Legal
Privacy policy
Last updated: 2026
Data controller
The data controller is sketchstack SARL, established in Morocco. For any privacy request, write to hello@sketchstack.online.
Scope and applicable law
This policy is governed primarily by Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data. The competent supervisory authority is the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel). Because international and EU users may use the service, we also honor GDPR-style rights (access, rectification, erasure, portability, objection) regardless of your location.
Data we process
| Data | Purpose | Legal basis |
|---|---|---|
| Account email and password hash | Authenticate access to your workspace | Performance of contract |
| Uploaded sketch images | Generate diagrams, component graphs, Terraform and ADR drafts | Performance of contract |
| Generated specs and history | Deliver and store the results you asked for | Performance of contract |
| Billing details (via payment provider) | Process paid subscriptions | Performance of contract / legal obligation |
| Support messages | Answer your questions | Legitimate interest |
| Essential cookies | Session, security, language | Legitimate interest |
| Preferences and analytics cookies (with consent) | Remember choices and improve the product | Consent |
Retention
| Category | Retention |
|---|---|
| Account data | For the life of the account, then deleted within 30 days of closure |
| Uploaded sketches | For the life of the account or until you delete them |
| Generated specs | For the life of the account or until you delete them |
| Billing records | As required by Moroccan accounting and tax law |
| Support messages | Up to 24 months |
| Analytics data | Up to 14 months |
Your rights
You have the right to access, rectify, delete, and port your personal data, to object to processing, and to withdraw consent at any time. To exercise a right, write to hello@sketchstack.online. You may also lodge a complaint with the CNDP (cndp.ma) or, if you are in the EU, with your local data protection authority.
Subprocessors
We rely on managed cloud infrastructure and standard operational tools (hosting, email, payments). A list of subprocessors is available on request at hello@sketchstack.online.
Security
Data is transmitted over TLS. Passwords are salted and hashed. Access to production data is restricted and logged. No system is perfectly secure; we work to reduce risk continuously.
Children
Sketchstack is not intended for children under 16. Do not create an account if you are under 16.
Changes
We will update this policy as the product evolves. Material changes will be announced by email or in-product.