In short
Two things leave your office when an image model is involved: the plan page and the view from the model. Four questions decide whether that is acceptable — is training excluded, how long is content stored, where is it processed, and is there a data processing agreement. Paid interfaces of the large providers exclude training on submitted content; the free tiers frequently do not.
Which data moves
The plan page
Often carries more than needed: client name, address, file number. Crop it before uploading.
The model view
An untextured image of your volume. Geometry, no names.
Project data
Title, address, coordinates, share links. These stay in the software.
Four questions for any provider
Training
Is submitted content used for training? With paid interfaces the answer is normally no, in writing.
Retention
How long do inputs stay on the provider’s servers? A few weeks for abuse detection is common.
Location
Where is processing done? Transfers to the US need a legal basis; in practice the EU-US Data Privacy Framework adequacy decision.
Contract
Is there a processing agreement under Article 28 GDPR, including the list of sub-processors?
Checklist before uploading
Cover the title block or crop the page to the plan. Upload only the page you need. Choose project names without client names when confidentiality is high.
Withdraw share links when a project ends, and mention in your own proposal that external services are used.
Questions and answers
Is a floor plan personal data?
The drawing itself usually is not. Personal data enters through title blocks, addresses and contact details — cropping avoids it.
Are my plans used for training?
Not on the paid interface we use: the provider excludes training on submitted content.
Do I need a processing agreement?
As soon as personal data is processed, yes. Ask for it; serious providers have one ready.
What about competitions?
Briefs often contain confidentiality clauses stricter than data protection law. Check whether external services are permitted at all.
Sources
- Regulation (EU) 2016/679 (GDPR), Article 28
- European Commission: EU-US Data Privacy Framework adequacy decision
This article also exists in German: read the German version.



