---
title: Privacy Policy
description: How PCBJam handles your personal data.
updated: 2026-06-10
---

## 1. A quick summary

This summary is here to help you understand our practices at a glance. It is **not a substitute** for the full policy below, which is what legally applies.

- **Who we are.** PCBJam is a browser-based PCB-design application (built on the open-source KiCad EDA toolchain) operated by Emergence-Engineering Kft. ("PCBJam", "we", "us"). We are the **data controller** for the personal data described here.
- **What we collect.** The email address you give us when you join the waitlist, account details, the projects and design files you create or upload, limited technical and usage data, your communications with us, and — if you buy a paid plan — limited transaction data from our payment provider.
- **Your design files.** Your projects are **private by default.** We process them on our servers only to run the service you ask for (storage, rendering, design-rule checks, compiling, exports, and the collaboration/sharing you choose to enable). We do not sell them and we do not use their contents to advertise to you.
- **Analytics.** We use **Vercel Web Analytics, which is cookieless and does not track you across other websites.** It does not build an advertising profile of you.
- **Payments** are handled by **Paddle**, which acts as the "Merchant of Record" and an **independent data controller** for your payment information (see §8).
- **Your rights.** You can access, correct, export, or delete your data, object to certain processing, and withdraw consent at any time. EU/UK users can complain to a data-protection regulator; California users have specific rights under the CCPA (see §13).
- **Contact.** contact@emergence-engineering.com (or hello@pcbjam.com).

---

## 2. Who we are (data controller)

Emergence-Engineering Kft. is the controller responsible for your personal data when you use PCBJam and the PCBJam website.

- **Legal entity:** Emergence-Engineering Kft.
- **Registered address:** 1123 Budapest, Nagyenyed utca 5. pinceszint, Hungary
- **Company registration number:** Cg. 01-09-380162
- **VAT number:** HU29043424 (adószám: 29043424-2-43)
- **Privacy contact:** contact@emergence-engineering.com

**Data Protection Officer (DPO).** We are not required to appoint a DPO under Article 37 GDPR, and we have not appointed one. You can reach the team responsible for data protection at contact@emergence-engineering.com.

**EU representative.** Because we are established in the European Union (Hungary), we are not required to appoint an Article 27 representative.

> PCBJam is a product of Emergence Engineering. "PCBJam" is the product; Emergence-Engineering Kft. is the legal entity behind it.

---

## 3. Scope of this policy

This policy applies to personal data we process when you:

- visit **pcbjam.com** and related marketing pages;
- **join the waitlist** for early access;
- create a PCBJam account and use the editor (including projects you store, render, check, compile, export, share, or collaborate on); and
- contact us or sign up for our emails.

**PCBJam is rolling out in stages.** Today the public website and the waitlist are live, and features such as accounts, cloud-stored projects, collaboration, and paid plans are being released gradually. Where this policy describes processing connected to a feature (for example storing your projects, or payments), that processing happens only once the feature is live and you use it.

It does **not** apply to third-party websites or services we link to, or to the separate practices of providers who act as their own controllers (for example, **Paddle** for payments — see §8). Where we use cookies and similar technologies, our separate [Cookie Policy](/cookies) explains the detail; this policy and the Cookie Policy should be read together.

---

## 4. The personal data we collect

We collect the following categories of personal data.

### 4.1 Data you give us

| Category | Examples | When |
|---|---|---|
| **Waitlist data** | The email address you submit to join the waitlist, and which page you signed up from | When you join the waitlist |
| **Account data** | Name or username, email address, password (stored only as a salted hash), or the identifier from a third-party login if you sign in with one | When you register or update your account |
| **Your content** | The PCB projects, schematics, layouts, and design files you create or upload, plus project names, descriptions, comments, and version history. **Note:** KiCad files can contain personal data you choose to put in them (e.g., the author/company fields in a title block). | While you use the editor |
| **Sharing & collaboration data** | Who you invite, share links you create, projects you publish, comments, and presence information (such as live cursors and edit activity) shown to collaborators | When you share, publish, or collaborate |
| **Communications** | The content of support requests, feedback, and other messages you send us, and your email/marketing preferences | When you contact us or set preferences |
| **Payment data** | Most payment data is collected directly by **Paddle** (see §8). From Paddle we receive limited transaction data such as your name, country, the plan purchased, the last four digits/card type, and billing status — **we never receive or store your full card number** | When you buy a paid plan |

