Privacy notice
Version 2026-08-27 · Last updated 27 August 2026
The short version. We hold the account you create, the design tables you build and the documents we generate from them. We do not track you, we run no advertising, and we sell nothing to anyone.
The one time your information goes to another company is when a distributor introduced you to Network Designer and you ticked the box agreeing to it. That is optional, it is described in full below, and you can stop it in one click at any time.
1. Who we are
Network Designer is a product of Clavia Ltd (“we”, “us”), company number 09537694, registered at George Court, Bartholemews Walk, Ely, Cambridgeshire, England, CB7 4JW. We are the data controller for the information described in this notice. We are registered with the Information Commissioner’s Office under number ZC173697.
For anything to do with your data, email [email protected].
2. What we hold, and why
| What | Why we have it | Lawful basis |
|---|---|---|
| Your email address and a hashed password | To create and secure your account, verify your email address and let you reset your password | Performance of a contract |
| Your company name, website, logo and brand colours | To brand the design packs we generate for you | Performance of a contract |
| Your project tables — project name, property address, and the list of devices in each room | To compute the design and produce your documents | Performance of a contract |
| The finished design packs (PDF and Excel) | So you can download again exactly what you delivered to your client | Performance of a contract |
| Payment records — the Stripe reference and when you paid | To prove a design was paid for, and to meet our accounting obligations | Legal obligation |
| Your IP address, momentarily, during the bot check | To stop automated signups | Legitimate interests — keeping the service available |
| If you refer a friend: the email address you give us | To send them a single invitation with your referral code | Legitimate interests — see section 4 |
| If a distributor introduced you and you agreed: your company name, contact email and the bills of materials for your designs, shared with them | So they can see what their installers are specifying and quote the equipment | Your consent |
We do not hold your card details. Payments go directly to Stripe; we only ever see a reference to the transaction.
3. Your clients’ details
When you build a design you may enter a property address. That is information about your client, not about you, and we treat it accordingly:
- It is used only to put the address on the cover of the documents we generate for you.
- It is never shown to a distributor, under any circumstances.
- It is never used for marketing and is never sold or shared.
- It is kept for as long as we keep the design (see section 7), so that you can retrieve the exact document you handed your client.
You are responsible for your own relationship with your client, including telling them what you share with your suppliers. If you would rather not enter an address at all, the field is optional and the design works perfectly without it.
4. Referrals
If you invite someone using “Refer a friend”, we send them one email containing your referral code and a link to sign up. We do this on the basis of our legitimate interest in word-of-mouth growth, and on the understanding that you have their permission to give us their address. We do not add them to any mailing list, we never email them again unless they create an account, and we do not use their address for anything else. If you are that person and would like the record deleted, email us and we will remove it.
5. Distributors
Some installers reach Network Designer through a distributor’s link. That distributor subsidises your access, and in return they can see how their installers are using the tool.
This only ever happens if you tick the box when you sign up. If you do:
| They can see | They can never see |
|---|---|
| Your company name Your contact email address When you joined How many designs you have produced For each design: its name, the brand, the device count, and the bill of materials |
Your clients’ property addresses Your design documents — they cannot download any pack Your account password or payment details Any design you produced before you agreed, or after you withdrew |
Withdrawing. Go to Settings and press “Stop sharing”. It takes effect immediately — you and your designs disappear from their view at once. Withdrawing does not affect anything they saw beforehand, and it does not affect your account or your documents; future designs are simply charged at the standard price. You can also email us and we will do it for you.
Where we share with a distributor, we and that distributor are each independent controllers of the information they receive, and they are bound by our written distributor data policy, which limits what they may do with it. They may not sell it or pass it on, under any circumstances.
6. Who else processes your data
We use a small number of suppliers to run the service. They act on our instructions and may not use your data for their own purposes.
| Supplier | What they do | Where |
|---|---|---|
| Cloudflare | Hosting, the database, document storage, the bot check, and the browser that renders your PDFs | Database in Western Europe; global network |
| Stripe | Takes payment. They hold your card details, we do not | EU / US |
| Resend (using Amazon SES) | Sends the emails we send you — verification, password reset, and “your pack is ready” | EU (Ireland) / US |
| Anthropic | Researches current equipment prices for us. No customer information is sent — the request contains equipment roles such as “24-port PoE switch” and nothing else | US |
| Google Fonts | Serves the typeface used on our pages, which means Google receives the IP address of visitors | US |
Where a supplier is outside the UK, the transfer is covered by the UK International Data Transfer Addendum or the equivalent standard contractual clauses.
7. How long we keep things
| What | How long |
|---|---|
| Your account | Until you ask us to delete it |
| Generated design packs and the inputs behind them | Indefinitely, unless you ask us to delete them. This is deliberate: if your client was handed version 1 of a design three years ago, you must still be able to retrieve that exact file |
| Drafts you have not generated | Until you delete them |
| Payment records | Six years, to meet UK accounting requirements |
| Login sessions | 30 days |
| Email verification and password reset links | 24 hours and 1 hour respectively, then deleted |
| A referral invitation | Until it is used, or until you or the recipient asks us to remove it |
If you ask us to delete your account, we remove your account, your designs, your stored documents and your uploaded logo. We may keep the minimum payment records the law requires.
8. Cookies and local storage
We run no analytics, no advertising and no third-party tracking of any kind. There is nothing to opt out of. We use exactly two cookies:
| Cookie | Purpose | Life |
|---|---|---|
nd_session | Keeps you signed in. Contains a random token and nothing else | 30 days |
nd_dist | Set only if you arrive on a distributor’s link, so we know whose offer you followed. Contains that distributor’s name and nothing about you. Discarded if you never sign up through it | 90 days |
Cloudflare’s bot check sets its own cookie while it runs. Your browser also stores your in-progress project table and your place in the in-app guide, on your own device — that never reaches us.
9. Your rights
Under UK data protection law you may ask us to give you a copy of your data, correct it, delete it, send it to another provider, restrict what we do with it, or object to processing based on our legitimate interests. Where we rely on your consent — distributor sharing — you may withdraw it at any time, and withdrawing is as easy as giving it.
Email [email protected] and we will respond within one month. If you are unhappy with how we have handled it you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you gave us the chance to put it right first.
10. Security
Passwords are stored only as a salted PBKDF2-SHA256 hash — we cannot read them and neither can anyone who obtained the database. Sessions live on our server; the cookie in your browser holds only an opaque token, marked HttpOnly so scripts cannot read it. Everything travels over TLS. Access to production systems is limited to those who need it.
No system is perfect. If we ever suffer a breach that puts your rights at risk, we will tell you and the ICO without undue delay.
11. Changes
If we change this notice materially we will update the version at the top and, where the change affects something you consented to, ask you again rather than assume.