Privacy policy.

1. Scope and our privacy roles

This Privacy Policy applies to BIMRelay websites, applications, communications, and related services operated by Sabrene Software LLC ("Sabrene," "we," "us," or "our"). It covers our handling of information, including when we use service providers. Autodesk, Stripe, and other third parties may also process information for their own purposes under their own privacy policies.

For account, billing, website, security, and direct marketing information, Sabrene determines why and how the information is processed. For model, workbook, project-member, and other content submitted by a customer organization ("Customer Data"), Sabrene generally processes the information on that organization's behalf. If your information appears in Customer Data, direct your request to the organization that controls the relevant workspace. We will assist that organization as required by applicable law or a written agreement.

2. Information we collect

Information you provide

• Account and profile information: name, work email, company, phone number, optional profile image, password credentials, and account preferences. We also record the Terms version accepted and the time of acceptance when you sign up.
• Workspace information: workspace and project names, invitations, memberships, roles, administrative settings, and contact details.
• Customer Data: model files and data, workbook content, collaboration records, settings, and exported or published files.
• Communications: support messages, feedback, website inquiries, surveys, and marketing preferences.
• Billing information: billing contact details, business tax IDs when provided, subscription plan, project quantity, transaction status, invoices, and related records. Stripe processes card and bank-account payment details. We do not store complete card numbers, security codes, or bank-account numbers.

Information received from Autodesk

When you connect Autodesk Platform Services or Forma, we receive authorization credentials and information available through the permissions you grant. This includes your Autodesk identity, accessible projects and files, model versions and relationships, and model data needed to generate and maintain the workbook.

We use those permissions to let you browse resources and process or publish the models and files you select. Connection permissions may extend beyond those selections. Disconnecting a connection stops its access; it does not delete information already held in BIMRelay or revoke separate workspace connections. Our Security page explains connection safeguards.

Information collected automatically

• Request and device data: IP address, browser or device information supplied with a request, requested URLs, referring pages when supplied, and timestamps in application or hosting logs.
• Operational logs: authentication events, API requests, model processing and export status, errors, performance measurements, and security signals.
• Collaboration activity: cell edits, configuration changes, comments, mentions, active edit sessions, and audit events associated with an account.
• Cookies and local storage: identifiers and preferences needed for authentication, security, navigation, and remembered views.
• Ad attribution: if you sign up after following one of our ads, the advertising platform (Google or Microsoft), ad campaign, search term, and ad click identifier carried in the link, and which of our ad pages you started from. We keep these with the new account and do not share them with advertising services.

3. How we use information

We use personal information and Customer Data to:

• create accounts, authenticate users, and administer workspaces, projects, roles, and invitations;
• process the Revit models you upload, or the host models, links, versions, and metadata you select from connected Autodesk services;
• generate, validate, update, collaborate on, export, and publish COBie workbooks;
• preserve supported edits, maintain history, show activity, and coordinate concurrent editing;
• process subscriptions, enforce plan limits, prevent abuse, and maintain billing records;
• provide support, send service notices, respond to requests, and communicate product updates;
• monitor reliability, diagnose errors, secure the Service, and prevent fraud or unauthorized access;
• use operational logs and aggregated information to understand reliability, feature use, and performance and to improve BIMRelay;
• measure which of our ads lead to accounts, activation, and purchases;
• respond to website inquiries and send marketing communications where permitted, subject to your preferences; and
• comply with law, enforce agreements, and protect users, Sabrene, and third parties.

We use third-party artificial intelligence services, including OpenAI, to help process project information and improve workbook content and recommendations. Relevant project data may be shared with these providers to deliver these features.

We do not sell Customer Data or use model data, workbook values, comments, or project files to train general-purpose artificial intelligence models. We also do not permit our artificial intelligence providers to use that content to train their models. We may use aggregated or de-identified information that cannot reasonably identify an individual, customer, or specific project. We maintain that information in de-identified form and do not attempt to re-identify it except to test our de-identification safeguards.

Where applicable law requires a legal basis, our purposes and bases are described below. When we process Customer Data on an organization's behalf, that organization determines its own legal basis and our Data Processing Addendum governs our processing.

