Privacy Policy

In short. afdim.com is a static website served by Cloudflare. It sets no cookies of its own. It uses Cloudflare Web Analytics, which counts page views without cookies and without tracking you across other sites. Your light or dark theme choice is stored only in your own browser. Licences are sold through Paddle, the Merchant of Record: you enter payment details only in Paddle’s checkout, which loads only when you click Buy, and the Seller receives from Paddle your name, email address, country and order details, never your card details. The AFDIM plugin sends no telemetry and never uploads drawings. Its update check reveals only your IP address, the AFDIM version and the update channel. If you click Start 7-day trial, the plugin sends one-way hashes of your computer’s hardware identifiers to the trial server, which keeps a keyed hash of them without a time limit so that each computer gets one trial, and a keyed hash of your network address for at most two days so that one network cannot take many trials. To issue a licence, the Seller keeps your name, email address and order number, plus one-way hashes of your computer’s identifiers. A licence the Seller issues for a request AFDIM made can wait on the same server for that AFDIM to collect it, for at most 30 days. If you activate a licence key, the server keeps a hash of the key and a keyed hash of your computer’s hardware identifiers, so that each key runs on one computer at a time. Support messages by email or Zalo are kept to answer you. Support files are sent only if you choose to send them, and are deleted when the problem is solved. You can ask support@afdim.com at any time for a copy of your data, or to correct or delete it.

1. Who is responsible

This policy explains how personal data is handled by TÔ VĂN TÍN (TO VAN TIN), an individual resident in Vietnam who develops AFDIM under the brand AFDIM and sells it through Paddle (the “Seller”). The Seller is a natural person, not a company, and decides how the data described here is used.

The policy covers afdim.com, the AFDIM plugin for AutoCAD®, licence requests and issued licences, and support by email. It does not cover Autodesk products, which have their own privacy notices. AFDIM is independent and is not affiliated with or endorsed by Autodesk, Inc.

2. The whole inventory

Nothing else is collected. You do not need a user account.

3. The website

Visiting pages. afdim.com is a static website served by Cloudflare. To deliver and protect the site, Cloudflare processes request data such as your IP address, the page you requested, your browser’s user agent and the time of the request.

Page-view statistics. The site uses Cloudflare Web Analytics, which produces aggregated page-view statistics without cookies. It does not track you across other sites and is not used for advertising. The Seller sees totals, not a profile of any visitor.

No cookies. The site itself sets no cookies. It stores a few things on your device, and sends none of them anywhere. In your browser’s local storage: your light or dark theme choice, and which notices you closed (the language suggestion and a site notice), so that they stay closed. In the tab’s session storage, until you close the tab: after you pay in Paddle’s checkout, the order number, so that the licence page can fill it in, and, on documentation pages, which sidebar groups are open and how far the sidebar is scrolled. You can remove them by clearing this site’s data in your browser. If the site is under attack, Cloudflare may show a short verification page that sets one cookie so you are not asked again; it is not used for tracking.

Payment. Nothing from Paddle loads while you read the site. When you click a Buy button, your browser loads Paddle’s checkout (Paddle.js, from paddle.com) and opens it over the page. From then on Paddle, not the Seller, processes what you enter, and Paddle’s checkout may set cookies it needs for the payment and for fraud prevention. Section 4 describes what happens next. No card or bank details are entered on afdim.com itself.

4. Buying a licence

Licences are sold by Paddle.com Market Limited (“Paddle”), which acts as reseller and Merchant of Record. Paddle collects your payment details, billing address and the information needed for tax and fraud prevention, and processes them as a controller under its own privacy notice, at paddle.com/legal/privacy. The Seller never receives your card or bank details.

From Paddle, the Seller receives what is needed to deliver and support the licence: your name and email address, your country (and postal code where tax requires it), the order number, the plan, the amount and tax charged, and a company name and tax number if you entered them. When you ask for a refund or dispute a payment, Paddle and the Seller exchange what is needed to handle it. The Seller keeps order details with the accounting records for as long as accounting and tax law requires.

