Privacy policy.

1. Scope and our privacy roles

This Privacy Policy applies to BIMRelay websites, applications, communications, and related services operated by Sabrene Software LLC ("Sabrene," "we," "us," or "our"). It covers our handling of information, including when we use service providers. Autodesk, Stripe, and other third parties may also process information for their own purposes under their own privacy policies.

For account, billing, website, security, and direct marketing information, Sabrene determines why and how the information is processed. For model, workbook, project-member, and other content submitted by a customer organization ("Customer Content"), Sabrene generally processes the information on that organization's behalf. If your information appears in Customer Content, direct your request to the organization that controls the relevant workspace. We will assist that organization as required by applicable law or a written agreement.

2. Information we collect

Information you provide

• Account and profile information: name, work email, company, phone number, optional profile image, password credentials, and account preferences. We also record the Terms version accepted and the time of acceptance when you sign up.
• Workspace information: workspace and project names, invitations, memberships, roles, administrative settings, and contact details.
• Customer Content: workbook cells, rows, settings, validation decisions, comments, mentions, generated exports, and published files.
• Communications: support messages, feedback, website inquiries, surveys, and marketing preferences.
• Billing information: billing contact details, subscription plan, project quantity, transaction status, invoices, and related records. Stripe processes payment-card details, and we do not store complete card numbers or security codes.

Information received from Autodesk

When you connect Autodesk Platform Services or Forma, we receive authorization credentials and information available through the permissions you grant. This may include your Autodesk identity, hubs, projects, files, model versions, host and linked model relationships, thumbnails, and selected published Revit data. During extraction, BIMRelay processes model elements, identifiers, categories, types, spaces, levels, parameters, geometry-related metadata, contacts, and other evidence needed to generate and maintain the workbook.

Depending on the connection, access is authorized through a user account or a workspace integration. We may list accessible hubs, projects, and files so you can choose a model; extraction and publication use the resources selected for the workflow. The permissions granted to an integration may be broader than those selections. OAuth access and refresh tokens support the connection, version checks, retrieval, and instructed publication. Stored connection credentials are held on the server; a limited access token may be supplied to the Autodesk viewer in your browser. Disconnecting an Autodesk connection does not delete data already held in BIMRelay, cancel a subscription, or revoke other authorized workspace connections.

Information collected automatically

• Request and device data: IP address, browser or device information supplied with a request, requested URLs, referring pages when supplied, and timestamps in application or hosting logs.
• Operational logs: authentication events, API requests, extraction and export status, errors, performance measurements, and security signals.
• Collaboration activity: cell edits, configuration changes, comments, mentions, active edit sessions, and audit events associated with an account.
• Cookies and local storage: identifiers and preferences needed for authentication, security, navigation, and remembered views.

3. How we use information

We use personal information and Customer Content to:

• create accounts, authenticate users, and administer workspaces, projects, roles, and invitations;
• connect to Autodesk services and process the host models, links, versions, and metadata you select;
• generate, validate, update, collaborate on, export, and publish COBie workbooks;
• preserve supported edits, maintain history, show activity, and coordinate concurrent editing;
• process subscriptions, enforce plan limits, prevent abuse, and maintain billing records;
• provide support, send service notices, respond to requests, and communicate product updates;
• monitor reliability, diagnose errors, secure the Service, and prevent fraud or unauthorized access;
• use operational logs and aggregated information to understand reliability, feature use, and performance and to improve BIMRelay;
• respond to website inquiries and send marketing communications where permitted, subject to your preferences; and
• comply with law, enforce agreements, and protect users, Sabrene, and third parties.

We do not sell Customer Content or use model data, workbook values, comments, or project files to train general-purpose artificial intelligence models, or authorize our service providers to do so. We may use aggregated or de-identified information that cannot reasonably identify an individual, customer, or specific project. We maintain that information in de-identified form and do not attempt to re-identify it except to test our de-identification safeguards.

Where applicable law requires a legal basis, we process information to perform our contract, pursue legitimate interests such as operating and securing the Service, comply with legal obligations, and act with consent where consent is required. You may withdraw consent for future processing, but that does not affect prior lawful use. Accepting the Terms is not consent to optional analytics, advertising, or unrelated uses of personal information.

4. How we disclose information

We disclose information only as needed for the purposes described in this policy:

• Within a workspace: authorized members can see project content, collaborator identity, edits, comments, mentions, presence, and activity according to their role.
• Service providers: hosting, database, object storage, security, email, support, monitoring, form, and infrastructure providers process information as needed to provide their services to us, subject to applicable confidentiality and data-protection obligations.
• Stripe: Stripe processes checkout, payment methods, subscriptions, invoices, and the billing portal.
• Autodesk: we exchange authorization, model, project, and publication data with Autodesk at your direction.
• Cloudinary: Cloudinary hosts optional profile images. These are displayed to collaborators, and an image may also be accessible to anyone with its image URL. Do not use a confidential image as your profile picture.
• Resend: Resend delivers account and service emails, including invitations and notifications that may contain collaborator or project details.
• Formspree: Formspree processes website form submissions and the contact information you include.
• Google Analytics: Google processes information about how visitors find and use the public BIMRelay website.
• Legal and safety matters: we may disclose information to comply with law or lawful process, or as reasonably necessary to investigate abuse, enforce agreements, or protect rights and safety, consistent with applicable law and our confidentiality commitments. We limit disclosure to the information needed for that purpose.
• Business transactions: information may be transferred as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of the business, subject to appropriate confidentiality protections.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising or use it for profiling that produces legal or similarly significant effects.