• Accounts, service delivery, and support: performing a contract with you, or our legitimate interests in providing and administering the service contracted by your organization and responding to requests.
• Security, reliability, and improvement: our legitimate interests in protecting users and data, preventing abuse, maintaining a reliable service, and improving its functionality, balanced against individuals' rights.
• Billing and business records: performing a contract, our legitimate interests in administering business relationships and resolving claims, and compliance with applicable tax, accounting, and other legal obligations.
• Marketing and optional analytics: consent where required, or legitimate interests in communicating relevant business information where permitted. Cookie choices and marketing permissions are separate from accepting the Terms.

Certain account, authorization, and billing details are needed to provide requested features or comply with law; without them, we may be unable to create an account, connect a model, provide support, or complete a purchase. Optional profile details and optional marketing are not required to use the Service. You may withdraw consent for future processing without affecting prior lawful processing.

4. How we disclose information

We disclose information only as needed for the purposes described in this policy:

• Within a workspace: authorized members can see project content, collaborator identity, edits, comments, mentions, presence, and activity according to their role.
• Service providers: hosting, database, object storage, security, email, support, monitoring, and infrastructure providers process information as needed to provide their services to us, subject to applicable confidentiality and data-protection obligations.
• Stripe and Link: Stripe processes payments, subscriptions, invoices, bank-account verification, and billing management. Link may be offered as an optional payment method. Their own terms and privacy practices apply to their independent processing.
• Autodesk: we exchange authorization, model, project, and publication data with Autodesk at your direction.
• OpenAI: OpenAI processes relevant project information to provide AI-assisted features.
• Other providers: Cloudinary hosts optional profile images. Resend delivers account and service emails. Cloudflare Turnstile screens support messages from website visitors who are not signed in, to block automated abuse. Google Analytics measures website and app use, and Google Ads receives those measurements for our ads, as described below.
• Legal and safety matters: we may disclose information to comply with law or lawful process, or as reasonably necessary to investigate abuse, enforce agreements, or protect rights and safety, consistent with applicable law and our confidentiality commitments. We limit disclosure to the information needed for that purpose.
• Business transactions: information may be transferred as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of the business, subject to appropriate confidentiality protections.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising or use it for profiling that produces legal or similarly significant effects.

Our provider list describes the providers used for Customer Data and other service functions. Subprocessor authorization and change notices are governed by our Data Processing Addendum. Contact us for the processing locations and contractual details relevant to your use of BIMRelay.

5. Cookies and analytics

We use essential cookies and browser storage for sign-in, security, session continuity, preferences, and core features. Application and hosting logs also help us operate and secure the Service.

With your permission, we use Google Analytics on the public BIMRelay website and in the application to understand visits, feature use, account registrations, exports, and purchases, including transaction information. We do not send Google Analytics your email address, project or model names, workbook contents, or authentication tokens.

Our Google Analytics account is linked to our Google Ads account, so these measurements, such as account registrations, show which of our ads lead to accounts. This measures our own advertising; it does not personalize ads or build advertising profiles.

You can accept or decline optional analytics in the cookie banner and change your choice anytime in Cookie settings. Your choice applies to both the website and the app. Neither loads Google Analytics before acceptance. Declining or withdrawing permission stops optional analytics measurements. Advertising storage and personalization stay off.

Global Privacy Control keeps optional analytics off on both the website and the app. We do not change our processing in response to Do Not Track signals.

6. Retention and deletion

Retention depends on the type of information, the status of the relevant workspace or project, any agreed retention requirements, and applicable law. Cancelling a subscription, archiving a project, disconnecting Autodesk, and requesting deletion have different effects.

