Polycam

GDPR overview

Concrete but partial. The privacy notice, last revised on 23 September 2024, carries a dedicated European residents section listing GDPR rights for EEA and UK data subjects: access, portability, correction, erasure, restriction of processing to storage only, objection, objection to marketing, withdrawal of consent and the right to complain, with the caveat that several apply only in certain circumstances. Rights are exercised through a single address, legal@polycam.ai, and no data protection officer is named. Polycam states it is based in the United States and that data may be transferred, stored and processed there, but names no transfer mechanism such as standard contractual clauses. No DPA is published, no Article 27 representative is designated and no subprocessor list exists. The phrase GDPR compliant appears once, on the pricing page, among the items Enterprise buyers must request from sales.

Who owns the data?

Polycam Inc. states in its terms that it claims no ownership of the models or other content users create, subject to its own rights in the underlying technology and software. In exchange, users grant the company and a broad set of Licensed Parties, which includes affiliates, licensees, sublicensees, contractors, service providers, successors and assigns, a royalty-free, worldwide, transferable, sublicensable and irrevocable licence to host, store, reproduce, transmit, display, publish, distribute and modify that content, including as needed to improve and develop the Services. Content marked private is excluded from reuse by other users. Polycam may remove, screen, edit or delete any content at any time without notice, and all feedback submitted becomes its exclusive property.

Reuse rights

Users keep ownership of their own captures and can reuse them freely in client and commercial work: the terms grant a limited, non-exclusive licence to the underlying technology so that exported models may be used as permitted, and the export range is designed to feed third-party CAD, BIM and 3D software directly. Public link sharing and embedding are available on every plan, with the watermark removed on paid tiers. The restrictions sit on the input and the competitive side rather than on the output: users may not create models of people or objects in ways that infringe intellectual property or privacy rights, may not sell, share or embed API keys, and may not use the Services to build competing products or to power or train other artificial intelligence and machine-learning models. On Polycam's own side, the privacy notice says collected information is shared with vendors handling system administration, cloud storage, security, customer relationship management, marketing communications, web analytics and payment processing, and, more unusually, that user-generated content may be licensed to third parties as a legitimate interest in running and monetising the business. Neither document states whether customer data is used to train Polycam's own models.

Data retention & training

Hosting summary

Polycam states in its privacy notice that it is based in the United States, and that information collected from users outside the country may be transferred to, stored and processed in the United States or in other countries outside the user's country of residence. No cloud provider is named: third parties appear only as categories, one of which is cloud storage. Regional cloud storage is listed on the pricing page among the items Enterprise buyers must request from sales, without naming any region. The pricing FAQ says captures are stored with industry-standard encryption, without specifying the algorithm or the location, and the privacy notice warns that no security measure is impenetrable. One notable exception to the cloud path: floor plans are computed on the device itself, with no cloud upload. The website is delivered by Fastly from an anycast node, which concerns content delivery rather than where captures are stored. The Trust Center that would document hosting in detail returns HTTP 403 to outside requests, so nothing beyond these statements can be verified.