Privacy Policy
Effective date: September 15, 2026
This policy explains what RedHold LLC, a Virginia limited liability company operating as Diagrams.so ("Diagrams.so", "we"), collects, why, and what your choices are. It covers the diagrams.so website and app, the public API, and the official MCP server and SDKs (the "Services"). Companion documents: the Cookie Notice, the Subprocessor List, and, for business customers, the Data Processing Addendum.
Controller and contact: RedHold LLC, 8401 Mayland Dr, STE S, Richmond, VA 23294, USA. Privacy questions and requests: privacy@diagrams.so.
We act in two roles. For account, billing, website, gallery, and analytics data, we are the controller. For content a business customer submits for us to process on its behalf, the customer is the controller and our Data Processing Addendum applies.
1. What we collect
Account data. Name, email, plan, preferences, and authentication identifiers. Sign-in is handled by PropelAuth (Google, Microsoft, or GitHub single sign-on, or an emailed magic link); we do not store a password for SSO users, and any password you do set is stored hashed. We also record how you first found us (referrer and campaign parameters) with your account.
Billing data. Subscription status, Credit balance and ledger, and payment metadata processed by Stripe. We never store full card numbers.
Your content. The prompts and content you submit ("Inputs"), including imported diagram files, and the diagrams, versions, and exports we generate for you ("Outputs").
How prompts are stored, precisely: the prompt that produces a diagram is stored with that diagram and each of its saved versions, so you can view, edit, and regenerate. Prompt text is private to your account. Public and gallery pages never display prompt text, and forking a public diagram copies the diagram content, never the author's prompt. Our usage and abuse-prevention telemetry records prompt size and processing metadata, never the prompt text itself.
Prompts typed on our landing page while signed out are stored on our servers without a link to any account, and we clear them in periodic clean-ups. Please do not include personal or confidential information in a prompt you submit while signed out.
Voice input. Audio you record is transcribed by a speech-to-text service hosted on Microsoft Azure. We do not store the audio; only the resulting text is kept, as a prompt.
Bring-your-own provider keys. If you supply your own AI provider API key, we store it encrypted and use it only to route your generations. You can remove it at any time.
Usage and technical data. Activity logs for actions in the app and API (including IP address and browser or client information), API call metadata (endpoint, timestamps, token counts, latency, source client), API key audit events, and error logs.
Free plan diagrams are public. Diagrams created on the Free plan are published at creation, appear in the community gallery and on share pages, can be indexed by search engines, and are cached on our CDN. They cannot be made private; private diagrams are a paid feature. Do not put confidential or personal information in a Free plan diagram or its prompt.
2. How we use it
| Purpose | Legal basis where GDPR applies |
|---|---|
| Provide the Services: generate, edit, version, and export diagrams; route Inputs to an AI provider; transcribe voice input | Performance of contract |
| Operate the public gallery and share pages for diagrams that are public | Performance of contract and legitimate interests |
| Meter Credits, bill through Stripe, and keep required billing records | Contract and legal obligation |
| Prevent fraud and abuse, secure the Services, rate-limit, and respond to incidents | Legitimate interests and legal obligation |
| Understand how the product is used (analytics, with your consent where required; see Section 6) | Consent and legitimate interests |
| Send transactional email such as sign-in links, receipts, and subscription notices | Contract and legitimate interests |
| Improve the Services using aggregated, de-identified data | Legitimate interests |
We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not use your Inputs or Outputs to train AI models, and our AI providers are contractually restricted from training on content submitted through our accounts. We do not make automated decisions about you that have legal or similarly significant effects; enforcement decisions involve human review.
3. AI providers and other processors
To generate diagrams and transcribe voice input, we transmit the relevant Inputs (including session context such as prior prompts and the diagram being edited) to third-party AI providers. The current providers are named in our Subprocessor List, along with what each receives. Providers process this content under their own agreements with us, delete API content on a default schedule (with longer retention only for trust-and-safety flags or legal holds), and may briefly cache recent requests to speed up repeat generations. If we add a provider, we update the Subprocessor List before using it.
Our other processors include PropelAuth (authentication), Stripe (payments), AWS (hosting and transactional email), and the analytics and monitoring vendors described in Section 6, all listed with locations on the Subprocessor List.
One client-side note: the in-browser diagram editor is the draw.io editor embedded from embed.diagrams.net (JGraph Ltd). When you view or edit a diagram, your browser sends the diagram content to that origin for rendering. Custom icon libraries load from GitHub, which receives standard request data such as your IP address.
4. Where data is processed
We process data in the United States. Where we transfer personal data from the EU, UK, or Switzerland, we rely on our vendors' EU-US Data Privacy Framework certifications where held, with EU Standard Contractual Clauses (and the UK addendum) as a fallback, as set out in the Data Processing Addendum.
5. Retention and deletion
- Diagrams and their versions are kept until you delete them; they do not expire on their own.
- Prompts live with the diagram and versions they belong to.
- Activity logs, API call metadata, and the Credit ledger are kept for security, abuse-prevention, and accounting purposes, including after account deletion.
- Rate-limit and idempotency records are short-lived (about a day).
- Provider-side retention follows Section 3.
Account deletion. When you delete your account we cancel any subscription immediately, anonymize your name and email on the account record, delete your Stripe identifiers and any stored provider key, and unlink your sign-in. Three honest limits: we keep a one-way hash of your email to prevent banned users from re-registering; we keep activity logs and billing records as described above; and your diagrams are not automatically deleted, so public diagrams remain public unless you delete or unpublish them first. Delete your diagrams before deleting your account if you do not want them retained.
If you need a fuller erasure than self-service deletion provides, email privacy@diagrams.so and we will action it, subject to records we are legally required or permitted to keep.
6. Cookies and analytics
Details are in the Cookie Notice. In brief: essential cookies (sign-in sessions, payment flows, security checks, your theme choice) are always on. Analytics tools (Google Analytics and Microsoft Clarity) run only with your consent, which you give or refuse in the cookie banner and can change at any time through the cookie settings link in the footer. On our servers we also run product analytics (PostHog) and error monitoring (Sentry); these are server-side and set no cookies in your browser.
The API, the MCP server, and the SDKs set no cookies and contain no third-party analytics. They send only first-party headers identifying the client so we can attribute usage on our own ledger.
7. Your rights
Depending on where you live, you may have rights to access, correct, delete, or export your personal data, to restrict or object to processing, and to withdraw consent at any time where processing is based on consent. To exercise them, email privacy@diagrams.so from your account email; we will verify your identity and respond within the time the law requires. You will not be treated worse for exercising your rights. EU and UK residents may also complain to their supervisory authority, and California and Virginia residents have equivalent rights under their state laws, which we honor.
8. Security
We protect data with encryption in transit and at rest, access controls that scope every object to its owner, hashed API key storage, encryption of stored provider keys, rate limiting, anomaly alerting, and audit trails on key activity. No method is perfectly secure; we maintain an incident-response process and will notify affected users and authorities as the law requires. To report a vulnerability, see our Vulnerability Disclosure Policy.
9. Children
The Services are for adults 18 and over. We do not knowingly collect data from anyone under 18, and if we learn we hold data of a child under 13 we delete it.
10. Changes and contact
We will post updates here with a new effective date and notify you by email or in-product notice of material changes. Questions or requests: privacy@diagrams.so, or RedHold LLC, 8401 Mayland Dr, STE S, Richmond, VA 23294, USA.