Privacy Policy

1. Who we are

ForensicBIM ("ForensicBIM", "we", "us" or "our") is responsible for the personal information described in this policy. Under the EU and UK General Data Protection Regulation (GDPR), we are the "controller" of that information. Our address is Claude Debussylaan 82-84, 1082 MD Amsterdam, The Netherlands, and you can reach us at support@forensicbim.business.

If you upload models on behalf of an organisation. IFC files can contain personal information about other people, such as the names of the authors in the file header. When an organisation uses ForensicBIM, we process the content of its models on that organisation's instructions and act as its "processor", under our Data Processing Agreement, which forms part of our Terms of Service. A signed copy is available on request. Where we use analysis results to improve our own service (see section 3), we do so as controller.

This policy does not cover third-party websites or services that we link to or that you choose to use, such as buildingSMART's validation service or Stripe's checkout pages. Their own privacy policies apply.

2. What information we collect

Information you give us

• Account information: your email address, and your name if you add it or sign in with Google. We do not use passwords. You sign in with a link we email to you, or with your Google account.
• Model files: the IFC files you upload. IFC files can contain personal information, such as the names, organisations, email addresses or phone numbers of the people who created or own the model. We process whatever the file contains, so please upload only files you are entitled to share with us.
• Uploads without an account: if you start an analysis without signing in, we ask for your email address so we can link the results to you and tell you when they are ready.
• Requests and messages: feedback, questions and consultant support requests (for example what you need help with, your budget, preferred language and any sharing restrictions), and the correspondence that follows.
• Billing information: for Pro subscriptions, Stripe collects your payment details on its own checkout pages. We receive your Stripe customer ID, plan and subscription status. We never see or store your full card number.
• Settings: your model reuse choice, preferred units, dashboard view and the valuation inputs you change, such as the hourly rate.

Information we generate when you use ForensicBIM

• Analysis records: scores, findings and valuations; the file name, size and checksum; processing status and logs; information read from the file, such as the authoring application, author and organisation names; and the georeferenced location of the asset.
• Generated files: the 3D preview (GLB), thumbnails, heatmaps, raw result files and reports created from your model.
• Sharing information: the secret share links you create, with their expiry dates, and the private link to your showcase page.
• Security and audit logs: sign-ins, sign-outs, changes to privacy settings, deletions, share links and downloads of model files by our staff, together with the IP address and browser (user agent) involved.
• Technical information: IP address, browser and device type, the pages you request, the referring page and, where our hosting infrastructure provides it, the country your connection comes from.
• Website statistics: aggregated page views, referrers, browser, device type and country, collected without cookies (see section 9).

Information from other sources

• Google, if you sign in with Google: your name, email address and whether that address is verified.
• Google reCAPTCHA: a score showing how likely it is that an upload without an account is automated.
• Stripe: payment and subscription status.
• buildingSMART International: validation results, if you choose that check.

3. How we use information and why

We use personal information only for the purposes below. For people in the EEA and the UK, the table also shows the legal basis we rely on.

Automated assessments. Our scores and valuations are automated assessments of model data, not of people. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

4. How we share information

We do not sell personal information, and we do not share it for targeted advertising. We share it only as described below.

• Service providers. Companies that host, store, send or process information for us, under contracts that limit what they may do with it. They are listed in the table below.
• buildingSMART International, only if you choose it. When you tick "Also validate with buildingSMART", buildingSMART International Limited (United Kingdom) receives your complete IFC file through validate.buildingsmart.org. buildingSMART handles the file under its own Terms of Service and privacy policy, not on our behalf, and decides how long it keeps it. Please read those terms before you use this option. Files larger than 256 MB, and files without an official IFC schema, are never sent.
• Consultants, only with your agreement. If you ask for consultant support, we review your request and propose consultants. We pass your contact details and request to a consultant only after you have agreed to that specific consultant. We do not share your model or its results with consultants.
• People you choose. Anyone who has a secret share link you created can view that report until the link expires or you revoke it. Anyone you give your showcase link to can see your showcase page (see section 10).
• Authorities and legal requests. When the law requires it, or when it is necessary to protect the rights, property or safety of our users, ForensicBIM or others.
• Professional advisers. Auditors, lawyers and accountants, under duties of confidentiality.
• Business transfers. If ForensicBIM is involved in a merger, acquisition or sale of assets, personal information may transfer to the new owner, who must continue to protect it as this policy describes.

Service providers (sub-processors)

Map services loaded by your browser. When you open a model's location or map view, your browser loads map images directly from Esri (ArcGIS Online) and OpenStreetMap, and coordinate-system definitions from epsg.io. These services receive your IP address and the map area around the asset, and handle that information under their own privacy policies.

5. Where your information is stored

You cannot change the region of a model after you upload it. To move a model, delete it and upload it again in another region.

International transfers. Some of the providers above process information outside the European Economic Area and the UK, and model files are stored in the region you choose, which may be outside the EEA. Where the law requires it, we protect these transfers with the European Commission's Standard Contractual Clauses (with the UK addendum), or rely on the EU-U.S. Data Privacy Framework where the provider is certified. You can ask us for a copy of the relevant safeguards.

