1. Who we are
DigiCity is the trading name of the United Kingdom limited company that operates and licenses the DigiCity platform (“DigiCity”, “we”, “us”). This notice explains how we handle personal data when you use the website digicity.dev, the DigiCity Hub desktop application and the applications it opens (DigiCAD, Struct, MEP, Project Management and Terminal), and our online services, including Digity AI. For the personal data described here we act as the controller.
Contact for any privacy question or request: admin@digicity.dev.
2. What we collect and why
| Data | Why we use it | Legal basis (UK GDPR) |
|---|---|---|
| Account: email address, name, password (stored only as a one-way hash), the date and version of the licence you accepted, account settings such as the beta channel. | To create and run your account, sign you in on the website and in DigiCity Hub, and keep a record of the agreement you accepted. | Contract |
| Sign in with Google: your name, email address and Google account identifier (scopes openid, email, profile). | To create or sign in to your DigiCity account with Google instead of a password. We receive no Google password. | Contract |
| Device and security records: a device identifier generated by DigiCity Hub, IP address, approximate location derived from the IP address (country, region, city), internet provider, browser or app version, the time and result of each request. | To keep one active desktop session per account, detect and stop abuse and account takeover, and investigate incidents. | Legitimate interests (security of our service and our users) |
| Licence and activation: licence key, plan, activation and verification times. | To check that the software is licensed and to provide the plan you have. | Contract |
| Digity AI: the messages you send, and files you choose to attach; usage figures (model, product, token counts, credits used). | To answer your requests and to measure usage against your AI allowance. We do not keep a copy of your conversations; attached files are stored only while they are being used and are deleted automatically after 3 days. | Contract |
| Connected mailbox (optional): the address of the mailbox you connect, and an encrypted access grant from Google or Microsoft. | To let DigiCity Hub read and send email in your own mailbox. See section 3. | Contract, at your request |
| Messages to us: what you send to admin@digicity.dev or through the contact form. | To answer you. | Legitimate interests |
Your project files — drawings, models, schedules and other documents — stay on your computer. They are sent to us only when you choose to use an online feature with them, such as attaching a file to Digity AI.
3. Google and Microsoft user data
If you connect a Gmail or Google Workspace mailbox, DigiCity Hub asks Google for access to that mailbox (scope https://mail.google.com/); for Outlook and Microsoft 365 it asks Microsoft for IMAP and SMTP access. We use this access only to show your email in DigiCity Hub, keep it in sync and send the messages you write. Your messages are downloaded directly from your provider to your own computer and are not stored on our servers. Our servers keep only the mailbox address and the provider's refresh token, encrypted, so that DigiCity Hub can obtain short-lived access; you can remove the connection at any time in DigiCity Hub, which revokes it.
DigiCity's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular we do not sell this data, do not use it for advertising, do not use it to train or improve AI models, and do not allow people to read it except with your explicit permission, where necessary for security or to comply with the law.
4. Who receives your data
We do not sell personal data or share it for advertising. We use the following service providers, each bound by a contract that allows them to use the data only to provide their service to us:
- Railway — hosting of our servers and database.
- Cloudflare — storage and delivery of software downloads and updates.
- Resend — delivery of account emails such as verification and password reset codes.
- AI model providers — third-party providers that run the language models behind Digity AI. Your requests reach them only through our servers, and they receive the messages and attachments you send to Digity AI in order to produce its answers.
- Google and Microsoft — only when you choose to sign in with Google or connect a mailbox.
We may also disclose data where the law requires it, or to protect the rights and safety of our users and of DigiCity.
5. International transfers
Some of these providers process data outside the United Kingdom, including in the United States and other countries. Where this happens we rely on the safeguards required by UK data protection law, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
6. How long we keep it
- Account data: while your account exists; deleted within 30 days after you ask us to close it, except records we must keep by law.
- Desktop sign-in tokens: expire after 30 days without use and at the latest after 180 days.
- Security records: 365 days.
- Digity AI attachments: 3 days. AI usage figures: while your account exists, for quota and billing.
- Mailbox access grants: until you remove the mailbox or close your account.
- Pending “Sign in with Google” attempts: 10 minutes.
7. Security
Connections to our services are encrypted. Passwords are stored only as hashes, mailbox grants are encrypted, and the keys of the providers we use are held only on our servers — never inside the software you install. Access to production systems is restricted and logged.
8. Your rights
Under UK data protection law you can ask for a copy of your personal data, and ask us to correct it, delete it, restrict or object to its use, or transfer it to you or to another provider. Where we rely on your consent you can withdraw it at any time. Write to admin@digicity.dev; we answer within one month. You can also complain to the UK Information Commissioner's Office at ico.org.uk.
9. Website and local storage
digicity.dev uses no advertising or analytics cookies. When you sign in on the website, your session is kept in your browser's local storage so you stay signed in; signing out removes it. DigiCity Hub keeps your sign-in and settings on your own computer.
10. Children
DigiCity is professional software and is not directed at children under 16.
11. Changes
We will update this notice when our processing changes and show the date of the latest version at the top of this page. Significant changes will be announced in DigiCity Hub or by email.