Privacy policy
Last updated 24 October 2026
This policy explains what personal data Dovetail collects, why, who helps us process it, how long we keep it, and the rights you have. It covers the website at dovetailmakers.com, the early-access list, the Dovetail apps and web portals, and the services behind them.
Dovetail is in beta. Payments are not switched on yet. When that changes, or when we add a new service provider, we will update this policy first.
1. Who is responsible
Dovetail is run by DovetailMakers ApS (CVR 35233741), Denmark, which is the data controller.
Contact for anything in this policy, including requests to use your rights: [email protected]. We have not appointed a data protection officer; we are not required to at our size.
2. What we collect and why
| What | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Early-access list: your email address, and optionally whether you are a customer, maker or designer; the page language and where you signed up; which version of the sign-up notice you saw; when you signed up; whether our confirmation email was sent. | To tell you about the beta and the launch. We send one confirmation email when you sign up, with a link to unsubscribe. | Consent (6(1)(a)). You can withdraw it at any time with the unsubscribe link, which deletes your address. |
| Account: email address, name, profile image if you add one, your role(s), your sign-in method (password hash, passkey, or one-time code/link), and sign-in sessions including IP address and browser/device type. | To give you an account and keep it secure. | Contract (6(1)(b)); legitimate interest in security (6(1)(f)). |
| Designs: what you ask the design assistant for, the conversation with it, the designs and 3D models it produces, files you import, and your saved designs and favourites. | To design furniture with you and keep your work. | Contract (6(1)(b)). |
| Photos of your space: up to three photos you choose to attach to a design. We re-encode them and strip metadata such as location. | Shown to the design assistant as context. Shared with makers only if you switch that on for a quote request. | Contract (6(1)(b)), at your request. |
| Quote requests and quotes: the design and version, your notes, the makers you asked, their quotes and your replies, and messages between you. | To get you quotes from makers and let you talk to them. | Contract (6(1)(b)). |
| Location: an address or place you type in to find makers near you, and, if you give none, an approximate (city-level) location looked up from your IP address in our own copy of the DB-IP database. Your IP address is not sent to anyone for this. | To show makers and designs near you. | Contract (6(1)(b)); legitimate interest (6(1)(f)) for the IP-based fallback. |
| Makers: company name, CVR, contact details, workshop location, capabilities, and the people who manage the account. | To list the workshop and send it quote requests. | Contract (6(1)(b)); legitimate interest (6(1)(f)) for publicly listed business details. |
| Technical logs: IP address, request details and errors in server logs, and records of design-assistant runs (prompt, result, cost). | To run the service, fix faults, prevent abuse and control costs. | Legitimate interest (6(1)(f)). |
IP geolocation by DB-IP, used under the Creative Commons Attribution 4.0 licence.
We do not sell personal data, show advertising, or use analytics or tracking tools. We do not make decisions about you by automated means that have legal or similarly significant effects.
3. Who processes it for us
These service providers process personal data on our behalf, under data processing terms, and only to provide their service to us:
| Provider | What they do | Where |
|---|---|---|
| Hetzner Online GmbH | Servers that run Dovetail and its database, and the file storage for designs, models and photos. | Germany (EU) |
| Cloudflare, Inc. | DNS and network delivery for dovetailmakers.com (it sees visitors’ IP addresses), and sending our emails (it sees the address and the message). | Global network; USA-based company |
| Anthropic, PBC | The AI models behind the design assistant. It receives what you ask the assistant, the conversation, rendered views of the design, and any space photos you attach. | USA |
| Serves the fonts on dovetailmakers.com and the creators portal, so your browser sends your IP address to Google when a page loads. | USA-based company | |
| Danish Agency for Climate Data (DAWA) and OpenStreetMap Foundation (Nominatim) | Turn an address or place you type into map coordinates. They receive the text you typed, not who you are. | Denmark (EU); United Kingdom |
| Expo (650 Industries, Inc.) | Delivers updates to the Dovetail mobile app, so it sees the app’s IP address when it checks for one. | USA |
Apple and Google distribute the mobile app through their app stores under their own privacy policies.
Where a provider is outside the EU/EEA, or may access data from outside it, the transfer relies on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses (GDPR Chapter V). The United Kingdom has an EU adequacy decision. Ask us for details of the safeguard for a particular provider.
We also share data with other users when you ask us to: a quote request goes to the makers you choose (with your photos only if you allow it), and a maker’s quote goes to you.
4. How long we keep it
- Early-access list: until you unsubscribe or ask us to delete it. We delete waitlist signups no later than 12 months after public launch, or sooner if you unsubscribe.
- Account, designs, photos, quote requests and messages: while you have an account. Photos are deleted with their design; you can also delete a design, or withdraw shared photos from a quote request, yourself. When you ask us to close your account we delete or anonymise your data, except what we must keep by law.
- Accounting records (once payments are switched on): 5 years from the end of the financial year, as the Danish Bookkeeping Act (bogføringsloven) requires.
- Server logs and design-assistant run records: 30 days.
5. Your rights
Under the GDPR you have the right to:
- get a copy of your personal data (access), and receive it in a machine-readable format (portability);
- have inaccurate data corrected;
- have your data deleted (erasure);
- have processing restricted;
- object to processing based on our legitimate interests;
- withdraw consent at any time, without affecting processing before you withdrew. For the early-access list, the unsubscribe link in our email does this and deletes your address.
To use any of these rights, email [email protected]. We answer within one month, free of charge. We may ask you to confirm your identity first, for example by replying from the email address on your account.
6. Complaints
If you think we are handling your data unlawfully, please tell us first so we can put it right. You can also complain to the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, [email protected], datatilsynet.dk, or to the data protection authority where you live or work.
7. Cookies
dovetailmakers.com sets no cookies. The Dovetail apps and portals use only the cookies and local storage needed to keep you signed in and remember your settings. We use no analytics, advertising or tracking cookies.
8. Security
Data is encrypted in transit, passwords are stored only as hashes, access to production systems is limited to the people who run Dovetail, and photos and design files are stored privately. If a breach puts your rights at risk, we will tell Datatilsynet and, where required, you.
9. Children
Dovetail is for adults. It is not meant for children under 18, and we do not knowingly collect their data.
10. Changes
We will update this page when what we do changes, and change the date at the top. If a change affects something you consented to, we will ask you again.