Contact us for details about the providers and processing locations relevant to your use of BIMRelay. If you require a contractual subprocessor list or notice of provider changes, those arrangements must be established in a written agreement before submitting the affected data.

5. Cookies and analytics

We use essential cookies and browser storage for sign-in, security, session continuity, preferences, and core features. Application and hosting logs also help us operate and secure the Service.

We use Google Analytics on the public BIMRelay website to understand how visitors find and use the site. You can accept or decline optional cookies through the cookie banner and change your choice through Cookie settings in the website footer.

Google Analytics is not installed in the signed-in BIMRelay application. We do not sell personal information or share it for cross-context behavioral advertising.

6. Retention and deletion

Retention depends on the type of information, the status of the relevant workspace or project, any agreed retention requirements, and applicable law. Cancelling a subscription, archiving a project, disconnecting Autodesk, and requesting deletion have different effects.

• Active and archived projects: we retain account, project, model, workbook, and collaboration information to provide the Service. Archiving makes a project read-only; it does not request deletion. Cancelling billing does not by itself delete retained projects.
• Project deletion: a deleted project becomes inaccessible to customers immediately. Its remaining project database records and associated object-storage files, including raw extraction archives and generated exports, are permanently deleted after a 30-day grace period.
• Workspace deletion and recovery: deleting a workspace also removes access to its projects and may remove database records before the grace period ends. Associated object-storage cleanup still follows its deletion schedule. The grace period does not guarantee that a deleted project or workspace can be restored.
• Account closure: contact us to request closure or deletion of your account. Closing an individual account does not automatically delete an organization's workspaces or shared records that other users depend on. We assess those records according to the customer's instructions, applicable law, and our obligations.
• Superseded model evidence: large relational evidence from older model snapshots may be pruned while limited version, audit, and preservation records remain available for workbook continuity and history.
• Separate business records: billing, tax, Terms-acceptance, security, audit, and dispute records may be retained for legal obligations or a documented business need. We limit retained information to what is needed for that purpose; this is not a general exception to retain deleted model files indefinitely.
• Backups: any residual copies in backups are subject to the relevant backup lifecycle rather than the active-project deletion worker. We restrict these copies from ordinary use and retain them only as needed for recovery, security, or legal obligations. If a backup is restored, we handle restored data according to then-applicable deletion obligations. A fixed backup-erasure deadline or a particular recovery capability applies only if agreed in writing.

Deletion from BIMRelay does not delete source models or files published to Autodesk, or copies downloaded or retained by your organization or other authorized recipients. Those copies are controlled by their recipients and providers. De-identified information that can no longer reasonably identify a person, customer, or project may be retained. Contact us before use if your project requires a specific deletion deadline or retention period.

7. Security and international processing

We use administrative, technical, and organizational safeguards designed to protect personal information and Customer Content. These include access controls, server-side credential storage, transport encryption, workspace authorization, security logging, and restricted service-provider access. More information is available on our Security page. No transmission or storage method is completely secure, and we cannot guarantee absolute security.

BIMRelay is operated from the United States, and information may be stored or processed in the United States and other countries where our service providers operate. Those countries may have different data-protection laws than your location. Any specific storage-location requirements, data processing agreements, or international-transfer safeguards must be established in writing with Sabrene before the affected Customer Content is submitted. Contact us to establish those terms. This policy does not replace a required data processing agreement.

8. Your privacy rights

Depending on where you live, you may have rights to know whether we process your personal information, access it, correct it, delete it, obtain a portable copy, restrict or object to certain processing, withdraw consent, appeal a denied request, or receive information about disclosures. You will not receive discriminatory treatment for exercising a privacy right.

To submit a request, email hello@bimrelay.com. Describe the request and the account or workspace involved. We may verify your identity and authority before responding. An authorized agent may submit a request where permitted by law, but we may require proof of authorization.

If your information is controlled by a BIMRelay customer, such as your employer or another project organization, contact that organization first. Account holders can update certain profile and workspace information directly in the Service. To stop marketing communications, use an unsubscribe option provided in the message or contact us. We may still send transactional, security, and administrative messages.

Where applicable, you may also complain to your local data-protection authority, including the relevant supervisory authority in the European Economic Area or the UK Information Commissioner. Contacting us first does not limit that right.

California and other U.S. state disclosures

During the preceding 12 months, we may have collected identifiers; customer-record information; commercial information; internet or network activity; professional information; account-login credentials; and Customer Content that may contain personal information. We collect these categories from you, your organization, authorized workspace members, Autodesk at your direction, service providers, and automatic interactions with the Service. We use and disclose them for the business purposes described in this policy.

We use sensitive account credentials only to authenticate accounts, protect the Service, and provide requested functionality. We do not use sensitive personal information to infer characteristics. We have not sold personal information or shared it for cross-context behavioral advertising, and we do not knowingly sell or share the personal information of anyone under 18.

9. Children

BIMRelay is a business service for adults. It is not directed to children, and users must be at least 18 years old. We do not knowingly collect personal information from children. Contact us if you believe a child has provided personal information so we can investigate and delete it as appropriate.

10. Changes to this policy

We may update this policy as BIMRelay, our providers, or legal requirements change. The effective date at the top identifies the current version. If a change materially affects how we handle personal information, we will provide notice through the Service, by email, or through another appropriate channel as required by applicable law. Changes do not retroactively authorize materially different uses of previously collected information without any notice and consent required by law.

11. Contact us

Questions, complaints, or privacy requests may be directed to: