ApexBIM

Privacy Policy

Last updated: August 28, 2026

1. Introduction

ApexBIM ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our cloud-native BIM platform (the "Service").

This Privacy Policy complies with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws. By using the Service, you consent to the practices described in this policy.

2. Data We Collect

2.1 Account Data

When you register for an account, we collect:

  • Your name and email address.
  • A hashed password (we use PBKDF2 with 100,000 iterations — we never store plaintext passwords).
  • Your company name (if provided during signup).
  • Your role (viewer, editor, admin, or owner) within your tenant.
  • Your profile picture (if you sign in via Google OAuth).

2.2 Project Data

When you use the Service, you may upload:

  • IFC files and BIM models.
  • Project data, including element properties, materials, and schedules.
  • BCF issues, RFIs, submittals, and change orders.
  • 2D drawings, annotations, and reports.

This data is tenant-isolated — it is only accessible to users within your tenant. We do not share your project data with other tenants or third parties.

2.3 Usage Data

We automatically collect:

  • IP addresses (for security, audit logging, and rate limiting).
  • Browser type, device type, and operating system.
  • Pages visited, features used, and time spent on the Service.
  • Audit log entries (every action is recorded in a tamper-evident hash chain).

2.4 Billing Data

If you purchase a paid subscription, we collect:

  • Billing address and company details.
  • Subscription tier and billing cycle.
  • Payment method information is handled entirely by Flutterwave — we never see or store your credit card number.

3. How We Use Your Data

We use your personal data to:

  • Provide the Service — authentication, model storage, collaboration features.
  • Communicate with you — account notifications, security alerts, product updates.
  • Process payments — subscription billing via Flutterwave.
  • Ensure security — fraud detection, rate limiting, audit logging, intrusion detection.
  • Comply with legal obligations — responding to lawful requests, maintaining records.
  • Improve the Service — analyzing usage patterns to identify bugs and prioritize features.

4. Legal Basis for Processing (GDPR)

Under the GDPR, we process your personal data on the following legal bases:

  • Contract — processing necessary to provide the Service you requested.
  • Legitimate interests — security monitoring, fraud prevention, and service improvement.
  • Legal obligation — compliance with applicable laws and regulations.
  • Consent — for optional communications like marketing emails (you can opt out at any time).

5. Data Storage and Security

5.1 Data Storage

Your data is stored on secure servers. For the Enterprise plan, an on-premise deployment option is available — your data never leaves your infrastructure. For other plans, data is stored in the region you select during account creation (default: us-east-1).

5.2 Security Measures

We implement defense-in-depth security:

  • Encryption in transit — all connections use TLS 1.2+.
  • Encryption at rest — database and file storage are encrypted.
  • Tenant isolation — all queries are scoped to your tenant ID.
  • IDOR defenses — every API route verifies resource ownership before returning data.
  • Content Security Policy (CSP) — prevents XSS and injection attacks.
  • Tamper-evident audit log — SHA-256 hash chain detects any tampering.
  • Rate limiting — prevents brute force and DoS attacks.
  • Account lockout — 5 failed login attempts locks the account for 15 minutes.
  • Password hashing — PBKDF2 with 100,000 iterations and random salt.
  • Session security — httpOnly, secure, sameSite cookies with 8-hour TTL.

5.3 Data Retention

  • Active accounts — data is retained as long as your account is active.
  • Cancelled accounts — data is retained for 90 days, then permanently deleted.
  • Audit logs — retained for 7 years (Free/Pro: 30 days, Enterprise: unlimited).
  • Contact form submissions — retained for 12 months, then deleted.

6. Data Sharing

We do not sell your personal data. We share data only with:

  • Flutterwave — payment processing. Flutterwave receives your billing address and payment method. We never see your card details.
  • Google — if you use Google OAuth sign-in, Google provides your name, email, and profile picture.
  • Cloud infrastructure providers — servers and storage (under Data Processing Agreements).
  • Legal authorities — when required by law, court order, or to protect our rights.

We never share your BIM models, project data, or proprietary content with any third party without your explicit consent.

7. Your Rights

7.1 GDPR Rights (EU/EEA/UK)

Under the GDPR, you have the right to:

  • Access — request a copy of your personal data.
  • Rectification — request correction of inaccurate data.
  • Erasure — request deletion of your personal data ("right to be forgotten").
  • Restriction — request that we limit processing of your data.
  • Portability — receive your data in a machine-readable format (JSON, IFC, CSV).
  • Objection — object to processing based on legitimate interests.
  • Withdraw consent — withdraw consent for optional processing at any time.

7.2 CCPA Rights (California)

Under the CCPA, California residents have the right to:

  • Know what personal data is collected and how it is used.
  • Request deletion of their personal data.
  • Opt out of the sale of personal data (we do not sell data).
  • Not be discriminated against for exercising these rights.

7.3 Exercising Your Rights

To exercise any of these rights, contact us at privacy@apexbim.com. We will respond within 30 days (GDPR) or 45 days (CCPA). We may need to verify your identity before processing your request.

8. Cookies

The Service uses the following cookies:

  • Session cookie (apexbim_session) — authenticates you. HttpOnly, secure, sameSite. 8-hour TTL.
  • CSRF token cookie — double-submit cookie for CSRF protection. HttpOnly.
  • Theme cookie — remembers your light/dark mode preference.

We do not use third-party tracking cookies, advertising cookies, or analytics cookies that profile your behavior across other websites.

9. International Data Transfers

Your data may be transferred to and processed in countries other than your own. For EU/EEA/UK users, we use Standard Contractual Clauses (SCCs) to ensure adequate protection of your data during international transfers. You can select your data region during account creation.

10. Children's Privacy

The Service is not directed to children under 18, and we do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us at privacy@apexbim.com and we will delete it.

11. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service at least 30 days before the changes take effect. We encourage you to review this policy periodically.

13. Contact

If you have any questions about this Privacy Policy or our data practices, please contact our Data Protection Officer at privacy@apexbim.com or through our contact page.

For GDPR complaints, you can also contact your local data protection authority. For the EU, the list of supervisory authorities is available at the European Data Protection Board website.