Privacy Policy - Polymath AI Inc.
Last Updated: June 18, 2026
1. INTRODUCTION
Welcome to Polymath AI. This Privacy Policy explains how Polymath AI Inc. (“Polymath,” “we,” “our,” or “us”) collects, uses, and discloses information from or about you when you access or use our website, our AI-powered design tools, and other services (collectively, the “Services”). Information from or about you is personal information.
By using our Services, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree, please do not use the Services.
This Privacy Policy covers two products. Polysync is our CAD file-conversion tool (Siemens NX to SolidWorks); it performs deterministic format conversion and does not use generative artificial intelligence. Prism is our AI assistant for CAD; it uses artificial intelligence to help you query, build, and modify models. Where this Policy describes practices that apply to only one product, we say so. The third-party providers we rely on and the periods for which we retain data are described in Sections 4 and 5 below. Polymath is the controller (and a “business” under U.S. law) of the account, billing, and usage information described below. Where we process a business customer’s Content to provide Prism, we act as a processor (a “service provider” under U.S. law) under that customer’s instructions and the data processing addendum referenced in Section 6.
Customer Data. This Privacy Policy does not govern personal information that Polymath processes on behalf of a business customer under a written agreement (“Customer Data”). The business customer’s own privacy policy governs that data, Polymath processes it only on that customer’s instructions and under the data processing addendum referenced in Section 6, and requests relating to Customer Data should be directed to that customer.
2. INFORMATION WE COLLECT
We collect information you provide directly to us, information we collect automatically, and information from other sources.
A. Information You Provide to Us
- Account Information: When you register for an account, we collect your name, email address, password, company name, and job title.
- User Content (Inputs & Outputs): We collect the information you provide when you use our Services. For Polysync, your “Inputs” are the 2D engineering drawings, CAD files, and other data you upload, and your “Outputs” are the converted files we generate. For Prism, your “Inputs” are the prompts and chat messages you submit, structured representations of the relevant geometry and feature tree that our software extracts from your open model, and screenshots of your model; your full native CAD file (for example, a .prt file) and your simulation results are not transmitted to us and remain on your machine. Your “Outputs” are the responses Prism returns and the modeling actions it performs.
- Prism Diagnostic Logs: For Prism, we also collect diagnostic logs consisting of your prompts, the AI agent’s reasoning output, and the modeling tool-calls the agent executes, which we use to operate, secure, debug, and improve the Service as described in Sections 3 and 5.
- Payment Information: We do not collect or store your full payment card details. We use a third-party payment processor (Stripe) to handle all transactions. We may receive transaction confirmations and billing details (like your name and billing address) from our processor.
- Communications: When you contact us for support, send us an email, or communicate with us in any way, we collect your name, email address, and the contents of your message.
B. Information We Collect Automatically
- Log and Usage Data: We collect standard log files when you use our Services. This includes your IP address, browser type, device information, operating system, pages viewed, and the dates/times of your requests. We use this data to operate, secure, and analyze the performance of our Services.
- Cookies and Similar Technologies: We use cookies, which are small files stored on your browser, to operate our Services. For example, we use cookies to keep you logged in (session cookies) and to understand how you interact with our Services (analytics cookies). You can instruct your browser to refuse all cookies, but some parts of our Services may not function.
3. HOW WE USE YOUR INFORMATION
We use the information we collect for the following purposes:
- To Provide and Maintain the Services: To create your account, provide you with our tools, generate Outputs, and process your payments.
- TTo Debug, Secure, and Improve the Services: To Debug, Secure, and Improve the Services: For Polysync, if a conversion fails due to unsupported features, we may temporarily retain the failed Input to debug our software and expand feature coverage. For Prism, we use the diagnostic logs described above to debug, secure, prevent abuse of, and improve the Service. We retain this data only for the periods set out in Section 5, and we do not use it to train generative AI models.