Licence delivery emails. The Seller uses Resend to send licence keys and order-related notices. Resend processes the recipient’s email address and the message content, including the licence keys, order reference and any name or order details included in the notice. These messages deliver or support your order; they are not marketing emails.

5. Licence requests and issued licences

AFDIM licences are issued for one computer at a time: by hand from a licence request, or by the licence server when you activate a licence key. When you ask for a licence, the Seller receives:

• the name to print on the licence;
• the email address to reply to;
• the Paddle order number, if you have one;
• the AFDIM version you are running;
• the time the request was made;
• one-way hashes of identifiers of your computer;
• in requests made by newer versions of AFDIM, a pickup code: a one-way hash of a random value that only the AFDIM that made the request keeps.

The hashes are calculated on your computer, and the identifiers themselves never leave it. The hashes let a licence recognize the computer it was issued for. A hash cannot be read back as the identifier, but a short identifier, such as a computer name or a short serial number, could be found again by someone who tries every possible value. A request contains no drawing content.

The licence file the Seller sends back contains the licence details and the same hashes. It is signed so that it cannot be altered.

The Seller records every issued licence in an issuance ledger, which shows who holds which licence. The Seller uses the ledger to re-issue a licence for a new computer, to renew a licence, to handle refunds and to keep accounting records.

Collecting a licence automatically. If your request carries a pickup code, the Seller may place the licence file on the licence server at api.afdim.com under that code, in addition to emailing it. While AFDIM waits for the licence it asked for, it asks that server now and then, sending the random value behind the code and the AFDIM version, and installs the licence once it is there. The server holds a placed licence for at most 30 days and records when it was first collected. Anyone who sees your request, or the pickup code in it, cannot use it to collect the licence: only the random value kept on your computer can.

Licence keys. If you buy a licence key, the Seller records on the licence server a hash of the key — not the key itself — with the name, email address and order number of your order and the plan you bought, and for a perpetual licence the end of its update period. When you enter the key in AFDIM, the plugin sends the key, the AFDIM version and the same one-way hashes and machine binding as a trial request (section 6), plus the language AFDIM shows. The server issues a licence locked to that computer and binds the key to it: it stores a keyed hash of each hardware hash, so that the key activates one computer at a time, and it records every licence it issues for the key (licence number, time, reason, AFDIM version and the licence itself). If you release the key from AFDIM to move it to another computer, the server deletes the keyed hashes of the computer that released it and records the release (licence number, time, AFDIM version and the reason you wrote for the move), so that quarterly and yearly keys can move by self-service at most twice in any 365 days, while a perpetual key can move once in total only in the first 365 days after purchase, and support can answer questions about a move. Update renewals do not restore the move or extend that window. Write the reason in a few words; it needs no personal details. These records are part of the issuance ledger.

Online update renewals. Before paying to renew a perpetual key’s updates, you enter the existing key on afdim.com. When you continue to checkout, the website sends the key over HTTPS only to api.afdim.com to verify the licence and match the payment to the right entitlement. The server stores no raw key. Paddle receives an opaque, one-use reference. The server stores a hash of that reference, the licence-key hash, payment environment, expected price, confirmation language (English or Vietnamese), creation and expiry times, and the transaction that consumes it. A reference authorizes payment for 48 hours. An unused expired reference is retained for 90 days after expiry so that a delayed payment notification can be matched to a payment made while it was valid, then deleted by scheduled cleanup. Consumed references remain with the sales ledger. The renewal ledger records the transaction, key hash, previous entitlement, extension time and refund status so that retries cannot grant twice and a refund removes only the extension it paid for. The confirmation email is sent through Resend. A transaction retry journal stores transaction references, payment environment, attempt times, retry counts, processing leases and outcomes, without a raw licence key or payer details. It lets the server retry interrupted processing without granting an entitlement twice. Renewal and retry records are retained with the sales and issuance ledgers described in section 9.