### 4.2 Data we collect automatically

| Category | Examples |
|---|---|
| **Technical & log data** | IP address, browser type and version, operating system, device type, timestamps, referring pages, and error/diagnostic logs generated when you use the service |
| **Usage analytics** | Aggregated, cookieless analytics about how the site and app are used (see §6) — pages viewed, approximate location (country/region/city), device/browser type, and referrer |

We do **not** intentionally collect special-category data (e.g., health, biometric, political, religious data) and ask that you do not put such data into your projects or messages.

---

## 5. How we use your data, and our legal bases

Under the GDPR we must have a "lawful basis" for each use of your data. The table below maps what we do to the basis we rely on (Article 6 GDPR).

| What we do (purpose) | Data used | Lawful basis |
|---|---|---|
| Provide the editor and your account; **store and process your projects** (rendering previews, running design-rule checks, compiling, generating exports, syncing) | Account data, your content, technical data | **Performance of a contract** — Art. 6(1)(b) |
| Enable the **collaboration and public sharing** you choose to use | Account, content, sharing & presence data | **Performance of a contract** — Art. 6(1)(b) |
| Keep accounts and the service **secure**; authenticate you; prevent, detect, and investigate fraud, abuse, and outages | Account data, technical & log data | **Legitimate interests** — Art. 6(1)(f) (keeping our service and users safe) |
| Process **payments and subscriptions** | Limited transaction data from Paddle | **Performance of a contract** — Art. 6(1)(b); **legal obligation** — Art. 6(1)(c) for tax/accounting records |
| Understand and **improve** the product using aggregated, cookieless analytics | Aggregated usage data | **Legitimate interests** — Art. 6(1)(f) (running and improving our service) |
| Send you **service/transactional emails** (e.g., security alerts, billing, important changes) | Account data | **Performance of a contract** — Art. 6(1)(b); **legitimate interests** — Art. 6(1)(f) |
| Run the **waitlist** — confirm your signup and send you your early-access invite and occasional product updates | Waitlist data | **Consent** — Art. 6(1)(a), given when you submit the signup form (see §7); you can withdraw at any time |
| Send you **marketing emails / our newsletter** | Email, marketing preferences | **Consent** — Art. 6(1)(a), or the ePrivacy "soft opt-in" where it applies (see §7) |
| Provide **customer support** | Account data, communications | **Legitimate interests** — Art. 6(1)(f); performance of a contract |
| Comply with **legal obligations** and respond to lawful requests | As required | **Legal obligation** — Art. 6(1)(c) |

Where we rely on **legitimate interests**, we have weighed our interests against your rights, and you can object at any time (see §13). Where we rely on **consent**, you can withdraw it at any time, without affecting processing already carried out.

**Do you have to provide your data?** You are never under a statutory obligation to give us personal data. Some of it is, however, **needed to enter into and perform our contract with you**: without an email address and basic account data we cannot create or secure your account, and without processing your project files we cannot store, render, or check your designs. If you choose not to provide that data, we cannot offer you those parts of the service. Payment details are required (by Paddle) only if you buy a paid plan.

---

## 6. Analytics — and why we don't track you

We use **Vercel Web Analytics** to understand how PCBJam is used so we can improve it. According to Vercel, this product is **cookieless** and privacy-focused:

- it does **not** use third-party cookies; instead, visitors are counted using a **hash generated from the incoming request**, which is **automatically discarded after 24 hours**;
- it does **not** collect identifiers that **track or cross-check you across different applications or websites**, and it is **not tied to your IP address**;
- the data is **anonymous and aggregated** — page views, approximate location, device/OS/browser type, and referrer.

