Who we are and how to reach us
measure.expert is run by foryouandyourcustomers Amsterdam B.V., Singel 126, 1015 AE Amsterdam, Netherlands. We're the data controller for everything in this policy.
Privacy questions and requests about your data: privacy@measure.expert Everything else: support@measure.expert
We haven't appointed a Data Protection Officer.
Who this policy is for
measure.expert is sold to businesses. This policy is about personal data concerning:
- people who hold seats on an account and sign in
- billing and admin contacts at customer organisations
- people who start a trial or get in touch
- visitors to the measure.expert website
If your employer holds the account, they decide who gets access and what happens to the content in it. Ask them first.
Your files
When you upload a file, we process it for your organisation, on its instructions. The Service is for floor plans and similar construction drawings, and those usually don't contain personal data — but sometimes they do.
Where they do:
- your organisation is the controller
- we're the processor
- the rules are in the Data Processing Agreement, not here
What we do with the *fact* of your files — how many auto-scans, whether detection worked, how long it took — is in the table below. What's inside them is in the DPA.
Interpreting what's inside a sheet — the walls, spaces, and scale — is done by our own vector-processing engine. It's still "what's inside" a file, so it stays DPA territory rather than this policy's.
What we collect, why, and how long we keep it
| What | Why we have it | Legal basis | How long |
|---|---|---|---|
| Name, business email, organisation, seat role | To run the account and send you service messages | Contract (Art. 6(1)(b)) | Life of the account, then 60 days |
| Sign-in credentials, sessions, MFA | To let you in and keep others out | Contract; our interest in security (Art. 6(1)(f)) | Life of the account |
| Paddle reference IDs linking your account to your subscription in Paddle's system | To know which tier you're on and keep your account provisioned correctly | Contract (Art. 6(1)(b)) | Life of the account, then 60 days |
| Your files, measurements and exports | Because the service doesn't work without them | Contract | Life of the account, then 60 days |
| Auto-scan counts, feature usage, detection outcomes, timings, errors | To meter the allowance, and to find out where detection fails | Our interest in running and improving the service (Art. 6(1)(f)) | 24 months |
| Sign-in events, IP addresses, browser and OS | To spot unauthorised access and credential stuffing | Our interest in security (Art. 6(1)(f)) | 90 days |
| Support messages and anything you send with them | So we have the history when you come back | Contract; our interest in decent support (Art. 6(1)(f)) | 24 months after the ticket closes |
| Whether you agreed at checkout to be contacted about the product, and the record of that choice | To send you product news if you said yes, and to show we asked properly | Consent (Art. 6(1)(a)); our interest in being able to evidence it | Until withdrawn, plus 3 years |
Service messages aren't marketing. Billing notices, security alerts and changes to the service go to account contacts and can't be switched off while the account is live. Product news is separate: we ask at checkout whether you want it, it only goes to people who said yes, and every message has an unsubscribe link.
Deletion. Content you delete inside a live account is removed immediately. When your subscription ends, access stops immediately — there's no grace period, so export what you need before it ends, not after. What's left in our systems is purged within 60 days, unless the law requires us to keep something.
Trial suppression records
Re-qualifying for another trial — after a cooldown, or a minimum paid period — is governed by the Terms and our pricing overview, not by anything in this policy.
We don't currently run any automated system to detect repeat trial sign-ups. No suppression data is collected for that purpose today.
Automatic detection and training
Detection is machine processing of drawings, not decisions about people. We don't make any decision about you by automated means that has a legal or similarly significant effect (GDPR Art. 22).
Detection runs on our own vector-processing engine. No third-party AI service is involved, and we don't use your drawing files to train any AI model.
If detection fails on your drawing and you tell us, we look at that specific drawing to fix it. That's the only situation where anyone here reviews the contents of a drawing — triggered by your report of a problem with your file, not a general review of uploaded drawings.
Aggregate metrics with no drawing content in them — success rates, timings, recurring failure modes — are used to improve the service more broadly, because they contain nothing about you or your files.
Who else touches your data
Providers who work for us. A short list — hosting, authentication, and email. Each is bound by a written agreement, works only on our instructions, and can't use your data for itself.
