Privacy Policy
This notice describes how Decret processes personal data in its capacity as controller and, where applicable, as processor.
Contents
1. Controller
Decret (the Service) is operated by Sorenor, LLC, a Delaware limited liability company (Delaware file number 10762175), which is the controller of the personal data described in this notice, except where it acts as a processor for a business customer (clause 2). In this notice, Decret and we mean Sorenor, LLC. Mailing address: 2810 N Church St STE 90277, Wilmington, DE 19802, United States. Website: https://decret.ai. Privacy correspondence: hello@decret.ai.
This notice is issued under the EU GDPR, which applies where Decret offers the Service to persons in the EEA, including Romania, and under the UK GDPR and the Data Protection Act 2018 where it offers the Service to persons in the United Kingdom. Cookies are addressed under the ePrivacy rules of the visitor’s country (PECR in the United Kingdom). Decret has not appointed a Data Protection Officer. Requests shall be sent to the address above.
2. Roles
Decret processes personal data in the following capacities:
- As controller: accounts; the website; demonstration and access-request forms; support correspondence; security logs retained for Decret’s own operations; and any marketing undertaken on a lawful basis.
- As processor: Customer Data in the workspace, including uploaded drawings and files, extracted text, project metadata entered by the Customer, generated drafts and exports, workspace activity records, and any personal data those files contain (including names on a drawing title block or a labour return). The business customer is the controller, or an independent controller, of that data. The Data Processing Agreement applies.
A data subject whose personal data appears only in a customer’s project files should address the relevant customer in the first instance. Decret shall assist that customer under the Data Processing Agreement and does not, as processor, determine erasure of the customer’s files of its own motion.
3. Scope
This notice applies to decret.ai, the workspace, related application programming interfaces, and emails sent from our domains (including noreply@decret.ai for verification and password reset). It does not apply to third-party websites linked from the Service.
The processing described in this notice is carried out now, with two conditions: push notifications are sent only where they are enabled on the Service and you turn them on for a device, and analytics runs only while Decret has it switched on and you accept it (clause 6).
4. Categories of personal data
4.1 Account and identity
Email address; display name; password (stored as an Argon2id hash); optional company name and logo; plan and role; email-verification status; and timestamps. Decret does not store payment card numbers. Card payments are taken through Stripe: card numbers are entered on Stripe-hosted pages and are handled by Stripe, not by Decret. For each order Decret keeps what was bought, the amount and currency, and the exchange rate and its date where lei were charged. For an invoice under the reverse-charge mechanism it keeps the company’s VAT identification number, the name and address VIES returns for it, and when VIES confirmed it.
4.2 Session and security
HttpOnly session cookie; hashed session identifiers; last-active time; idle and absolute expiry. Authentication events (including login, register, reset, verify, password change, logout, and idle expiry) with Internet Protocol address and user identifier. Those logs do not contain passwords, tokens, or email addresses. Rate-limiting uses Internet Protocol addresses (including the Cloudflare connecting address where present). Verification and reset tokens are stored as hashes.
4.3 Website and access
The public site is open. A first-party cookie records whether you accept or refuse analytics (decret_consent), and another records the language you read the site in (decret_locale). Demonstration and access-request forms store name, email, organisation, role, optional note, and related fields submitted by the requester. Inbound mail to addresses such as hello@decret.ai is routed to Decret for handling.
4.4 Workspace (processor)
Project name, location, work types, employer and contractor names, jurisdiction, language, and other metadata entered by the Customer; uploaded files (including PDF, office documents, and images, subject to type and size limits); a cryptographic hash of uploads used for duplicate detection; extracted text where extraction succeeds; generated documents and exports; workspace activity messages; template download records; a demonstration credit ledger (not a live payment); logos uploaded for document covers; and the names, email addresses and roles of the people a Customer invites to a project. Questions put to the project assistant and its answers are kept with the project.
A project created on the free 14-day test is deleted, with its files, when the test period ends, unless the account has moved to a paid plan by then.
4.5 Site diary
Dictation in the site diary uses your browser's own speech recognition (for example Google's in Chrome or Apple's in Safari, which may process the audio on their own servers under their terms); Decret receives only the resulting text, never the audio. Diary photos keep the time and position the camera recorded, when the file carries them. When a project chooses automatic weather, the site's coordinates are sent to the Norwegian Meteorological Institute (MET Norway, api.met.no) to add a forecast to a diary page. Manual weather sends nothing to a weather provider. To find those coordinates once, OpenStreetMap Nominatim receives only a locality with its county or country: one a person enters or confirms in the site's location settings, or, for a site in Romania, a locality named in the project's location that Romania's official register of localities lists, with its county. It never receives the project's location text, a street or a house number, and Decret refuses a locality that is the name of the project's client, contractor or contacts. Coordinates a person types are not looked up.