If you send a request or receive a licence through a channel other than email, such as a messaging app, that service’s own privacy terms also apply to those messages.

Email delivery status. Signed Resend delivery notifications update each order with the provider message identifier, delivery state and event times. A journal keeps the event identifier, message identifier, event type and receipt and processing times so that duplicate or out-of-order notifications are handled safely. The new delivery journal contains no recipient, subject, email body, IP address or raw licence key; the recipient is already part of the order record. These status records are retained with the sales ledger, not deleted on a separate short schedule.

6. The plugin on your computer

No telemetry. AFDIM does not report how you use it, sends no analytics and never uploads drawings.

Update checks. AFDIM checks a signed update feed at update.afdim.com with a plain HTTPS request. It checks in the background when AutoCAD starts or when you open AFDIM’s settings, and whenever you click Check now. The server sees your IP address, a user-agent that names the AFDIM version, and the update channel requested. No drawing content, no licence data and nothing about your computer is sent. The feed can also list licences that have been withdrawn, for example after a refund or a move to another computer: AFDIM compares that list with the licence on your computer and sends nothing more. You can turn off automatic checking in AFDIM’s settings. An administrator can also switch off updating when installing AFDIM.

The 7-day trial. Only when you click Start 7-day trial in AFDIM does the plugin contact the trial server at api.afdim.com. It sends one request containing: the product name; the AFDIM version; a one-way hash of each hardware identifier AFDIM can read on your computer (the system UUID, the system board serial number and the first disk’s serial number); and the machine binding written into your licence, which holds salted one-way hashes of those identifiers and of a few Windows values, such as the computer name. The identifiers themselves never leave your computer. No email address, name, drawing or file path is sent. The server answers with a trial licence locked to that computer. A computer on which AFDIM cannot read any hardware identifier sends nothing; its trial is requested by hand at afdim.com/account/.

One trial per computer. To keep that rule, the server stores a keyed hash (an HMAC, made with a secret only the server holds) of each hardware hash, together with the licence number, the AFDIM version and the date issued. This record contains no name or email address. It is kept without a time limit, because remembering which computers have had a trial is the only way to allow one per computer. The server also keeps a copy of the trial licence, so that it can send it again if the answer is lost on the way, and deletes that copy within a day after the licence expires. Your IP address reaches Cloudflare, which runs the server, and is used for about a minute to limit repeated requests. When a trial is issued, the server also records a keyed hash of the network the request came from (your IP address, or for IPv6 its first 48 bits) with the time, so that one network cannot take more than a few trials a day. The address itself is not stored, and this record is deleted within two days.

The licence server. The trial server at api.afdim.com is also the licence server described in section 5. Apart from the trial, AFDIM contacts it only while it waits for a licence it requested (at most about once an hour while AutoCAD is open, and for at most 45 days), when you activate a licence key or release it, and — from 14 days before a licence activated with a key expires until 30 days after — at most once a day, to collect a renewal. Each of these requests carries the AFDIM version and what sections 5 and 6 list — never a drawing, a file path or your Windows user name. Your IP address reaches Cloudflare, which runs the server, and is used for about a minute to limit repeated requests; it is not stored. Turning off automatic update checks does not stop these requests, because they only happen after you asked for a licence; an administrator can switch off both background checks with the environment variable AFDIM_DISABLE_BACKGROUND_SERVICES=1, and the buttons still work.

Licence terms on update. If a release changes the licence terms, AFDIM asks you to accept the new terms before that update installs. It then records on your computer which revision you accepted. Releases that do not change the terms ask for no new acceptance.

Removing AFDIM’s files. In AFDIM’s settings, the About tab lists every place where AFDIM keeps files on your computer, and deletes nothing. Uninstalling AFDIM from Windows removes the plugin and its update cache. If you tick the uninstaller’s option to delete your settings and logs, it also deletes your settings, support logs and exported support files. Your licence file is kept either way, and your drawings are never touched.