- To Improve Our AI Models (Polysync, Opt-In Only): For Prism, we do not use your Content to train or develop AI models under any circumstances. The Developer Discount, under which you may consent to let us use your Content to train our models in exchange for a discount, is offered only for Polysync. Where you participate, we use only deidentified and aggregated data, and you may withdraw from future contribution at any time in your account settings. “Deidentified” means information that cannot reasonably be used to infer information about, or be linked to, you; we maintain such information without attempting to reidentify it, publicly commit to maintain and use it only in deidentified form, and contractually require recipients to do the same.
- To Communicate With You: To respond to your support requests, send you service-related announcements (like updates to our Terms or this policy), and provide customer support.
- For Marketing: We may use your email address to send you newsletters, product updates, and other marketing communications that we believe may interest you. You can opt out of these communications at any time by clicking the "unsubscribe" link in the email.
- For Safety and Security: To monitor for and prevent fraud, debug our Services, and protect the rights and safety of Polymath, our users, and the public.
Our Legal Bases. We process your personal information only where we have a legal basis to do so: to perform our contract with you (providing and maintaining the Services and processing payments); for our legitimate interests (securing, debugging, and improving the Services, preventing fraud and abuse, and communicating with business contacts), balanced against your rights; with your consent (where we ask for it, such as for certain marketing); and to comply with our legal obligations. You may object to processing based on our legitimate interests and withdraw consent at any time.
4. HOW WE SHARE YOUR INFORMATION
We do not “sell” or “share” your personal information as those terms are defined under applicable privacy laws. We only disclose your information in the following limited circumstances:
- Service Providers: We share information with third-party vendors who help us operate our Services. These include:
- Cloud Hosting Providers such as Amazon Web Services (AWS), located in the United States.
- Payment Processors such as Stripe, to securely handle your payments.
- CAD Platforms such as Siemens NX and Dassault Systèmes SolidWorks, to render CAD models in 3D.
- AI Model Providers (Prism): To provide Prism, we transmit your prompts and the geometry and feature-tree representations and screenshots described above to third-party AI model providers that generate responses at our direction. These providers act as our service providers and processors, are contractually prohibited from using your Content to train their models, and process the data on infrastructure located in the United States. Anthropic processes under a zero-data-retention configuration; the other providers are contractually prohibited from training but may retain data transiently under their standard terms. The current providers are Google, Anthropic, and OpenAI, and we may update them from time to time; any provider we add will meet the same requirements described here, including no training on your Content, processing in the United States, and retention no longer than the periods in Section 5. If you use Prism with your own model (bring-your-own-model), your Content is not sent to any third-party model provider for reasoning. We also use a Polymath-hosted optical-character-recognition model, operated on our own infrastructure in the United States, for certain advanced workflows.
- Legal and Safety Reasons: We may disclose your information if we believe it is required to comply with a legal obligation, such as a subpoena or court order, or to protect our rights, prevent fraud, or ensure the safety of our users.
- Business Transfers: If Polymath AI Inc. is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in control.
- Business Account Administrators: If you use the Services as an employee, contractor, or other authorized user under an account established by a business customer (for example, during a company trial), that customer may access information associated with your use of the Services, including your usage data and the contents of your Inputs and Outputs, and the customer’s own privacy policy may apply to that information.
- With Your Consent: We may share your information for other purposes with your explicit consent.
By using Prism, you direct and consent to the transmission of your prompts and Content to the service providers identified above for the purpose of operating the Service.
5. DATA RETENTION AND SECURITY
A. Retention
We retain your personal information for as long as your account is active or as needed to provide you with the Services. Specific retention periods are as follows.
- After Account Deletion: If you delete your account, we will take steps to delete your personal information (like your name, email, and password) from our active systems within a reasonable timeframe.
- Polysync Conversion Data: Input and Output conversion files are stored securely (for example, via temporary presigned URLs) and are automatically deleted from our active storage within 48 hours of processing.
- Prism Content: Your prompts, chat, geometry and feature-tree representations, screenshots, and Outputs are retained for up to 30 days and then deleted.
- Prism Diagnostic Logs: The AI agent’s reasoning output and modeling tool-call logs, in pseudonymized form, are retained for up to twelve (12) months to debug, secure, prevent abuse of, and improve the Services, on the basis of our legitimate interests, and are then deleted. You may object to this use as described in Section 6.
