Facility Design Matrix ("FDM", "we") operates 3D facility design tools at facilitydesignmatrix.com and partner-branded designers such as kodiak-sports.facilitydesignmatrix.com. This policy explains what data we collect, why, where it goes, and the rights you have over it - including how to permanently delete everything.
What we collect
Account data you give us: name, email, phone, company, mailing address, and country. Your work: saved facility designs, uploaded logos, and design thumbnails. Quotes: when you request a quote, a snapshot of your cart, totals, and contact details is created and shared with the equipment partner whose designer you are using (for example Kodiak Sports) so they can respond. Support: tickets and replies you submit. Security logs: an audit trail of account actions that may include IP address and browser type. We use browser storage to keep you signed in. Diagnostics & analytics: we use Sentry to capture application errors and PostHog to measure how our pages and designers are used (pages visited, features clicked). Both run under our instructions as processors, session recording is off, and we use no third-party advertising trackers.
How we use it
To run the designer and save your work, to prepare and deliver quotes you request, to answer support tickets, to bill subscriptions, and to secure the platform. We do not sell your personal information.
Who processes it
Your data is processed by a small set of infrastructure providers acting on our instructions: Supabase (database, authentication, and file storage), Vercel (website hosting), SendGrid(transactional email), Sentry (error monitoring),PostHog (product analytics), and Paddle (payment processing - Paddle is the merchant of record for subscriptions and never shares your full payment details with us). Quote requests are additionally shared with the sporting-goods partner named on the designer you used.
How long we keep it
Account data lives as long as your account does. Quote and billing records are retained for tax and business-record obligations - but if you delete your account these records are pseudonymized: every personal detail is stripped and only totals, dates, and status remain. Security logs have identifying details (IP address, browser) scrubbed when your account is deleted.
Deleting your account - our commitment
You can permanently delete your account and data yourself: sign in, open Account → Profile → Danger zone → Delete my account. The moment you confirm, your account is deactivated everywhere and you receive an email with a deletion reference number.
United States accounts: your data is held, inaccessible, for a 30-day grace window (so an accidental or fraudulent request can be reversed - just reply to the confirmation email), then permanently and automatically destroyed. This meets and beats the CCPA/CPRA 45-day requirement.
EU / UK accounts: within 24 hours you receive a complete report of every piece of personal data we hold about you (GDPR Article 15), and within 48 hours your data is permanently erased - a month faster than GDPR's Article 17 deadline. The report itself is destroyed with your data.
Either way, deletion ends with a certificate email listing exactly what was destroyed, what minimal business records were retained and under which legal basis (GDPR Art. 17(3)(b) / CCPA §1798.105(d)), and the status of third-party systems. Deletion covers your profile, designs, thumbnails, logos, quote PDFs, support tickets, team memberships, sessions, and security-log identifiers - verified by an automated zero-residue check across every table and storage bucket.
Your other rights
You may access and correct your profile at any time from the Account portal. EU/UK users additionally hold the GDPR rights to restriction, objection, and portability (the deletion report doubles as a portable JSON export). California residents hold the CCPA rights to know, delete, and non-discrimination. To exercise any right, or if you cannot sign in, email design@facilitydesignmatrix.com from your account email and we will action it on the same timelines above.
Security
Data is encrypted in transit (TLS) and at rest, access is role-gated with row-level security, admin actions are audit-logged, and secrets are held in a managed vault. No system is perfect; if a breach ever affects your personal data we will notify you and the relevant authorities within the legally required windows.
Children
Our services are for businesses and adults; we do not knowingly collect data from children under 16. If you believe a child has created an account, contact us and we will delete it immediately.
Changes & contact
We will update this page and its effective date when our practices change; material changes are announced by email. Data controller: Facility Design Matrix, LLC. Contact: design@facilitydesignmatrix.com.