7. Support

Email and Zalo. Messages you send to support@afdim.com or to the Seller’s Zalo account (0865877769), and any attachments, are kept so the Seller can handle your support request and any follow-up. The mailbox is hosted by an email service provider acting for the Seller. Zalo is run by VNG Corporation under its own privacy terms.

Support bundle. On the About tab of AFDIM’s settings, Create support zip… shows what the zip will contain and, after you confirm, creates it on your Desktop. The zip contains:

• the AFDIM version, and the AutoCAD and Windows versions;
• AFDIM’s settings, with names taken from your drawings removed;
• AFDIM’s logs, with user-profile paths and your Windows login name removed.

It contains no drawing content and no layer names. Nothing is uploaded, and you decide whether to send the file.

Geometry export. Some problems can only be reproduced with the shapes involved. Export the last run’s geometry…, on the same tab, exports the objects you selected the last time you ran AFDIM on the open drawing, meaning their coordinates. That is design data, and it may belong to your own customer. AFDIM first tells you what it will capture and exports nothing unless you consent. A reduced option leaves out annotation text, layer names and the drawing’s file name. Nothing is uploaded, and you decide whether to send the file.

Support files you send are used only to reproduce and fix the problem. They are deleted when the problem is resolved, and in any case within 90 days.

8. Legal basis

Where the GDPR, the UK GDPR or a comparable law applies, the Seller relies on these legal bases:

• Contract. Issuing, re-issuing and renewing licences, delivering a licence to the AFDIM that asked for it, activating a licence key you bought, issuing the 7-day trial you ask for, and answering support requests.
• Legal obligation. Keeping accounting and tax records of sales, including the order records received from Paddle and the issuance ledger.
• Legitimate interests. Keeping the website and the trial server available and protected from abuse, measuring which pages are read through aggregated statistics, delivering updates, keeping a record of who holds which licence, making sure each computer receives only one free trial, and making sure each licence key runs on one computer at a time.
• Consent. Support bundles and geometry exports are created only after you agree, and sent only if you choose to send them. You can withdraw consent at any time and ask for those files to be deleted.

The Seller intends to comply with the GDPR, Vietnam’s personal data protection law and comparable laws. The Seller does not hold any privacy certification or seal, and claims none.

9. How long data is kept

• Order records: for as long as accounting and tax law requires.
• Issuance ledger: for the life of the licence, and for as long as accounting and tax records must be kept.
• Support email: for as long as needed to handle your request and any follow-up about the same licence.
• Support bundles and geometry exports: deleted when the problem is resolved, and in any case within 90 days.
• Trial records: without a time limit, because one trial per computer can only be enforced by remembering which computers have had one. A trial record contains no name or email address. The stored copy of a trial licence is deleted within a day after the licence expires.
• Trial network counts: deleted within two days.
• Licences placed for collection: deleted 30 days after they were placed, whether collected or not.
• Licence key records: for the life of the licence, and for as long as accounting and tax records must be kept, like the issuance ledger. The keyed hashes of the activated computer are deleted when you release the key, and replaced when the key moves to another computer.
• Website request data: processed by Cloudflare under its own retention rules. The Seller uses only aggregated statistics.

If you ask for your data to be deleted, the Seller will delete it, except for records the law requires the Seller to keep.

10. Who data is shared with

Data is shared only with:

• Cloudflare, which delivers and protects the website, provides the aggregated page statistics, and runs the trial and licence server and its database.
• Paddle, which sells the licences as Merchant of Record: the Seller shares with Paddle only what a refund, a dispute or a tax question about your order needs.
• Resend, which sends licence keys and order-related emails on the Seller’s behalf and processes the email address and message content for delivery.
• The Seller’s email service provider, which hosts the support mailbox, and Zalo (VNG Corporation), if you choose to message the Seller there.