- Deidentified and Aggregated Data: We may retain deidentified and aggregated data derived from use of the Services indefinitely, including, for Polysync Developer Discount participants, data used to improve and train our models. This data is no longer personal information, is maintained without attempting to reidentify it, and recipients are contractually bound to keep it deidentified.
- Legal Obligations: We may retain certain information for longer periods as required by law (e.g., payment records for financial and tax purposes).
B. Security
We use reasonable administrative, technical, and physical safeguards to protect your personal information, including encryption of data in transit and encryption at rest for stored data (including diagnostic logs). However, no internet transmission or method of storage is 100% secure, and we cannot guarantee its absolute security.
6. YOUR PRIVACY RIGHTS
We extend the following rights to all users, wherever you are located. Some apply only in certain places or are subject to legal limits and exceptions, but where the law gives you a right we will honor it, and we make the rights below available to everyone as a matter of practice. We will not discriminate against you for exercising them.
- Access: a copy of the personal information we hold about you, together with the categories, sources, and purposes of processing and the categories of third parties to whom we disclose it.
- Correct inaccurate personal information we hold about you.
- Delete your personal information, subject to legal exceptions.
- Portability: receive the personal information you provided to us in a portable format.
- Restrict or object to certain processing, including processing based on our legitimate interests and processing for direct marketing.
- Withdraw consent at any time where our processing is based on your consent.
- Opt out of sale or sharing: we do not sell or share your personal information, and we honor opt-out preference signals such as Global Privacy Control.
- Limit the use of sensitive information: the only sensitive personal information we collect is your account credentials (your password together with your email), which we use solely to provide the Services and not for any purpose that triggers this right.
- Non-discrimination, and, where available, the right to appeal our decision on your request or to complain to your local data protection authority or regulator.
To exercise any of these rights, email hello@polymathmade.com or submit a request through your account. We will verify your identity before responding, will respond within the time required by applicable law, and will honor a request made by an authorized agent with proof of authorization. Prism does not make decisions that produce legal or similarly significant effects about you without human involvement.
7. OTHER IMPORTANT INFORMATION
A. California Disclosures
- Do Not Sell or Share: We do not "sell" or "share" your personal information with third parties for cross-context behavioral advertising, and we honor Global Privacy Control signals.
- "Do Not Track" Signals: Our Services do not currently respond to "Do Not Track" signals from your browser.
- Notice of Financial Incentive (Developer Discount; Polysync only): The Developer Discount offers a price discount in exchange for your consent to let us use your Content to train our models. You may opt in at checkout and withdraw at any time in your settings; the material terms are presented at enrollment. We have estimated the value of the data to us by reference to the amount of the discount offered, which is a reasonable, good-faith estimate that bears a relationship to that value.
B. Children's Privacy
Our Services are not intended for or directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we learn we have collected such information, we will take steps to delete it.
C. Third-Party Links
Our Services may contain links to third-party websites. This policy does not apply to their practices. We encourage you to read their privacy policies.
D. International Data
Polymath is based in the United States and processes personal information in the United States. The Services are available to users in other countries, and if you access them from outside the United States your information will be transferred to, and processed in, the United States, including by our AI providers. Where we transfer personal information from a country whose law requires a transfer safeguard (for example, the European Economic Area, the United Kingdom, or Switzerland), we put an approved transfer mechanism in place, such as the applicable Standard Contractual Clauses and the UK Addendum, and we carry out transfer assessments where required.
E. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by a prominent notice in the Services prior to the change becoming effective, and where required we will obtain your consent.
F. AI Transparency
Prism is an artificial-intelligence system. We disclose when you are interacting with AI, consistent with applicable transparency requirements.
8. CONTACT US
If you have any questions about this Privacy Policy, please contact us at hello@polymathmade.com.
Where we are required to designate a representative for data protection matters, our representative will be identified here (for example, an EU representative and a UK representative, each to be appointed).