4.6 Project email address (processor)
A project may receive email at its own address. For each message Decret stores the sender’s address and name, the recipient address, the subject, the body, the attachments, and the time of receipt. Messages from the project’s members and from senders the Customer has approved are added to the project. Messages from any other sender wait for a decision by the project owner and are deleted, with their attachments, thirty (30) days after receipt if they have not been accepted. Mail to these addresses reaches Decret through Cloudflare Email Routing.
4.7 Notifications
Notifications are shown in the workspace and, according to each person’s choices, sent by email. Where push notifications are enabled and you turn them on for a device, Decret stores, for that device, the push address and keys your browser provides, a short device label (for example “Chrome, Android”, never the full browser identification string), and delivery times and failures. Push messages are delivered through the push service operated by your browser’s vendor (for example Google, Mozilla, or Apple). The record is removed when you turn push off, sign out on that device, or the browser withdraws the subscription, and after repeated failed deliveries. Your notification choices are stored with your account.
4.8 Outside parties invited by link (processor)
A Customer may ask a person outside its account (for example a designer, supplier, beneficiary, or site supervisor) to answer requests for information or to review a draft through a link, without an account. Decret stores that person’s name, role, and email address as entered by the Customer, the message sent with the link, when the link was viewed, and the answers, review decisions, and downloads made through it. The link expires after the period the Customer chose (thirty (30) days unless changed, ninety (90) at most) or when it is revoked; the record of what was done through it stays with the project. Decret emails that person the link and reminders on the Customer’s behalf.
A Customer may also share approved documents with such a person through a personal link to the project’s shared folder, where that person can read and download them without an account. Decret stores that person’s name and email address as entered by the Customer, when the link was opened, and which documents were downloaded and when; the Customer’s project team sees that record. The link works for ninety (90) days from when it is sent or last extended by the Customer, or until it is revoked; the record stays with the project. Decret emails that person the link on the Customer’s behalf.
4.9 Data not collected as a purpose of the Service
Advertising cookies, cross-site trackers, and social-media pixels are not used. Analytics (Google Analytics 4) runs on the public pages only while Decret has it switched on and the visitor has accepted it; it is not used in the signed-in workspace. Government identity documents are not required at registration. Special-category data is not a purpose of the Service.
5. Purposes and legal bases
| Purpose | Examples | Legal basis |
|---|---|---|
| Provision of the account and the Service | Registration, authentication, workspace, exports, password reset | Contract (UK/EU GDPR Article 6(1)(b)) |
| Customer Data in a project | Storage of drawings, generation of drafts, listing of projects | Processor instructions (Article 28); the customer’s bases as controller |
| Security of the Service | Rate limits, authentication logs, session idle timeout, abuse prevention | Legitimate interests (Article 6(1)(f)) |
| Transactional email | Address verification, password reset | Contract; legitimate interests in account integrity |
| Demonstration and sales enquiries | Request-a-demo form | Legitimate interests in responding to business enquiries; or steps prior to entering a contract |
| Legal obligations | Tax records if invoices are issued; responses to lawful requests | Legal obligation (Article 6(1)(c)) |
| Strictly necessary cookies | Session cookie; analytics consent cookie; language cookie | ePrivacy rules (necessary cookies); GDPR contract and/or legitimate interests |
| Analytics (optional) | Google Analytics 4 on the public pages, after the visitor accepts | Consent (ePrivacy rules; EU/UK GDPR Article 6(1)(a)), withdrawable at any time |
| Optional marketing | Not presently undertaken | Would require consent or another valid ePrivacy or GDPR basis |
| Payments | Card checkout through Stripe; the VAT identification number and its VIES check for invoices under the reverse-charge mechanism | Contract (Article 6(1)(b)); legal obligation for invoices (Article 6(1)(c)); card data is handled by Stripe |
Where processing is based on legitimate interests, the data subject may object (clause 11). Decret shall not continue such processing where the law requires it to stop.
6. Cookies
Cookies are described in the Cookie Policy. Decret uses a session cookie for authentication, a cookie recording your analytics choice, and a cookie recording the language you read the site in. Google Analytics 4 runs on the public pages only while Decret has it switched on, and then only after you accept it in the banner, which is shown only while it is on; Google acts as Decret’s processor for it. Withdrawing consent stops further analytics and removes its cookies on a best-effort basis. Advertising and cross-site tracking cookies are not set.
