In short
- Subduxion B.V. in Eindhoven is responsible for data from website visits, forms and accounts. For drawings and other data in a Workspace we are the processor and the Customer is responsible.
- On forms we ask for your name, work email and company, and whatever you add yourself, such as a message. For an account also your role and how you sign in.
- The Website sets no analytics or marketing cookies and loads no third-party scripts. What the Website keeps in your browser is set out in the Cookie statement.
- Blake is in early access and runs on an environment that Subduxion manages itself. Forms on the Website are processed on our hosting provider's servers, including outside the EU.
- You can access, correct or erase your data, and object. Email privacy@useblake.ai; you can also complain to the Dutch Data Protection Authority.
Who we are#
We are Subduxion B.V., High Tech Campus 5, 5656 AE Eindhoven, the Netherlands. We make Blake, a workspace for CNC manufacturing shops.
For the personal data this statement describes, we are the controller within the meaning of the General Data Protection Regulation (GDPR). For any privacy question and for requests about your rights, email privacy@useblake.ai.
Definitions#
In this statement the following terms mean:
- Website: useblake.ai, including all its pages and forms;
- Customer: the company that has an agreement with Subduxion for the use of Blake;
- Workspace: one Customer's environment in Blake, with its own Users, requests, drawings, calculations and quotes;
- User: a person who works in a Workspace on behalf of a Customer;
- Customer Data: everything a Customer and its Users put into a Workspace or have prepared there, such as requests, drawings (PDF), 3D models (STEP), calculations and quotes.
When this statement applies#
This statement applies when you visit the Website, fill in a form on the Website, email us or use an account in a Workspace.
It does not apply to Customer Data. The Customer is responsible for that data and the Customer's own privacy notice applies; see the article on data in a Workspace.
Data in a Workspace#
For Customer Data the Customer is the controller and we are the processor. We process it only on the Customer's instructions and under the arrangements in the quote or agreement with that Customer.
In a Workspace, requests come in as forwarded email or upload. Blake reads drawings and 3D models into a proposal of the drawing's requirements and prepares a calculation with the cost price per operation. The Customer's own people check, correct and confirm it.
The Customer owns its drawings, models, requests and workshop data and keeps all rights. We use them only to provide Blake to that Customer. To every Customer we commit:
We do not use your drawings, 3D models or workshop data to train AI models, unless you give separate written consent.
If you work in a Workspace as a User and have a question about Customer Data, or want to exercise your rights over it, contact the Customer. If your request reaches us, we pass it on and help the Customer handle it. How the optional drawing reader handles drawings is set out on the Your drawings and AI page.
What data we collect#
We collect only the data you give us yourself and the technical data needed to provide and secure the Website and Blake.
| Situation | Data |
|---|---|
| You visit the Website | Technical data every website needs to deliver and secure its pages, such as your IP address, browser type and the page requested. For the language suggestion, the Website derives from your IP address which country you are in; only the country code goes back to your browser, and the Website does not store it. Cookies and browser storage are covered in the article on them below. |
| You fill in the contact or demo form | First and last name, work email, company and country, your role and what you want to see, and, if you add them, your phone number, your LinkedIn profile, your message and what you tell us about your shop, such as team size, locations and systems. |
| You join the waitlist | Work email and, if you add them, your first name and company. |
| You sign up for product updates | Your work email. |
| You send a form | On sending, a bot check (Cloudflare Turnstile) verifies that the request comes from a person. For that, Cloudflare processes your IP address and technical characteristics of your browser; we receive only the result. |
| You use an account in a Workspace | Name, email address, the Customer you work for, your role (owner, admin, member or read-only) and your sign-in data. |
| You email us | Your name, email address and what you write to us. |
| Security and error tracking | Sign-in events, IP address, timestamps and error reports. We remove personal data from error reports where possible. |
| Billing only for paid self-serve plans | Company name, billing address and invoice details. |
Purposes, legal bases and retention#
We use your data only for the purposes in this table, each with a legal basis under Article 6(1) GDPR and a retention period.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering your question and planning a demo | The data from the contact or demo form | Legitimate interest (f): answering business enquiries and showing Blake | 12 months after the last contact |
| Waitlist and early access to Blake | Work email, first name, company | Legitimate interest (f): arranging early access | 12 months after the last contact |
| Sending product updates | Work email | Consent (a) | Until you unsubscribe or withdraw your consent |
| Providing your account and Blake | Name, email address, Customer, role, sign-in data | Performance of the contract (b); for Users working on behalf of a Customer: legitimate interest (f) in performing the contract with that Customer | As long as the Workspace exists; after the agreement ends, the period in the article on retention applies |
| Answering questions by email | Name, email address, content of your message | Legitimate interest (f), or performance of the contract if you are a User | 12 months after the last contact |
| Providing and securing the Website and Blake, tracking errors | IP address, browser type, sign-in events, timestamps, error reports | Legitimate interest (f): a secure, working service | up to 30 days |
| Issuing and keeping invoices only for paid self-serve plans | Company name, billing address, invoice details | Legal obligation (c) | 7 years, the Dutch statutory tax retention period (Article 52 of the General State Taxes Act) |
Where we rely on legitimate interest, we have weighed that interest against your privacy. You can always object; see the article on your rights.