Because this analytics does **not** involve cross-context behavioural advertising or cross-site tracking, **we do not consider it a "sale" or "sharing" of personal information** under California law (see §13). Vercel acts as our **processor** for this analytics. See Vercel's [analytics privacy documentation](https://vercel.com/docs/analytics/privacy-policy) and [Data Processing Addendum](https://vercel.com/legal/dpa).

---

## 7. Marketing communications

We will only send you marketing emails (such as product news and our newsletter) where we are allowed to — that is, **with your consent**, or under the ePrivacy "**soft opt-in**" where you are an existing customer, the message concerns our own similar products or services, and you were given an easy way to opt out when we collected your address.

- Every marketing email includes a **one-click unsubscribe** and identifies us as the sender.
- You can opt out at any time via the unsubscribe link or by emailing contact@emergence-engineering.com.
- **Opting out of marketing does not stop service/transactional messages** (such as security alerts, billing notices, or material changes to the service), which we need to send you to operate your account.

**The waitlist.** If you join the waitlist, we use the email address you give us — with your consent, requested next to the signup form — to confirm your signup and to send you your early-access invite and occasional product updates. The signup confirmation itself is a service message confirming what you asked for. Every update email includes an unsubscribe link, and you can opt out at any time even before the first one — just reply to any of our emails or write to contact@emergence-engineering.com. If you opt out, we keep a suppression record so we can honour it.

We use **Resend** to deliver email on our behalf (see §9).

---

## 8. Payments — Paddle (Merchant of Record)

When you buy a paid PCBJam plan, the seller of record is **Paddle**, our payment provider, acting as the **"Merchant of Record."** This means:

- **You contract with Paddle for the transaction.** Paddle resells our software and handles billing, payment processing, and sales-tax/VAT collection and remittance.
- For your **payment data, Paddle acts as an independent data controller** — not merely our processor. Paddle collects and processes your payment details under **its own privacy notice**, and shares limited transaction data back to us (such as your name, country, plan, billing status, and card type/last four digits) so we can provide the service and keep our records. **PCBJam never receives or stores your full payment-card number.** Card data is handled by Paddle and its PCI-DSS-compliant processors.
- Please read **[Paddle's Buyer Privacy Notice](https://www.paddle.com/legal/privacy)** to understand how Paddle handles your payment data, including your rights against Paddle directly.

---

## 9. Who we share your data with

We do **not** sell your personal data. We share it only with the following categories of recipients, under appropriate contracts (and, for processors, GDPR Article 28 data-processing agreements):

| Recipient | What they do | Their role | More info |
|---|---|---|---|
| **Vercel** | Hosting/infrastructure and cookieless web analytics | **Processor** | [Vercel DPA](https://vercel.com/legal/dpa) · [Privacy](https://vercel.com/legal/privacy-policy) |
| **Paddle** | Payments / Merchant of Record | **Independent controller** (for payment data) | [Paddle Privacy](https://www.paddle.com/legal/privacy) |
| **Resend** | Sending transactional and marketing email | **Processor** | [Resend DPA](https://resend.com/legal/dpa) · [Subprocessors](https://resend.com/legal/subprocessors) |
| **Cloudflare** | Storing your project files (R2 object storage), hosting application/account data, and network delivery & security (CDN, DNS, WAF) | **Processor** | [Cloudflare DPA](https://www.cloudflare.com/cloudflare-customer-dpa/) · [GDPR hub](https://www.cloudflare.com/trust-hub/gdpr/) |
| **Google (Google Workspace)** | Our business email and support correspondence | **Processor** | [Google Cloud DPA](https://cloud.google.com/terms/data-processing-addendum) |
| **Professional advisers & authorities** | Lawyers, accountants, auditors; courts, regulators, and law-enforcement where legally required | Controller / as required | — |
| **A successor entity** | If we are involved in a merger, acquisition, financing, or sale of assets, your data may transfer to the successor under this policy | As required | — |

We keep an up-to-date list of subprocessors and will update this policy when it changes. **Other than the public sharing and collaboration you choose to enable, we do not disclose your project files to other users.**