7. Recipients and subprocessors
Decret does not sell personal data. Personal data is disclosed only as required to operate the Service, to the recipients below. Those that process Customer Data as Decret’s subprocessors come first, as Annex C of the Data Processing Agreement lists them.
| Recipient | Purpose and data received | Location, role and safeguard |
|---|---|---|
| Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg | Hosting of the Service: the application servers (Amazon EC2), the database (Amazon RDS for PostgreSQL), project files, generated documents, site diary photos and logos (Amazon S3), and the Service’s configuration and secrets (AWS Systems Manager). It holds all account and project data. | Europe (Frankfurt), eu-central-1. Processor under the AWS Data Processing Addendum, part of the AWS Service Terms, which includes the Standard Contractual Clauses for any transfer outside the EEA. |
| Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States | DNS, the edge network, TLS and security filtering for decret.ai: every request to the Service passes through it, with the visitor’s IP address and what the request carries, uploaded files included. Email Routing: it receives mail sent to project email addresses, which it passes to the Service. | A global network, operated from the United States. Processor under the Cloudflare Data Processing Addendum. Transfers rely on the EU-U.S. Data Privacy Framework and its UK Extension, to which Cloudflare is certified, and on the Standard Contractual Clauses with the UK Addendum in that addendum. |
| Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, United States | Outbound email from noreply@decret.ai: address verification and password reset, notifications, and links and reminders sent to outside parties on the Customer’s behalf. It receives each recipient’s address and the message, and keeps the messages it sends and their delivery records. | United States. Processor under Resend’s Data Processing Addendum, which includes the Standard Contractual Clauses with the UK Addendum; Resend also participates in the EU-U.S. Data Privacy Framework and its UK Extension. |
| Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland, for an API customer in the EEA, Switzerland or the United Kingdom; Anthropic, PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, United States, otherwise | Model inference (Claude API) when an AI feature runs on a project: transcribing drawings, classifying files, extracting facts, filling templates, answering questions in chat and the project assistant, drafting site diary reports, describing site photos and proposing measurements. It receives the relevant project documents or extracts of them, does not train models on them, and deletes them within thirty (30) days unless it must keep them longer to enforce its usage policy or to comply with law. | United States. Processor under Anthropic’s Data Processing Addendum, part of its Commercial Terms, which includes the Standard Contractual Clauses with the UK and Swiss addenda. |
| Stripe, LLC, 354 Oyster Point Boulevard, South San Francisco, CA 94080, United States | Card payments, invoices and the customer portal. It receives the account’s email address, the name, billing address and VAT identification number given for an order, the name VIES returns for that number, and what was ordered. Card details are entered on Stripe-hosted pages and never reach Decret. | United States. Processor for the payments it handles for Decret, and an independent controller for its own purposes, such as fraud prevention and its duties as a payment provider. Transfers rely on the EU-U.S. Data Privacy Framework and its UK Extension, to which Stripe, LLC is certified, and on the Standard Contractual Clauses in Stripe’s data processing terms. |
| European Commission (VIES, the VAT Information Exchange System) | Checking a company’s VAT identification number before a sale under the reverse-charge mechanism. It receives only that number. | European Union. The Commission runs VIES as processor for the Member States’ tax authorities, which are its controllers. Nothing leaves the EEA. |
| Norwegian Meteorological Institute (MET Norway), Oslo, Norway | Automatic weather on a site diary page, for a project that chooses it. It receives the site’s coordinates, rounded to about one kilometre, from Decret’s server. | Norway, in the EEA. Independent controller of its access logs, which it keeps in Oslo. |
| OpenStreetMap Foundation (Nominatim), Cambridge, United Kingdom | Finding a site’s coordinates for automatic weather. It receives only a locality with its county or country, from Decret’s server: one a person enters or confirms, or, in Romania, one the official register of localities lists. Never the project’s location text, a street or a house number. | United Kingdom, which has an adequacy decision of the European Commission. Independent controller of its request logs. |
| Google (Google Workspace) | Decret’s mailboxes: mail sent to Decret’s addresses at decret.ai. | Google’s global infrastructure, operated from the United States. Processor under Google’s Cloud Data Processing Addendum. Transfers rely on the EU-U.S. Data Privacy Framework and its UK Extension, to which Google LLC is certified, and on the Standard Contractual Clauses in that addendum. |
| Google (Google Analytics 4) | Audience measurement on the public pages, only while Decret has it switched on and only after the visitor accepts it. It receives the pages visited and the identifiers in the analytics cookies; Google Analytics 4 does not log or store IP addresses. Not used in the workspace. | United States. Processor under Google’s data processing terms for its measurement products. Transfers rely on the EU-U.S. Data Privacy Framework and its UK Extension, to which Google LLC is certified, and on the Standard Contractual Clauses. |
| The push service of the device’s browser (for example Google, Mozilla or Apple) | Delivery of push notifications to a device that turned them on. It receives each notification encrypted, so it cannot read it, with the device’s push address. | Chosen by the browser, not by Decret; the browser vendor’s own terms apply. |
| Professional advisers and public authorities | Legal, accounting, or lawful requests | As required |
The table names every recipient the Service uses at the date of this notice. Decret keeps it current and gives notice of a new subprocessor of Customer Data as clause 7 of the Data Processing Agreement provides. Operator access is limited as described in the Security Measures document.