Who receives your data#
Your data goes only to the providers we need to deliver the Website and Blake. They process it on our behalf.
| Recipient | Purpose | Location |
|---|---|---|
| Hosting provider | Delivering the Website and processing the forms | Global network; forms also on servers outside the EU |
| Email service | Sending the emails of the forms on the Website. The email service receives name, email address and the content of the email. | EU |
| Bot check on the forms (Cloudflare) | Verifying that a form is sent by a person: IP address and technical characteristics of the browser | Worldwide; US company |
| Payment service (only for paid plans) | Invoicing and payment: billing data only, never Customer Data | EU |
During early access, accounts and workspace data are kept in an environment that Subduxion manages itself. Which providers process data from a Workspace, now and for the online service, is on the Subprocessors page.
Other parties receive your data only when a legal obligation requires us to share it.
Transfers outside the EU#
Some data can reach countries outside the EU, because some of our providers are American.
- The Website is delivered through our hosting provider's global network; forms are processed on that provider's servers, including outside the EU.
- The emails of the forms on the Website are sent through our email service in the EU.
- The bot check on the forms (Cloudflare Turnstile) is provided by a US company and may process your IP address and browser characteristics outside the EU.
- If a Customer turns on the optional drawing reader, image crops of at most 2 MiB go to a compute provider in the EU; that provider's administration and logs are in the US. By default the drawing reader is off until an owner or admin turns it on.
How long we keep data#
We keep data no longer than needed for the purpose we received it for; the period per purpose is in the table of purposes, legal bases and retention.
- After an agreement ends, the Customer can export its data. We then delete the Workspace, including its Users' account data. The periods for this are in the quote or agreement with the Customer.
- Data we must keep by law, such as invoices, we keep for as long as the law requires.
Security#
We protect your data with measures that fit what Blake processes.
- Traffic to the Website runs over TLS.
- During early access, Blake runs on an environment that Subduxion manages itself; its storage is encrypted.
- Access is scoped per organisation, and within a Workspace roles set what each person may do: owner, admin, member or read-only.
How we secure Blake is set out on the Security page. Report a vulnerability to security@useblake.ai or through /.well-known/security.txt on the Website.
If a personal data breach affects your data, we report it to the Dutch Data Protection Authority and to you, as the GDPR requires.
Automated decisions#
We take no decisions about you based solely on automated processing that have legal effects or similarly significant effects on you.
In Blake the software prepares proposals and calculations; the Customer's own people check, correct and confirm them. Your people decide: the Customer decides on prices and quotes and stays responsible for them.
Your rights#
Under the GDPR you have the following rights over the personal data we process as controller:
- access: you may know which data we hold about you and what we do with it;
- rectification: you may have incorrect data corrected or completed;
- erasure: you may ask us to delete your data, unless we must keep it by law;
- restriction: you may ask us to restrict the use of your data for a time;
- portability: you may receive the data you gave us in a common file format, or have it sent on;
- objection: you may object to use based on legitimate interest;
- withdrawing consent: you may withdraw consent at any time, without making earlier use unlawful.
Email your request to privacy@useblake.ai. We may ask you to confirm who you are, so your data does not end up with someone else. We respond within one month; if a request is complex, it can take two more months and we tell you so within the first month. A request is free of charge.
If your request is about Customer Data, contact the Customer; see the article on data in a Workspace.
Complaint to the Dutch Data Protection Authority#
If you disagree with how we handle your data, you can file a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), the Dutch supervisory authority.
We would like to hear it first ourselves at privacy@useblake.ai, so we can put it right, but that is not a condition.
Changes#
We update this statement when our processing changes. The top of the page shows when the text was last updated; what changed is on the Changes page.
Contact#
For privacy and requests about your rights, email privacy@useblake.ai.
- Security reports and vulnerabilities: security@useblake.ai;
- All other questions: info@subduxion.com;
- Post: Subduxion B.V., High Tech Campus 5, 5656 AE Eindhoven, the Netherlands.