains how Topdraw collects, uses, stores, shares, retains, and protects personal data when you use the Topdraw website, account area, project directory, project workspaces, drawing register, project invitations, billing pages, invoice pages, receipt pages, and related services.

Topdraw is a project drawing management service. The service is used by Project Managers, Senders, Receivers, invited participants, staff users, and people who contact Topdraw through the public website.

2. Who controls your data

For the purposes of UK data protection law, Topdraw is the controller for the personal data it processes to operate the Topdraw service, manage accounts, process billing records, provide support, maintain security, and run the website.

If you are invited to a project by a Project Manager, that Project Manager may also decide who participates in the project and what access they have. Topdraw provides the software tools used to manage that access.

3. Personal data we collect

Topdraw may collect and process the following types of data:

  • name, first name, surname, company, email, and phone number;
  • account login details, password hashes, and session records;
  • customer number and account status;
  • project names, project references, project addresses, and role information;
  • project ownership, membership, and invitation records;
  • drawing names, revision numbers, uploaded file metadata, and access settings;
  • drawing view events, revision view events, timestamps, and viewed status;
  • billing contact details and payment method summaries;
  • Stripe customer, subscription, invoice, receipt, and payment references;
  • email delivery records for invitations, invoices, and receipts;
  • contact form messages, support messages, and privacy request messages;
  • privacy request type, request details, staff handling records, and acknowledgement records;
  • IP address, user agent, timestamps, staff audit events, security events, system logs, and operational records.

4. How we collect data

We collect personal data when:

  • you create an account;
  • you log in or use the account area;
  • you create, manage, or participate in a project;
  • you accept or receive a project invitation;
  • you upload, view, or manage drawings and revisions;
  • you manage a subscription, invoice, receipt, or payment method;
  • you contact Topdraw;
  • you submit a privacy request through Settings → Privacy & data;
  • staff users administer, support, review privacy requests, or secure the service;
  • our systems automatically record security, session, billing, privacy request, and audit events.

5. Why we use personal data

Topdraw uses personal data to:

  • create, manage, close, and reactivate accounts;
  • authenticate users and protect account access;
  • create and operate project workspaces;
  • manage Sender, Receiver, and Project Manager access;
  • send and track project invitations;
  • store, display, and control access to drawings and revisions;
  • record viewed status for drawings and revisions;
  • process subscriptions, payments, invoices, and receipts;
  • send operational emails, invitation emails, billing emails, and receipt emails;
  • provide support and respond to contact messages;
  • receive, review, record, and respond to privacy requests;
  • detect, investigate, and prevent misuse, fraud, security incidents, and unauthorised access;
  • meet legal, tax, accounting, audit, data protection, and compliance obligations;
  • maintain, test, debug, improve, and secure the service.

6. Legal bases for processing

Topdraw processes personal data under one or more lawful bases, depending on the context.

  • Contract: to provide the Topdraw service, manage accounts, provide project access, operate subscriptions, and deliver requested features.
  • Legitimate interests: to secure the service, prevent misuse, maintain audit records, provide support, improve reliability, and operate a business-to-business drawing management service.
  • Legal obligation: to keep records required for tax, accounting, company, legal, regulatory, dispute, or security purposes.
  • Consent: where Topdraw asks for consent for a specific optional purpose.

7. Project roles and access data

Project Managers control who is invited to their projects and whether a participant is a Sender, Receiver, or both.

Topdraw stores project membership records so users can access the correct active, completed-storage, retained, or still-existing projects. These records also allow project access to reappear if a closed account is later reactivated using the same verified email address.

8. Drawing and revision view data

Topdraw may record whether a user has viewed a drawing or revision and when that view occurred. This may include the project, drawing, revision, user, timestamp, and related audit information.

Viewed status is used for project coordination and access history. It is not intended to prove legal acceptance, technical approval, professional approval, construction approval, or regulatory compliance.

9. Billing, invoices, receipts, and Stripe data

Topdraw uses Stripe for payment processing. Topdraw may store Stripe customer IDs, subscription IDs, invoice IDs, payment intent IDs, balance transaction IDs, hosted invoice URLs, hosted receipt URLs, invoice PDF URLs, payment method summaries, subscription status, invoice status, paid amounts, fee information, and related billing event records.

Topdraw does not store full card numbers. Payment card processing is handled by Stripe.

Billing, invoice, receipt, payment, tax, accounting, audit, legal, and security records may be retained after an account is closed or after a project workspace has been deleted where required or permitted.

10. Email, message, and privacy request data

Topdraw may send account, project invitation, billing, invoice, receipt, security, and service emails. Topdraw may store delivery records for those emails, including recipient details, delivery status, provider message IDs, timestamps, and failure reasons.

If you contact Topdraw through the Contact Us page, Topdraw may store your name, email, message, acknowledgement status, and staff handling records.

If you submit a privacy request through Settings → Privacy & data, Topdraw may store the request type, request details, account details, customer number, email address, IP address, user agent, timestamps, staff handling records, acknowledgement records, and audit events.

11. Account closure and reactivation

Topdraw uses Close account rather than destructive account deletion. Closing an account disables access, revokes active sessions, clears password reset tokens, marks the account as closed, and minimises local profile data.