Correspondence sent to Decret by email is visible to persons who operate the Service.
8. International transfers
Account and project data are stored in the EEA: Decret’s database, project files and application servers run in AWS Europe (Frankfurt), eu-central-1. Decret itself is a United States company (clause 1). For the data it controls (accounts, billing, the website and support) it is subject to the EU GDPR and the UK GDPR directly, because it offers the Service to persons in the EEA and the United Kingdom, and the persons who operate the Service may reach that data from the United States.
Decret passes personal data to recipients outside the EEA only as clause 7 sets out, each under one of these safeguards:
- the EU-U.S. Data Privacy Framework and its UK Extension, for a recipient certified under it: Cloudflare, Resend, Stripe and Google;
- the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914), with the UK Addendum for data from the United Kingdom, which are part of the data processing terms of Anthropic, Cloudflare, Resend, Stripe and Google, and of the AWS terms for any transfer AWS makes outside the EEA;
- an adequacy decision, for the OpenStreetMap Foundation in the United Kingdom.
For Customer Data, which Decret processes for a business customer, the Data Processing Agreement (clause 8) sets out the safeguards, including the Standard Contractual Clauses between the customer and Decret. Cloudflare’s network may handle a request in the location nearest the visitor, inside or outside the EEA. A copy of the safeguard for a recipient is available on request at hello@decret.ai.
9. Retention
The following retention schedule applies.
- Accounts: for the life of the account, then deletion or anonymisation within a reasonable period after closure (target: thirty (30) days for live data, longer for backups and legal holds).
- Sessions: until idle timeout (default fourteen (14) days) or absolute expiry (thirty (30) days), then purged.
- Authentication tokens: twenty-four (24) hours (email verification) or one (1) hour (password reset), single use, then consumed or expired.
- Authentication event logs: a capped operational log, not an archive of email content.
- Access and demonstration requests: until the enquiry has been handled, and thereafter as a record of the business contact for no more than twenty-four (24) months. The requester may ask for earlier deletion, which Decret carries out where the law permits.
- Customer Data (processor): until the customer deletes the project or account, instructs Decret under the Data Processing Agreement, or the applicable subscription or one-off retention period below expires. Live deletion is subject to the backup cycle described below.
- After a paid subscription ends: while the subscription is active, this schedule does not delete Customer Content. After cancellation at the end of a billing period, or after a subscription remains unpaid beyond the seven-day payment grace period, project files, generated documents and deliverables are kept for sixty (60) days and are then deleted from the live Service. The account owner is emailed forty-five (45), thirty (30), fifteen (15) and one (1) day before deletion, with the deletion date in Romania time and links to the account data export and the applicable dossier ZIP. Deletion happens only after these warnings: if a warning could not be sent on schedule, the deletion moves to fifteen (15) days after the warning sent at that point, which states the new date, and the one-day reminder still precedes it. A new subscription before the deletion date cancels the deletion and all further warnings.
- One-off orders without a subscription: delivered documents, including documents edited by Decret for the Customer, are deleted from the live Service twenty-four (24) hours after delivery. The delivery screen and delivery email state this period and the deletion time in Romania time. A delivery whose screen and email did not state a deletion time, such as one made before this schedule applied, is not deleted on this schedule; the Customer is notified before it is deleted. Downloaded copies on the Customer's own systems are not affected.
- Retention-deletion audit records: what was deleted, when and why, without file content, are retained together with the account itself and its billing history. The project or delivered document itself is not retained in these records.
- Backups: Automated backups of the database, with point-in-time recovery, expire after seven (7) days. No expiry is configured yet for earlier versions of project files kept by storage versioning, including versions of files that have since been deleted: they are retained until one is. The planned expiry is ninety (90) days, unless a legal hold applies. A copy of the Service’s data as it stood on 22 October 2026, kept from the move of the Service to its managed database, is held in the Service’s AWS account (on the application host and in its nightly backups) until the move is declared complete. Personal data that was in the Service on that date and was deleted later remains in that copy until the copy is deleted; no date has been set for that deletion.