---

## 10. Public sharing and user-generated content

PCBJam lets you **publish projects and share them** with others (for example via a public project or a share link). Please remember:

- **Anything you make public can be viewed, copied, downloaded, and re-shared by others, and may be indexed by search engines.** Once content is public, we cannot control how others use it, and removing it later may not erase copies others have already made.
- **You decide what to share.** Projects are private by default; you choose if and when to publish or invite collaborators. You can change a project's visibility or stop sharing at any time in your settings.
- **You are responsible for the personal data you include** in content you publish or share (for example, names in a title block, or comments). Do not publish personal data about others without a lawful basis.
- For content you share, you are typically the controller of the personal data you choose to include; we process it as part of providing the sharing feature you requested.

---

## 11. International data transfers

We are based in the EU, but some of our providers (for example, Vercel, Cloudflare, Paddle, and Resend) may process data **outside the European Economic Area**, including in the United States. Where personal data is transferred outside the EEA/UK, we rely on an appropriate safeguard under Chapter V GDPR, such as:

- an **adequacy decision** by the European Commission (including, where applicable, the **EU–US Data Privacy Framework** for certified US providers); or
- the European Commission's **Standard Contractual Clauses** (and the UK International Data Transfer Addendum), together with additional safeguards where needed.

You can ask us for more information about the safeguards that apply by emailing contact@emergence-engineering.com.

---

## 12. How long we keep your data (retention)

We keep personal data only as long as we need it for the purposes in §5:

| Data | Retention |
|---|---|
| **Account data & your content** | For as long as your account exists — we do not automatically delete inactive accounts; your projects stay until you delete them. After you delete your account (or ask for erasure), we delete or anonymise your data from our live systems within **30 days**, and it expires from encrypted backups within **90 days** of your deletion, except where we must keep some data longer (see below). Public content you shared may persist in copies others have made. |
| **Waitlist data** | Until your signup converts into an account or you opt out, whichever comes first; after an opt-out we keep only a suppression record so we can honour it |
| **Payment & tax records** | For the period required by tax and accounting law (**8 years** under the Hungarian Accounting Act, Act C of 2000) — Art. 6(1)(c) |
| **Technical & log data** | Kept for **90 days** for security and troubleshooting, then deleted or aggregated |
| **Analytics** | Aggregated and not tied to you; the per-visitor hash is discarded after 24 hours (see §6) |
| **Marketing preferences** | Until you unsubscribe, and a suppression record afterwards so we can honour your opt-out |

---

## 13. Your privacy rights

### 13.1 Everyone / EU & UK users (GDPR)

Subject to the conditions in the law, you have the right to:

- **Access** a copy of your personal data (Art. 15);
- **Rectification** — correct inaccurate or incomplete data (Art. 16);
- **Erasure** — delete your data ("right to be forgotten") (Art. 17);
- **Restriction** of processing (Art. 18);
- **Data portability** — receive your data in a portable format, or have it sent to another provider (Art. 20);
- **Object** to processing based on our legitimate interests, and to direct marketing at any time (Art. 21);
- **Withdraw consent** at any time, where we rely on consent (Art. 7(3)); and
- not be subject to a decision based **solely on automated processing** that produces legal or similarly significant effects (Art. 22). **We do not use such automated decision-making.**

To exercise any right, email **contact@emergence-engineering.com**. We will respond within one month (extendable by two further months for complex requests). We will not charge you or treat you differently for exercising your rights.

**Right to complain.** If you think we have mishandled your data, you can lodge a complaint with your local supervisory authority. Our lead authority is **the Hungarian National Authority for Data Protection and Freedom of Information (NAIH — Nemzeti Adatvédelmi és Információszabadság Hatóság), naih.hu**. If you are in the United Kingdom, you can also complain to the **Information Commissioner's Office (ICO, ico.org.uk)**. We'd appreciate the chance to address your concern first.

