Privacy Policy

This policy explains how Bimvue ("we", "us") collects, uses, shares, and protects your information when you use bimvue.com and related services.

Bimvue is designed for construction and engineering teams to view and manage BIM/IFC models. We take data protection seriously and design our systems to minimise the personal data we handle.

Account information: When you create an account, we collect your name, email address, password (hashed), and the organisation you belong to. Paid subscriptions add billing information handled by our payment processor (Stripe).

Model data: IFC files you upload, together with data extracted from them (geometry, element properties, spatial structure, georeference coordinates) and any custom attributes you attach to elements.

Usage data: If you consent to analytics cookies, we collect anonymised information about how you use the site (pages visited, features used, session duration). See section 5.

Log data: Our servers automatically record technical information such as IP address, browser type, operating system, request timestamps, and any errors returned. This is used for security, debugging, and abuse prevention.

Communications: Content of messages you send us through the contact form or by email.

We process your information for the following purposes, on the corresponding legal bases (GDPR Article 6):

• Providing the service — account creation, model processing, viewer, custom attributes, team collaboration. Legal basis: performance of contract.
• Billing — processing payments, managing subscriptions, sending invoices. Legal basis: performance of contract and legal obligation (tax records).
• Service communications — technical notices, security alerts, product updates. Legal basis: legitimate interest.
• Support — responding to your questions and requests. Legal basis: legitimate interest.
• Analytics — understanding how visitors use the site to improve it. Legal basis: consent (via the cookie banner).
• Security — detecting fraud, abuse, technical failures. Legal basis: legitimate interest.
• Legal compliance — responding to lawful requests, keeping records. Legal basis: legal obligation.

We use the following third-party services (sub-processors) to operate Bimvue. Each processes only the data required for its specific function.

We also notify search engines (Bing, Yandex, Seznam, Naver) about public marketing pages via the IndexNow protocol. This only transmits URLs of public pages; no personal data is involved.

We do not sell your personal information or model data. We may share information beyond this list only when required by law, legal process, or a government request; or in connection with a merger, acquisition, or sale of assets (in which case you will be notified).

We use two categories of cookies:

• Essential cookies (always active) — session, authentication, and CSRF protection. Required for the site to work and exempt from consent requirements under PECR and GDPR.
• Analytics cookies (opt-in) — set by Google Analytics 4 and Microsoft Clarity (see section 4) after you accept via the cookie banner. Used to understand aggregated usage and improve the site.

You can change your cookie preferences at any time by clicking "Cookie settings" in the site footer. Withdrawing consent stops future analytics tracking; historic data already collected is retained per the retention policy in section 8.

Your data is stored on servers with full-disk encryption. All data in transit is encrypted via HTTPS (TLS 1.2+). Internal services (database, cache, queue) are restricted to localhost — not accessible from the public internet.

We use role-based access control and PostgreSQL row-level security to enforce strict tenant isolation. Your organisation's data is never accessible to other organisations through the application.

Passwords are hashed using bcrypt. Payment card details never touch our servers — they are collected and stored by Stripe under PCI-DSS compliance.

Bimvue's infrastructure and most sub-processors are located in the United States (see section 4). When you use the service from the European Union, United Kingdom, Switzerland, or another jurisdiction, your data may be transferred to and processed in the US.

These transfers are covered by the sub-processors' contractual safeguards, which include the European Commission's Standard Contractual Clauses (SCCs) where applicable. You can review each sub-processor's transfer mechanisms on their linked privacy policies in section 4.

Under GDPR, UK GDPR, Swiss FADP, and similar laws, you have the right to:

• Access — obtain a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete information
• Erasure — request deletion of your account and associated data ("right to be forgotten")
• Portability — receive your data in a structured, machine-readable format
• Restriction — request that we stop processing your data in certain circumstances
• Objection — object to processing based on legitimate interests
• Withdraw consent — withdraw analytics consent at any time via "Cookie settings" in the footer
• Complain to a supervisory authority — such as your national data protection authority

To exercise any of these rights, contact us. We will respond within 30 days.

Deleting your organisation account will cascade-delete all associated data — projects, models, custom attributes, and audit logs — within 30 days.

We retain your data for as long as your account is active. If you close your account, we delete your data within 30 days, with the following exceptions:

• Backups — encrypted backups may retain data for up to 90 days after deletion, after which they are permanently overwritten.
• Billing records — Stripe retains payment records for the period required by tax and accounting law (typically 7-10 years depending on jurisdiction).
• Log data — server logs are retained for up to 90 days for security and debugging.
• Analytics data — Google Analytics retention is set to 14 months. Microsoft Clarity session recordings are retained for 30 days.

If you are an organisation that requires a Data Processing Agreement under GDPR Article 28 (or equivalent under UK GDPR / Swiss FADP), please contact us to request one. We can provide a signed DPA reflecting the sub-processors and safeguards described in this policy.

Bimvue is not intended for individuals under 16 years of age, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete the information.

We may update this policy to reflect changes in our services, legal requirements, or sub-processors. Material changes will be communicated by email or by a notice on the site at least 30 days before they take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

For questions, data-subject requests, or DPA requests, please contact us.