- Projects on the free 14-day test: deleted with their files when the test period ends, unless the account has moved to a paid plan.
- Email to a project address from an unapproved sender:deleted with its attachments thirty (30) days after receipt unless the project owner accepts it.
- Push subscriptions: until push is turned off, the person signs out on that device, the browser withdraws the subscription, or deliveries repeatedly fail.
- Links for outside parties: usable until they expire (thirty (30) days unless the Customer chose otherwise, ninety (90) at most) or are revoked; their record stays with the project as Customer Data.
- Shared folder links: usable for ninety (90) days from when they are sent or last extended, or until they are revoked; their record of openings and downloads stays with the project as Customer Data.
- Transactional mail: message bodies are not kept on the application host. Resend, which sends them, keeps the messages it sends and their delivery records in the United States (clause 7).
10. Security
Measures are described in the Security Measures document, including TLS in transit, Argon2id password hashing, HttpOnly session cookies, project access controls, origin checks on authentication requests, and security response headers. Decret is not presently certified under SOC 2, ISO/IEC 27001, or equivalent schemes. Security controls are designed with reference to widely recognised frameworks, including the control themes commonly associated with ISO/IEC 27001 and SOC 2. The database and project files are encrypted at rest by the storage provider (Amazon RDS and Amazon S3); application-level encryption of project files is not implemented.
11. Data subject rights
Subject to the EU GDPR or the UK GDPR, as applicable, a data subject may have the right of access, rectification, erasure, restriction, objection (including to processing based on legitimate interests), and data portability, and the right not to be subject to a solely automated decision producing legal or similarly significant effects. Outputs of the Service are tools for a human reviewer. Decret does not take solely automated decisions granting construction permits or employment.
A signed-in user may exercise access, portability and erasure directly under Settings, Your data. The export is a ZIP archive containing the account record (without the password hash), the projects the user owns with their stored files, the user’s notifications, sign-in events and billing ledger entries. Account deletion requires the account email and current password; it removes the account, its sessions and the projects the user owns, removes the user from projects owned by others and replaces the user’s name and email in their activity records with “Deleted user”, except in the site diary, and cancels an active subscription. The site diary keeps the user’s name on pages and addenda they wrote and photos they added; its append-only change history keeps the name and email recorded with each change, because the diary is the register of the works. Credit ledger entries, which carry no name or email, are kept for accounting retention. Backup copies are kept as set out under Retention (clause 9).
Requests shall be sent to hello@decret.ai from the address held on file, or with other evidence of identity. Manifestly unfounded or excessive requests may be refused or charged as permitted by law. In respect of Customer Data processed as processor, Decret shall refer the requester to the customer or act on the customer’s instructions.
Complaints concerning Decret’s processing of personal data may be sent to the same address. Decret shall acknowledge and respond without undue delay.
12. Children
The Service is intended for businesses and professionals and is not directed at children. Decret does not knowingly collect personal data from persons under 18. If such data has been collected, Decret shall delete it upon notice.
13. Complaints
Data subjects may contact Decret in the first instance. They also have the right to lodge a complaint with a supervisory authority.
- United Kingdom: Information Commissioner’s Office: https://ico.org.uk/
make-a-complaint/. - European Economic Area, including Romania: the supervisory authority of the data subject’s habitual residence, place of work, or place of the alleged infringement. In Romania, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP): https://www.dataprotection.ro/. Reference to ANSPDCP does not constitute an establishment in Romania or a designation of ANSPDCP as lead supervisory authority.
14. EU and UK representatives
Decret is established in the United States, outside the EEA and the United Kingdom. A controller or processor not established in the EEA that offers goods or services to, or monitors the behaviour of, persons in the EEA may be required to appoint a representative under Article 27 of the EU GDPR; Article 27 of the UK GDPR makes the same provision for persons in the United Kingdom. No EU representative has been appointed as at the date of this notice. No United Kingdom representative has been appointed as at the date of this notice. Persons in the EEA and the United Kingdom may write to Decret directly at the addresses in clause 16 and complain to their supervisory authority (clause 13).
15. Changes
Decret shall publish revisions of this notice on this page with an updated effective date. Material changes may also be notified to account holders by email.
16. Contact
Sorenor, LLC, operator of Decret
2810 N Church St STE 90277, Wilmington, DE 19802, United States
hello@decret.ai
General correspondence: hello@decret.ai.