### 13.2 California users (CCPA / CPRA)

If you are a California resident, you have additional rights. The table below shows the statutory categories of personal information we collect, for the purposes in §5 (for features that are still rolling out — see §3 — collection starts only once you use them; this table also serves as our look-back disclosure for the preceding 12 months):

| CCPA category | Collected? | Examples |
|---|---|---|
| Identifiers | Yes | Name, username, email, account ID, IP address |
| Customer records / commercial information | Yes | Plan purchased, billing status (most payment data is collected by Paddle) |
| Internet/network activity | Yes | Aggregated, cookieless usage analytics |
| Geolocation data | Coarse only | Approximate country/region/city from analytics |
| Sensitive personal information | Limited | Account log-in credentials, used **only** to authenticate you and provide the service |
| Audio/visual, biometric, professional, education, inferences | No | — |

**We do not "sell" your personal information, and we do not "share" it for cross-context behavioural advertising**, as those terms are defined under the CCPA. We do not knowingly sell or share the personal information of consumers under 16.

As a California resident you can:

- **Know/Access** the categories and specific pieces of personal information we collected;
- **Delete** personal information we collected from you;
- **Correct** inaccurate personal information;
- **Opt out of the sale or sharing** of personal information; and
- **Limit the use of sensitive personal information** to what's necessary to provide the service.

Because we do not sell or share personal information, there is nothing to opt out of, and we do not currently process opt-out preference signals — there is nothing for them to switch off. If we ever introduce a technology that constitutes a "sale" or "sharing", we will add the legally required "Your Privacy Choices" mechanism and honour opt-out preference signals such as the **Global Privacy Control (GPC)** at that time. We will not **discriminate** against you for exercising any right. To make a request, email **contact@emergence-engineering.com**; you may use an authorised agent. We will verify your request against your account information.

---

## 14. Children's privacy

PCBJam is a general-audience engineering tool and is **not directed to children.** You must be at least **16** years old to create an account. (Under the GDPR, the "digital age of consent" is between 13 and 16 depending on your country — in Hungary, where we are established, it is 16, and we apply 16 everywhere. If you are below that age, a parent or guardian must create and manage the account on your behalf and is responsible for your use.)

We do not knowingly collect personal data from children under **13** (the US COPPA threshold), and we do not operate a parental-consent mechanism for under-13s — the service is simply not directed at them. **We do not require visitors to state their age**, but if we become aware that we hold personal data of a child under 13 (or under the applicable digital age of consent), we will delete it promptly. If you believe a child has provided us personal data, contact **contact@emergence-engineering.com** and we will remove it.

---

## 15. How we protect your data

We implement appropriate technical and organisational measures to protect your data, taking into account the state of the art, the costs, and the risks involved (Article 32 GDPR). These include encryption of data **in transit** (and at rest where supported by our providers), access controls and least-privilege, authentication safeguards, logging, and regular review of our security practices.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal-data breach occurs that is likely to result in a risk to your rights, we will **notify the competent supervisory authority without undue delay and, where feasible, within 72 hours** (Article 33 GDPR), and we will inform affected users where the breach is likely to result in a **high risk** to them (Article 34 GDPR).

---

## 16. Cookies and similar technologies

PCBJam uses a small number of **strictly necessary** cookies/local storage to keep you logged in and remember your preferences. Our analytics is **cookieless** (see §6). Where we use any non-essential cookies, we will ask for your consent first. For details and choices, see our [Cookie Policy](/cookies).

---

## 17. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top, and for **material** changes we will give you reasonable notice (for example, by email or an in-app notice) before they take effect. Please review it periodically.

---

## 18. Contact us

Questions, requests, or complaints about privacy:

- **Email:** contact@emergence-engineering.com (or hello@pcbjam.com)
- **Postal:** Emergence-Engineering Kft., 1123 Budapest, Nagyenyed utca 5. pinceszint, Hungary
- **Supervisory authority:** the Hungarian National Authority for Data Protection and Freedom of Information (NAIH — Nemzeti Adatvédelmi és Információszabadság Hatóság), naih.hu

---

*PCBJam is built on the open-source KiCad EDA suite. This policy covers the PCBJam service operated by Emergence-Engineering Kft.; it does not cover the KiCad project itself or other third parties.*
