Personal data protection
Regulation (EU) 2016/679 (GDPR) and the Luxembourg law of 1 August 2018. Last updated: 14 September 2026.
1. The principle
CadMirror works on your computer. Your plans, projects and take-offs are never sent to AMS Studio or anyone else. The software contains no audience measurement, no advertising identifier, no account to create. We process personal data for three things only: to sell you a licence, to deliver it, and to offer you updates.
2. Data controller
AMS STUDIO S.à.r.l., 87, Route d'Esch, L-4450 Belvaux, Luxembourg — contact@ams-studio.lu. The company is not required to appoint a data protection officer; the manager acts as the point of contact.
3. What we process, why, and on what basis
| Processing | Data | Legal basis (art. 6 GDPR) | Retention |
|---|---|---|---|
| Purchase of a licence (Stripe) | Name, e-mail address, billing address, country, VAT number where applicable, last four digits and type of the card (the full number is known only to Stripe) | Performance of the contract (b); accounting and tax obligations (c) | 10 years from the close of the financial year (art. 16 of the Luxembourg Commercial Code) |
| Issuing and delivering the licence key | E-mail address, signed licence key, issue date, order reference | Performance of the contract (b) | Term of the licence, then 10 years with the accounts |
| Business licence: seat enrolment | Name and e-mail address of each enrolled employee, provided by the licence administrator, issue and revocation dates | Performance of the contract (b) and the employer's legitimate interest in administering its seats (f) | Term of the Business licence, then 12 months |
| Pairing of the Survey app (iPhone, iPad) | Pairing identifier, passed by the QR code shown on your workstation; the surveys themselves go from the device to the workstation | Performance of the contract (b) | Duration of the pairing |
| Update check | Software and Windows version, IP address (processed by Cloudflare for the duration of the request, not retained by us) | Legitimate interest: security and maintenance (f) | Technical logs, 30 days at most |
| Service e-mails | E-mail address, content of the e-mail (licence key, enrolment token) | Performance of the contract (b) | Sending logs, 30 days |
| Support requests | What you write to us, and your contact details | Legitimate interest: replying (f) | 3 years after the last exchange |
| Promotional offers inside the software | No personal data: the software reads a public offers file and sends nothing | — | — |
4. What we do not do
We do not sell or rent any data. We do no profiling. We send no marketing without your consent: news about new versions lives in the software, not in your inbox. We do not knowingly collect any data from minors.
5. AI services, if you turn them on
By default, nothing leaves your computer. Two optional features can call on an artificial intelligence service, with your own API key, encrypted on your computer by Windows (DPAPI): reading a plan with Claude (Anthropic), which receives the images of the displayed area of the plan, and realistic perspectives, which send the 3D view (and, depending on the service, the floor plan) to OpenAI, Google or Stability AI. These transfers go directly from your computer to the chosen service; AMS Studio is neither recipient nor intermediary, and the processing falls under the terms of that service, which you accept when obtaining your key. The project itself is never sent.
6. Processors and transfers outside the European Union
Stripe Payments Europe (Ireland) for payment; Cloudflare (European servers, a US company) for the licence service, downloads and hosting. These providers are bound by the GDPR by contract (art. 28). Where data may transit to the United States, the transfer relies on the adequacy decision for the EU–US Data Privacy Framework for providers certified under it, and on the European Commission's standard contractual clauses for the others.
7. Your rights
You may request access to your data, its rectification or erasure, restriction of processing, portability, and object to processing based on legitimate interest — by e-mail to contact@ams-studio.lu. We reply within a month. You may also lodge a complaint with the National Commission for Data Protection (CNPD), 15 boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu, or with the authority of your country of residence.
8. Security
Licence keys are signed (ECDSA P-256) and verified offline; the private key is never on a computer. The API keys of AI services are encrypted by Windows on the computer. Exchanges with our services are encrypted (TLS). The software and its installer are signed in the name of AMS STUDIO S.à.r.l. and time-stamped.
9. Changes
This policy may evolve with the software. The date at the top is authoritative; a substantial change is announced in the release notes.