The sub-processor list lives in the DPA, along with how you're told when it changes. We keep it in one place so it can't drift out of sync.
Paddle. Paddle sells you the subscription, not us — that's in the Terms. For data protection, the consequence is that Paddle is an independent controller of your payment data under its own privacy policy at paddle.com/legal/privacy. The checkout opens over our own page, but the form itself is Paddle's: your billing details — card, billing address, tax data — are entered directly into it and never reach us. What comes back to us is a set of reference IDs that tell us which account maps to which subscription, and nothing more. For anything about the billing data itself, Paddle's privacy policy is the one that governs it.
Our group. Colleagues at other foryouandyourcustomers companies may see your data where a task needs it — support escalation, development, administration. Covered by intra-group processing agreements, limited to what the task requires. The full list of group locations is under "Where your data goes" below.
Authorities. Only where EU or Dutch law requires it, or under a valid order recognised in the Netherlands. We read every request, refuse the overbroad ones, hand over the minimum, and tell the customer first unless we're barred from doing so.
Us. Nobody here opens your account content unless you ask us to — including reporting that detection didn't work correctly on a specific drawing — you consent to it for a support case, or something has broken badly enough that a person has to go in and fix it. In that last case we look for a root-cause fix so it doesn't happen twice.
Anonymised data. We may aggregate or anonymise data so it identifies nobody, and use the result freely. This doesn't extend to your drawing files — we don't use those to train anything, anonymised or not.
Where your data goes
The Terms already say it: drawings and account data stay in the EEA; payment data goes to Paddle in the UK under the adequacy decision. Hosting, authentication, and detection all run in the same EU region — this holds in full. Two additions.
Our group. Colleagues at foryouandyourcustomers companies in the Netherlands, Germany, Austria, Greece and Bulgaria — all in the EEA — and in Switzerland, which has an adequacy decision, may access your data where a task needs it. Nothing goes to a country without one of those protections.
Anywhere else. If a provider processes outside the EEA, we rely on an adequacy decision where one covers that country. Where none does, we put Standard Contractual Clauses in place with a transfer impact assessment and whatever technical measures it calls for. Ask us and we'll tell you which applies to a given provider.
Cookies
We don't currently set cookies of any kind — not even the strictly necessary category. There's no cookie banner and no settings link because there's nothing yet to gate or manage.
If that changes, the two categories work differently: strictly necessary cookies — session, security, load balancing — can be set without asking, as Dutch law allows. Anything else, analytics included, needs a consent banner in place *before* it starts collecting, not retrofitted afterward.
Basis, for when it applies: consent under Art. 6(1)(a) GDPR and Art. 11.7a of the Dutch Telecommunications Act for anything non-essential.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or hand it over in a portable format. You can object to anything we do on the basis of legitimate interest — including how we use product usage data — on grounds particular to your situation. You can withdraw consent whenever you like, without affecting what we did before.
Some of this you can do yourself: fix your profile in settings, export measurements any time, and unsubscribe from product news using the link in any of those emails.
For the rest, write to privacy@measure.expert. We reply within a month, or tell you inside that month if a complex request needs up to two more. We may need to confirm who you are first, usually via the account email — if we can't, we may not be able to act.
If your request is about personal data inside uploaded files, we'll point you to the organisation that controls it and help them answer.
Exercising any of this costs you nothing and changes nothing about your price or service.
Complaints go to the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority where you live or work.
Security
TLS in transit, encryption at rest, role-based access with production access limited to named people, MFA on admin access, logging of production access, and a written agreement plus security review for every provider.
The full technical and organisational measures are an annex to the DPA — that's the document a security reviewer will ask for, and it's where they belong.
If a breach happens and it's likely to put people at risk, we tell the Autoriteit Persoonsgegevens within 72 hours, and tell affected customers and individuals where the risk is high.
Children
Business product, not for anyone under 18, and we don't knowingly collect their data. Tell us if you think we have, and we'll delete it.
Changes
We update this policy when the service or the law changes. Material changes to how we handle personal data are emailed to account administrators before they take effect.
The Terms have their own change mechanism, with its own notice period and deemed-acceptance rule. That governs the contract. This policy isn't part of the contract and changes on its own timing.
Privacy questions or a request about your data?
Email privacy@measure.expert.