LUX Revit Plugin — Privacy Policy (GDPR)
Product: LUX Revit plugin (LUX Live, LUX Certify) and connected cloud services
Version: 1.0 · Effective date: 2026-09-01 · Last updated: 2026-09-10
Companion documents: Terms of Use / EULA · Data Processing Agreement
1. Roles: who is controller, who is processor
The LUX plugin involves two different kinds of data, with two different roles for Upskiller:
1.1 Project and model data — Upskiller acts as a processor. When the plugin sends geometric data from your Revit model to the cloud for a prediction or simulation, Upskiller processes that data on behalf of your organisation (the customer), which is the controller. This processing is governed by the Data Processing Agreement appended to the License and Service Agreement ("Master Agreement") between your organisation and Upskiller — see Appendix — Data Processing Agreement (DPA). If your Master Agreement does not yet include it, contact us to add it before using the Software with live project data. Model geometry is normally not personal data, but Revit models can contain personal data (e.g. names in sheet/title-block fields, worksharing usernames, RVT author metadata), so a processor relationship is assumed.
1.2 User, account, licensing and telemetry data — Upskiller acts as a controller. For data about the individual people who install and use the plugin (identification, licence/seat management, support, security and product-improvement telemetry), Upskiller is the controller. This Policy describes that processing.
Controller:
BIMTech Innovations AB, org. nr 559518-2881
Jungfrudansen 6, 171 56 Solna, Sweden
Privacy contact: [email protected]
2. Personal data we process as controller
| Category | Examples | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| User identification | User's work email address (stored pseudonymised / hashed where feasible), organisation, plugin version, Revit version | Authenticate and authorise use; enforce licence and concurrent-seat limits; link support requests to an entitlement | Art. 6(1)(b) performance of the contract with your organisation / steps to perform it; Art. 6(1)(f) legitimate interest in licence enforcement and preventing misuse |
| Usage & event telemetry (where enabled) | May include: feature and usage events; counts such as rooms analysed or data points per room in a run; run duration and outcome; a random project identifier (not the project name); performance metrics; error and crash logs; coarse timestamps | Operate, secure and monitor the Software; diagnose faults; understand how the tool is used to prioritise improvements; produce internal usage statistics | Art. 6(1)(f) legitimate interest (securing and improving a professional software product); telemetry is designed to be pseudonymous |
| Cloud API access logs | IP address, request metadata, API token / seat identifier, timestamps | Security, abuse prevention, fault diagnosis, capacity planning | Art. 6(1)(f) legitimate interest |
| Support communications | Name, email, message content, screenshots/models you choose to send | Provide support and resolve issues | Art. 6(1)(b) / Art. 6(1)(f) |
| Onboarding / model-review data | A Revit model you deliberately send us, and any personal data it contains | Verify model compatibility; perform model review or a LUX Certify simulation | Processed as processor on your organisation's behalf (see 1.1); if any is used for our own purposes it is anonymised first |
2.1 Model-improvement use
Upskiller does not currently retain geometric data from the plugin for model improvement or research. Geometric data sent for a prediction or simulation is used only to compute the results you request.
We do not use personal data for advertising, do not sell it, and do not carry out automated decision-making producing legal or similarly significant effects on individuals. The daylight prediction is a technical output about a building, not about a person.
3. Where the data is processed (hosting and sub-processors)
Upskiller uses the following categories of sub-processors, engaged under Art. 28 GDPR data processing agreements:
| Sub-processor | Role | Location |
|---|---|---|
| Scaleway SAS | Cloud hosting of prediction API, back-end microservices, databases and object storage; storage of LUX Certify snapshots, results and exports | France (EU) |
| Modal (serverless GPU) | On-demand machine-learning inference for LUX Live predictions | EU region (region="eu") |
| Okta / Auth0 | Authentication for the LUX Certify web results viewer and the plugin sign-in | EU region tenant (Ireland / Germany); tenant data processed in the EU |
| Sentry | Application error and crash reporting | EU region (de.sentry.io) — data in Germany |
| Google Workspace (Google Ireland Ltd) | Handling support correspondence sent to Upskiller | EU (Ireland) |
The current sub-processor list is available on request and, for customers, is maintained under the Master Agreement. We notify customers of changes as required by the Master Agreement.
4. International transfers
All hosting and processing for the LUX cloud services takes place within the EU / EEA. Our sub-processors are contracted to keep the relevant personal data in the EU/EEA (Scaleway in France; Modal on its EU region; the Auth0 tenant in Ireland/Germany; Sentry on its EU region in Germany; Google Workspace in Ireland). If in future any sub-processor were to process personal data outside the EEA, Upskiller would first put in place a valid Chapter V GDPR transfer mechanism — normally the European Commission's Standard Contractual Clauses (2021) plus a transfer impact assessment and any necessary supplementary technical measures (e.g. encryption, pseudonymisation) — and update this Policy.
5. Retention
| Data | Retention |
|---|---|
| User identification / seat records | For the duration of the Master Agreement + 12 months, then deleted or anonymised |
| Usage & event telemetry | Up to 24 months in identifiable/pseudonymous form, then aggregated or deleted |
| Cloud API access logs | 90 days, longer only for an active security investigation or legal claim |
| Support communications | Duration of the matter + 24 months |
| Onboarding models / Certify project data (as processor) | Per the Master Agreement; deleted or returned on request and at end of contract, subject to legal retention |
| Geometry sent for a prediction/simulation | Used transiently to compute the result; not retained for model improvement or research |
6. Recipients
Personal data is accessible to authorised Upskiller personnel and contractors bound by confidentiality, and to the sub-processors in Section 3. We may disclose data where required by law, court order or a competent authority, or to establish, exercise or defend legal claims. In a corporate transaction (merger, acquisition, financing) data may be disclosed to counterparties under confidentiality, consistent with this Policy.
7. Your rights
If Upskiller is the controller for data about you (Section 2), you have the right to: access; rectification; erasure; restriction; data portability (where applicable); and to object to processing based on legitimate interest, including profiling for product analytics. Where processing relies on consent, you can withdraw it at any time.
Where Upskiller acts as processor (project/model data, Section 1.1), please direct requests to your own organisation (the controller); Upskiller will assist the controller in responding as required by Art. 28 GDPR.
Contact [email protected] to exercise your rights. We respond within one month of receiving your request. Where a request is complex or you have made several requests, we may extend this by up to two further months and will tell you within the first month. Handling your request is free of charge unless it is manifestly unfounded or excessive. Note that much of our telemetry is pseudonymous and we may be unable to single out data relating to you without additional information (Art. 11 GDPR).
You may lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se) or your local supervisory authority.
8. Security
Technical and organisational measures include: TLS in transit and encryption at rest for stored snapshots; access control and least-privilege for internal systems; pseudonymisation of user identifiers in telemetry; EU-based hosting; audit logging; and contractual confidentiality and security obligations on personnel and sub-processors. Personal-data breaches are handled under our incident procedure and notified to the supervisory authority and affected controllers/individuals as required by Art. 33–34 GDPR.
9. Children
The Software is a professional tool not intended for or directed at children.
10. Changes to this Policy
We may update this Policy. The current version is published at https://docs.upskiller.xyz/lux-privacy and, for customers, provided under the Master Agreement. Material changes affecting customers as controllers are notified as required by the Master Agreement.
11. Contact
BIMTech Innovations AB — Jungfrudansen 6, 171 56 Solna, Sweden
[email protected]