6. How long we keep information

What deletion removes. When you delete an analysis, we delete the IFC file, every file generated from it, the analysis record and any share links to it. When you delete your account, we also delete your feedback, consultant requests, share links, profile, sign-in account and mailing-list contact. Before you can delete your account, you need to cancel any active subscription.

Deleted files stay in Google Cloud Storage's recovery store for 7 days, where they are used only to recover from technical errors, and are then permanently erased.

7. How we protect information

• All traffic is encrypted in transit (HTTPS/TLS), and stored data is encrypted at rest by Google Cloud.
• Model files are kept in separate regional storage, and access rules tie each file to the account that uploaded it.
• Our staff use multi-factor authentication and have only the access their role needs.
• Sessions end after 60 minutes of inactivity.
• We monitor for security events, scan for vulnerabilities and keep an incident response plan. Our controls are designed around the SOC 2 and ISO 27001 frameworks.

Who at ForensicBIM can see your models

Analyses run automatically. Authorised ForensicBIM staff can access a stored model or its analysis only when:

• you ask us for help, or send feedback and allow us to view the analysis and model;
• we use the model to test or calibrate our algorithms, unless you have opted out in Settings;
• we need to investigate a security incident or abuse of the service; or
• the law requires it.

Every download of a model file by our staff is logged.

No method of transmission or storage is completely secure. If a personal data breach affects you, we will notify you and the competent authorities as the law requires.

8. Your rights and choices

Things you can do yourself

• Delete an analysis from your dashboard.
• Delete your account and all associated data in Settings.
• Opt out of model reuse to improve our algorithms in Settings. A change applies to your next uploads. To opt out for models you have already uploaded, contact us or delete those models.
• Download your IFC files and reports from each analysis.
• Update your name on your account page.
• Unsubscribe from product news and offers with the link in our newsletters, or by replying to any offer or emailing us.

Your legal rights

Depending on where you live, you have the right to:

• access the personal information we hold about you and receive a copy;
• have inaccurate information corrected;
• have your information deleted;
• restrict how we use your information;
• receive your information in a structured, machine-readable format (portability);
• object to processing based on our legitimate interests, and always to direct marketing;
• withdraw consent at any time, without affecting processing that took place before; and
• complain to a data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens. You can also contact the authority where you live or work.

To use these rights, email support@forensicbim.business with the subject "Privacy request". We may ask you to confirm your identity. We respond within one month. For complex requests, we may extend this by up to two further months and will tell you why. Requests are free of charge.

If you used ForensicBIM through an organisation, requests about personal information inside that organisation's models are best sent to the organisation. We will help them respond.

9. Cookies and similar technologies

We use a small number of cookies and browser storage items that the service needs to work, and a few that remember your preferences. We do not use advertising or cross-site tracking cookies. Our website statistics (Umami) work without cookies.

Stripe's checkout pages and Google's sign-in window are hosted by Stripe and Google and set their own cookies. You can block or delete cookies in your browser settings, but signing in and uploading will not work without the strictly necessary ones.

10. Information you share through links

Your account includes a showcase page at a private, hard-to-guess link. Anyone you give that link to can see your name, a partly hidden version of your email address, your badges, your best scores and the number of files you have analysed.

Pro users can create secret share links. A secret share link shows the report of one analysis to anyone who has the link, until it expires or you revoke it. You can manage your share links in your account.

11. Children

ForensicBIM is a professional service and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, please contact us and we will delete it.

12. Information for specific regions

European Economic Area and United Kingdom

The legal bases we rely on are set out in section 3 and your rights in section 8. In the UK you can complain to the Information Commissioner's Office (ICO).

United States

In the past 12 months we have collected the following categories of personal information: identifiers (such as name, email address and IP address); commercial information (subscriptions); internet or other electronic network activity (such as pages requested and security logs); approximate location (the country of your connection); and professional information contained in model files (such as author and organisation names). We collect them from the sources and for the purposes described in sections 2 and 3, and disclose them only as described in section 4.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. Depending on the state you live in, you may have the right to know about, access, correct and delete your personal information, and to opt out of sale, sharing or profiling. You can use these rights as described in section 8, or through an authorised agent with your written permission. We will not discriminate against you for using them.

Brazil

Under the Lei Geral de Proteção de Dados (LGPD), you have the right to confirmation that we process your data, access, correction, anonymisation, blocking or deletion of unnecessary data, portability, information about the parties we share data with, and to withdraw consent. You can also complain to the Autoridade Nacional de Proteção de Dados (ANPD).

Australia, Hong Kong, Japan and Singapore

You can ask to access or correct your personal information as described in section 8. If you are not satisfied with our response, you can contact your local authority: the Office of the Australian Information Commissioner (OAIC), the Privacy Commissioner for Personal Data in Hong Kong (PCPD), the Personal Information Protection Commission in Japan (PPC), or the Personal Data Protection Commission in Singapore (PDPC).

13. Changes to this policy

We may update this policy when our service or the law changes. The date at the top shows when it last changed. If we make material changes, we will tell you by email or in the product before they take effect.

14. How to contact us

For questions about this policy, to use your rights, or to request a signed copy of our Data Processing Agreement, contact us at:

Back to top ↑