Personal data is not sold, not rented, not shared with advertisers or data brokers, and not used to train AI models. It is disclosed to anyone else only where the law requires it, or to establish or defend a legal claim.

11. International transfers

The Seller is in Vietnam, so data you send to the Seller is processed in Vietnam. Cloudflare and Paddle operate internationally and may process data in other countries; Paddle is based in the United Kingdom. Resend stores email content and delivery logs in the United States, including when a different sending region is selected. Its data-processing terms are available at resend.com/legal/dpa. If the law that protects your data requires a safeguard for such a transfer, the Seller relies on the safeguard that law provides. Ask, and you will be told which safeguard applies.

12. Your rights

Depending on where you live, you may have the right to:

• Access: get a copy of the personal data held about you.
• Correction: have inaccurate data fixed.
• Deletion: have data erased, except records the law requires the Seller to keep.
• Portability: receive the data you provided in a machine-readable form.
• Objection: object to processing based on legitimate interests.
• Restriction: ask for processing to be paused while a dispute is resolved.
• Withdrawing consent: where processing is based on consent.
• Complaint: if you think your data has been misused, write to support@afdim.com first. A complaint about your personal data is confirmed within 1 business day and answered within 7 business days, as section 16 of the Terms of Service describes. You can also complain to the data protection authority where you live; in Vietnam that is the Ministry of Public Security.

To use any of these rights, email support@afdim.com from the address concerned. To confirm that the request comes from you, the Seller may ask you to reply from the email address on the licence or to give your order number. Identity documents are never requested. Requests are acknowledged within 1 business day — Monday to Friday, excluding Vietnamese public holidays, ICT (UTC+7), as the Terms of Service define it — and handled within the specific deadlines below.

If you still use a licence, deleting its ledger entry would make it impossible to re-issue or renew that licence. The Seller will tell you this before acting.

13. Security

Everything is served over HTTPS. Card details are entered only in Paddle’s checkout; the Seller never receives them. A licence request carries one-way hashes, never your computer’s actual identifiers. The licence server stores a hash of each licence key, never the key itself. The strongest protection is to collect little, which is why the inventory above is short. No system is perfectly secure.

14. Children

AFDIM is a professional CAD tool. Neither the website nor the software is aimed at children, and the Seller does not knowingly collect personal data from anyone under 16. If you believe a child has sent personal data, write to support@afdim.com and it will be deleted.

15. Changes to this policy

This policy changes when the website or AFDIM changes, and this page shows its revision number and the date it came into force. If a change materially affects how your data is used, this page will say so openly.

16. Contact

Send questions about this policy, and any request about your data, to one place:

• Email: support@afdim.com
• Reply: within 1 business day, ICT (UTC+7)
• Phone and Zalo (in Vietnamese, 8:00 to 17:00 ICT on business days): 0865877769
• Seller: TÔ VĂN TÍN (TO VAN TIN), trading as AFDIM
• Postal address for formal notices: Đông Môn Residential Group, Hòa Bình Ward, Hải Phòng City, Vietnam (postal code 04308). Formal notices may also be sent by email to support@afdim.com.

Rights deadlines in Vietnam

Under Article 5 of Decree 356/2025/ND-CP, procedural responses are provided within 2 business days (the 1-business-day acknowledgement commitment remains); access, correction or provision is performed within 10 days; withdrawal, restriction or objection within 15 days; deletion within 20 days. Processor or third-party involvement and extensions follow the specific deadlines, conditions and notice requirements of Article 5; one month is not a blanket deadline. Mandatory rights and exceptions under other applicable law remain unaffected. Hashes are not automatically anonymous: if linkable to an individual, they are protected as personal data. Anti-abuse retention requires a lawful basis, necessity reviews and lawful handling of deletion requests, rather than refusal solely because trials are limited to one per machine.