Privacy Policy
Last updated 27 October 2026
1. Who we are
PSPF Services Ltd, a company registered in Cyprus, is the data controller for the personal data described here. We operate the website and application at powertopology.com.
You can reach us about anything in this policy at info@powertopology.com.
2. The short version
PowerTopology is a drawing tool that runs in your browser. The drawings you make never leave your computer unless you choose to export or send them yourself. We do not use analytics, we do not use advertising, we do not track you between sites, and we do not sell or share personal data with anyone for their own purposes.
The only personal data we hold is what an account needs: your email address, which plan you are on, and an identifier that lets our payment provider recognise you. If you sign in with Google we also receive your name and profile picture. If you ask to be told when a paid plan or a new feature is ready, we hold the email address you gave us for that. If you never create an account and never join a waiting list, we hold nothing about you at all.
3. Your drawings
Single-line diagrams, equipment registers, cable schedules and everything else you draw or import are stored in your own browser, using its local storage. They are not uploaded to us and we have no technical means of reading them.
When you export a drawing — as a file, an image, a PDF or a self-contained viewer page — that file is produced inside your browser and saved to your computer. Where you send it afterwards is your decision and outside our control.
This also means we cannot recover a drawing for you. Clearing your browser's data, using a private window, or switching computer will lose anything you have not exported. The application says so where it matters, and exporting is the backup.
4. What we collect
| What | When | Where it is held |
|---|---|---|
| Email address | When you create an account | Supabase |
| Account identifier, sign-in timestamps, and the tokens that keep you signed in | When you sign in | Supabase, and your browser |
| Your name and profile picture, if you sign in with Google | When you sign in with Google | Supabase |
| Email address and the feature you were looking at, if you join a waiting list ("tell me when Pro is ready", cloud projects and Team) | When you submit the form | Supabase, and your browser (so the form can remember the address) |
| Your plan (free, Pro or Team) | When you subscribe or cancel | Supabase |
| A customer reference from our payment provider | When you first pay | Supabase and Stripe |
| Name, billing address, VAT number and card details | At checkout | Stripe only — these are entered on Stripe's page and never reach us |
| Server request logs, including IP address | Whenever a page is served | Cloudflare |
Signing in with Google
If you choose "Continue with Google", Google tells us your email address, your name, your profile picture and your Google account identifier. These are the three basic sign-in permissions (openid, email and profile) and nothing more. We do not receive your Google password, and we do not access your Gmail, Drive, contacts, calendar or any other Google service.
We use this information only to create your account, sign you in and, if you buy a plan, to match your account to it. We do not use it for advertising, we do not sell it, and we do not transfer it to anyone except the processors listed in section 6, only to provide the service. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. You can remove PowerTopology's access at any time in your Google Account settings, and ask us to delete the account data as described in section 10.
We do not collect: analytics, usage statistics, session recordings, device fingerprints, advertising identifiers, or the contents of your drawings. There are no third-party scripts on our pages. Fonts are served from our own domain, so loading a page does not tell anybody else that you visited.
5. Why, and on what basis
| Purpose | Data | Lawful basis (UK/EU GDPR Art. 6) |
|---|---|---|
| Letting you sign in and keeping you signed in | Email, account identifier, tokens | Performance of a contract |
| Giving you the plan you paid for | Plan, customer reference | Performance of a contract |
| Taking payment and issuing invoices | Billing details held by Stripe | Performance of a contract; legal obligation for tax records |
| Keeping the service up and stopping abuse | Server logs | Legitimate interests — running a service that works and is not attacked |
| Telling you when a plan or feature you asked about is ready | Email, and the feature you were looking at | Consent, which you give by submitting the form |
| Answering you when you write to us | Whatever is in your message | Legitimate interests — replying to the person who contacted us |
Apart from the waiting lists, we do not rely on consent, because none of the rest is optional to the service you asked for. A waiting list is the one thing you choose to join. You can withdraw at any time by writing to us, and we will remove you. There is no cookie banner, because we set no cookies that would need one.
6. Who else sees it
The companies below process data on our behalf. Each is bound by a data processing agreement and may only act on our instructions.
| Who | What they do | What they hold |
|---|---|---|
| Supabase | Accounts and the database behind them | Email, name and picture (Google sign-in), account identifier, plan, customer reference, waiting-list emails |
| Stripe | Payments, invoices and the billing portal | Name, email, billing address, VAT number, card details, payment history |
| Cloudflare | Serving the site and running the small API behind it | Request logs, including IP address |
We also use Resend to send the sign-in link to your address, and to send the one message a waiting list promises. Beyond these, nobody. We do not sell personal data, we do not share it for anybody else's marketing, and we have no advertising partners.
We may disclose data if the law requires it, or to establish or defend a legal claim. If that ever happens we will tell you, unless we are forbidden from doing so.
7. Storage in your browser
We do not set tracking cookies. The application uses your browser's local storage for things that have to survive closing the tab:
- Your drawings and settings — the sheet you are working on, your theme, paper and preferences.
- Your sign-in tokens, if you have an account, so you are not asked to sign in on every visit.
- The email address you gave a waiting list, so the form does not ask for it twice.
- Which plan you are on, so the application still works correctly for a short period when you have no network connection.
All of it stays on your device. Clearing your browser's site data removes every bit of it, which also signs you out and deletes any drawing you have not exported.
A service worker caches the application's own files so it keeps working offline. It caches program files, not your data, and never contacts anybody else.
8. How long we keep it
- Account data — while your account exists, and for 30 days after you ask us to delete it, so an accidental deletion can be undone.
- Waiting-list emails — until we have sent the message you asked for, and no longer than 24 months, or sooner if you ask us to remove you.
- Invoices, payment records and other financial documents — for a minimum of 6 years from the end of the relevant tax year, to comply with Cypriot statutory tax obligations. We cannot delete these on request, because we are required to keep them. They are stored securely, in physical form or as encrypted electronic files, and only authorised financial and administrative personnel can access them. When the required period has ended and any pending tax assessments or inquiries are resolved, the data is permanently and securely deleted or destroyed.
- Server logs — for the period Cloudflare retains them under our plan, which is a matter of days rather than months.
9. Transfers outside the EEA
Our database is hosted in Frankfurt, Germany (AWS eu-central-1). Stripe and Cloudflare are United States companies that operate globally, so some data reaches the United States. Those transfers are covered by the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
10. Your rights
Under the GDPR you may ask us to: give you a copy of your personal data; correct it if it is wrong; delete it; restrict what we do with it; hand it to you or another provider in a portable form; or object to processing we base on legitimate interests.
Write to info@powertopology.com and we will answer within one month. We will not charge you and we will not make the service worse for you because you asked.
Two honest notes. Deleting your account does not delete your drawings — they are on your computer and only you can remove them. And we cannot delete invoices we are required by law to keep.
If you think we have handled your data badly you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy), or to the authority where you live. We would rather you told us first, but it is your right either way.
11. Security
Everything travels over HTTPS. Sign-in is by a one-time link or by Google, so there is no password of yours for us to store or lose. Access to the database is restricted at the row level, so one account cannot read another's. Card details never touch our servers. Nobody can promise perfect security, and we do not; if a breach ever affects your rights we will tell you and the regulator within the time the law allows.
12. Children
This is a tool for electrical engineers. It is not directed at children and we do not knowingly collect data from anyone under 16.
13. Changes
If we change this policy we will update the date at the top. If a change materially affects you — new purposes, new processors, data going somewhere new — we will email account holders before it takes effect.
14. Contact
PSPF Services Ltd
info@powertopology.com