• Active and archived projects: we retain account, project, model, workbook, and collaboration information to provide the Service. Archiving makes a project read-only; it does not request deletion. Cancelling billing does not by itself delete retained projects.
• Project deletion: a deleted project becomes inaccessible immediately. Remaining project data and files are scheduled for permanent deletion after a 30-day grace period, subject to legal retention obligations.
• Workspace deletion and recovery: deleting a workspace removes access to its projects. File cleanup follows the project-deletion schedule. Restoration is not guaranteed.
• Account closure: contact us to request closure or deletion of your account. Closing an individual account does not automatically delete an organization's workspaces or shared records that other users depend on. We assess those records according to the customer's instructions, applicable law, and our obligations.
• AI processing: recommendations are kept as project content. Temporary review files held by BIMRelay are scheduled for cleanup after seven days, once processing has finished. OpenAI separately retains abuse-monitoring logs, which may include inputs and outputs, for up to 30 days, or longer where required by law or to prevent harm (see OpenAI's data controls).
• Separate business records: billing, tax, Terms-acceptance, security, audit, and dispute records may be retained for legal obligations or a documented business need. We limit retained information to what is needed for that purpose.
• Email opt-outs: we retain a minimal email suppression record after account closure to respect an unsubscribe request and prevent optional emails from restarting automatically. You may contact us to change that choice.
• Backups: deleted data can remain in database backups until they expire on a rolling schedule of about 30 days. Backups are used only for recovery, security, or legal obligations.

Deleting data in BIMRelay does not delete your source models, files published to Autodesk, or copies others have downloaded. De-identified information may be retained.

7. Security and international processing

We use administrative, technical, and organizational safeguards designed to protect personal information and Customer Data. These include access controls, encrypted credential storage, transport encryption, workspace authorization, security logging, and restricted service-provider access. More information is available on our Security page. No transmission or storage method is completely secure, and we cannot guarantee absolute security.

BIMRelay is operated from the United States, and information may be stored or processed in the United States and other countries where our service providers operate. Those countries may have different data-protection laws than your location. Where a transfer requires safeguards, these may include an applicable adequacy decision or approved contractual safeguards, with any additional measures required for the transfer. Our Data Processing Addendum sets out contractual transfer terms for eligible transfers of Customer Data. Our provider list describes service functions and processing locations. Contact us for the safeguard applicable to your information and how to obtain a copy.

8. Your privacy rights

Depending on where you live, you may have rights to know whether we process your personal information, access it, correct it, delete it, obtain a portable copy, restrict or object to certain processing, withdraw consent, appeal a denied request, or receive information about disclosures. You will not receive discriminatory treatment for exercising a privacy right.

To submit a request, email hello@bimrelay.com. Describe the request and the account or workspace involved. We may verify your identity and authority before responding. An authorized agent may submit a request where permitted by law, but we may require proof of authorization.

If your information is controlled by a BIMRelay customer, such as your employer or another project organization, contact that organization first. Account holders can update certain profile and workspace information directly in the Service. Where required, we obtain permission before sending marketing; merely creating a business account or accepting the Terms does not give that permission. To stop marketing communications, use an unsubscribe option provided in the message or contact us. We may still send essential account, security, and administrative messages.

Where applicable, you may also complain to your local data-protection authority, including the relevant supervisory authority in the European Economic Area or the UK Information Commissioner. Contacting us first does not limit that right.

Your right to object

Where applicable law provides this right, you may object to processing based on legitimate interests for reasons relating to your situation. You may object to direct marketing at any time, including related profiling; we will stop using your information for that purpose. Email the contact above to exercise these rights, withdraw consent, or appeal a response. We respond within the time required by applicable law.

California and other U.S. state disclosures

During the preceding 12 months, we may have collected identifiers; customer-record information; commercial information; internet or network activity; professional information; account-login credentials; and Customer Data that may contain personal information. We collect these categories from you, your organization, authorized workspace members, Autodesk at your direction, service providers, and automatic interactions with the Service. We use and disclose them for the business purposes described in this policy.

We use sensitive account credentials only to authenticate accounts, protect the Service, and provide requested functionality. We do not use sensitive personal information to infer characteristics. We have not sold personal information or shared it for cross-context behavioral advertising, and we do not knowingly sell or share the personal information of anyone under 18.

9. Children

BIMRelay is a business service for adults. It is not directed to children, and users must be at least 18 years old. We do not knowingly collect personal information from children. Contact us if you believe a child has provided personal information so we can investigate and delete it as appropriate.

10. Changes to this policy

We may update this policy as BIMRelay, our providers, or legal requirements change. The effective date at the top identifies the current version. If a change materially affects how we handle personal information, we will provide notice through the Service, by email, or through another appropriate channel as required by applicable law. Changes do not retroactively authorize materially different uses of previously collected information without any notice and consent required by law.

11. Contact us

Questions, complaints, or privacy requests may be directed to: