Privacy Policy
How we collect, use, share, and protect your personal data. Includes GDPR and Vietnam ND13/2023 compliance information.
This document is a structural draft from our specs. It has not been reviewed by qualified counsel and must not be relied upon as binding legal text. Production version will replace this before public launch.
- Version:
- 0.1.0-draft
- Effective:
- May 26, 2026
- Updated:
- May 26, 2026
Introduction
BIM Mobius respects your privacy. This policy explains what personal data we collect, how we use it, and your rights over it. It applies to all services we provide.
Information We Collect
Account Information
- Name and email address
- Hashed password (never stored in plain text)
- Profile information you choose to share
- Locale and timezone preferences
Billing Information
- Billing address and tax ID (for invoicing)
- Payment method tokens via Stripe (we never store raw card data)
- Transaction history
Usage Data
- Product usage metrics (anonymized aggregates)
- Revit addin telemetry (tool invocations, session duration)
- Hardware fingerprint hash for license enforcement
- Crash reports (with personal paths sanitized)
How We Use Information
- Provide and improve our services
- Process payments and issue licenses
- Enforce subscription terms and prevent abuse
- Communicate transactional and (with consent) marketing emails
- Customer support and account recovery
- Comply with legal obligations
- Aggregate analytics (no personal identification)
Legal Basis (GDPR)
- Contract — processing necessary to deliver our services
- Legitimate interest — product improvement, fraud prevention
- Consent — marketing emails, analytics cookies
- Legal obligation — tax and compliance record-keeping
Information Sharing
We do not sell your personal data. We share information only with:
- Service providers: Stripe (payments), Resend (email), Cloudflare (CDN), Vercel and Render (hosting)
- Legal authorities — when required by valid legal process
- Successor entities — in the event of merger or acquisition, with prior notice
International Transfers
Data is stored primarily in US and Asia data centers. Cross-border transfers comply with Standard Contractual Clauses (EU) and Nghị định 13/2023 cross-border data rules (Vietnam).
Data Retention
- Account data — while your account is active, plus 12 months after deletion
- Financial records — 7 years (legal requirement)
- License and audit logs — 7 years
- Marketing data — until you unsubscribe, plus 30 days
Your Rights
Under GDPR and Vietnam ND13/2023, you have the right to:
- Access your personal data
- Correct inaccurate data
- Request erasure (with exceptions for legal records)
- Restrict processing
- Receive a portable copy of your data
- Object to marketing or automated decisions
- Withdraw consent at any time
- Lodge a complaint with a supervisory authority
Exercise these rights through /account/privacy or by emailing [email protected].
Security
- TLS 1.2+ encryption in transit
- Encryption at rest for all personal data
- Argon2id password hashing
- Application-level handshake encryption on sensitive endpoints
- Audit logs for all administrative actions
- Incident response procedures with 72-hour breach notification
Children
Our services are not intended for users under 18. We do not knowingly collect data from children. If you believe a child has registered, contact us and we will delete the account.
Updates to This Policy
We notify users 30 days in advance of material changes via email and in-product banner.
Contact
Privacy questions: [email protected]. Data Protection Officer (when applicable): [email protected].