When an account is closed, Topdraw clears the local profile name, first name, surname, company, and phone number. Topdraw retains the email address, customer number, and internal account ID because the email address is the identity key for reactivation and the internal IDs are needed for project, billing, audit, security, and legal linkage.

Closing an account does not immediately delete project records, project memberships, project ownership links, billing records, invoice records, receipt records, payment records, audit records, security records, tax records, accounting records, dispute records, or legal records.

Billing address and payment details may remain in Stripe, invoices, receipts, payment records, accounting records, tax records, audit records, security records, dispute records, and legal records where required or permitted.

Closing an account is not the same as a deletion request under data protection law. Settings → Privacy & data explains what can be closed, what can be downloaded, what can be corrected, what is deleted automatically, and what may be retained.

If you sign up again with the same verified email address, Topdraw may reactivate your original account instead of creating a duplicate account. You may set a new password and update your name, company, and contact details during reactivation.

12. Privacy & data settings

Signed-in users can use Settings → Privacy & data to review account data, understand data categories, read retention information, access the Privacy Policy and Terms, download an Excel copy of linked user data, and check account closure eligibility.

Settings → Privacy & data explains that Close account clears local profile details such as name, first name, surname, company, phone number, password reset tokens, and active sessions, while retaining email address, customer number, internal account ID, and records needed for project, billing, audit, security, legal, tax, and accounting purposes.

Topdraw provides automatic account data summaries, automatic Excel export, account correction links, account closure checks, and deletion eligibility information through Settings → Privacy & data. Some privacy rights may still be limited where records must be retained for billing, invoice, receipt, payment, accounting, tax, audit, security, dispute, or legal reasons.

13. Project cancellation and 90-day retention

If a Project Manager cancels an active or completed-storage project subscription, the project normally remains available until the end of the current paid billing period.

After the paid period ends, the project may enter a retained or read-only state. Topdraw keeps the project workspace for 90 days after the subscription ends so the Project Manager can resume the subscription where available.

After the 90-day retention period, Topdraw may permanently delete the recoverable project workspace data, including drawings, revisions, uploaded files, invitations, and participant access.

Topdraw may retain limited internal billing, payment, accounting, tax, security, audit, legal, and compliance records where required or permitted.

14. How long we keep data

Topdraw keeps personal data only for as long as needed for the purposes described in this policy, including providing the service, maintaining project records, supporting reactivation, enforcing access controls, keeping security records, resolving disputes, and meeting legal, tax, accounting, and audit obligations.

When an account is closed, Topdraw minimises the local user profile by clearing local name, first name, surname, company, and phone number. Topdraw keeps the email address, customer number, internal account ID, closure status, and records needed for reactivation, project linkage, billing linkage, audit, security, legal, tax, and accounting purposes.

Project workspace data is handled according to the project lifecycle. Billing, invoice, receipt, payment, tax, accounting, audit, security, dispute, and legal records may be kept for longer where required or permitted.

15. Who we share data with

Topdraw may share personal data with:

  • other authorised users on the same project;
  • Project Managers who manage participant access;
  • staff users who administer, support, or secure the service;
  • Stripe for payment processing and billing services;
  • email delivery providers for service, invite, billing, and receipt emails;
  • hosting, database, storage, logging, monitoring, and security providers;
  • professional advisers, insurers, accountants, auditors, or legal advisers where necessary;
  • public authorities or regulators where required by law.

16. Security

Topdraw uses technical and organisational measures designed to protect personal data, including authentication, session controls, staff access controls, audit records, no-index and no-store controls for staff areas, and security monitoring.

No online service can guarantee absolute security. You are responsible for keeping your login details secure and for telling Topdraw if you believe your account or project access has been compromised.

17. International transfers

Some service providers used by Topdraw may process data outside the United Kingdom. Where this happens, Topdraw relies on appropriate safeguards or transfer mechanisms required by data protection law.

18. Your rights

Depending on the circumstances, you may have rights to request access to your personal data, correction of inaccurate data, deletion of personal data, restriction of processing, objection to processing, portability of data, and withdrawal of consent where processing is based on consent.

Signed-in users can use Settings → Privacy & data to view account data, download an Excel copy of linked user data, update account details, change password, check deletion eligibility, and access the Close account flow.

Closing an account automatically clears local profile details that are no longer needed, including local name, first name, surname, company, and phone number. It does not delete retained project, billing, invoice, receipt, payment, audit, security, legal, tax, accounting, or dispute records where those records are required or permitted.

These rights are not absolute. Topdraw may need to retain or continue processing certain records where required or permitted, including for legal, tax, accounting, audit, security, dispute, or compliance reasons.

19. How to contact Topdraw

Signed-in users can view and download their account data through Settings → Privacy & data. You can also contact Topdraw through the Contact Us page if you cannot access your account or need help with a privacy or data protection issue.

20. Complaints

You can contact Topdraw first so we can try to resolve your concern. You may also have the right to complain to the UK Information Commissioner's Office.

21. Changes to this policy

Topdraw may update this privacy policy from time to time. The updated policy will be shown on this page. If a change is material, Topdraw may provide additional notice through the website, account area, email, or another reasonable method.