- Home
- Privacy policy
Legal
Privacy policy
Last updated 25 October 2026. In short: your Revit model never leaves your computer, we collect only what we need to run the beta and improve ClashFree, we never sell personal data, and you can ask us to delete it at any time.
Beta draft: this policy describes our practices accurately and applies now; it will be reviewed by counsel before general availability.
1. Who we are
ClashFree ("we", "us") makes the ClashFree add-in for Autodesk Revit and runs this website, clashfree.app. We are the controller of the personal data described here. You can reach us at [email protected], which also handles privacy requests.
[To complete before general availability: the legal entity's registered name, registered address, company number and, where required, the EU/UK representative and data protection officer.]
2. Scope
This policy covers this website (including the beta sign-up and contact forms), the beta activation and licensing service, and the data the ClashFree add-in sends to us. The beta data terms describe in detail what the add-in sends and are part of this policy. Your use of the add-in is governed by the beta licence (EULA); your use of this website by the terms of use.
3. What we collect
3.1 When you sign up for the beta
- Required: your name, work e-mail address, company, job title, country and role.
- Optional: company size, main discipline, the Revit version you use most, how you heard about us, and what you would like ClashFree to solve.
- Automatically: the country derived from your IP address by our hosting provider (not the IP address itself in our records), the time of sign-up and confirmation, the version of the licence you accepted, and a spam check result from Cloudflare Turnstile.
3.2 When you contact us
Your name, e-mail address, optional company, the topic, your message, the IP-derived country and the time. If you e-mail us directly, we receive what your e-mail contains.
3.3 When you activate the add-in
Your e-mail address, a 6-digit code we send to it, your invite code (stored only as a hash), a random installation id generated on your computer, the add-in version, the time you activated and were last seen, and your trial dates. This lets us run your trial and keep invite codes to their limit of three machines.
3.4 Usage analytics from the add-in
Counts and codes about how ClashFree is used, a condition of the beta: for example that a report was imported (with the number of clashes and groups), that a fix was proposed, verified, kept or rejected, which strategy and AI model were used, token counts and cost, timings, flag and error codes. Each event carries the random installation id, a session id, the add-in and Revit versions, and a one-way hash of the model instead of its name. Category names, sizes and system classes are sent as coded values.
3.5 Diagnostics
Once a day, and when you press Send diagnostics now, the add-in sends its log lines as templates with the values hashed, plus your optional note. Error reports carry a hash of the code location, never file paths.
3.6 Clash content (your choice, on by default)
When you Keep or Reject a fix and clash content sharing is on, the add-in sends a scrubbed record of that clash: the description the AI saw (element categories, sizes, system classes, distances and free space in millimetres, the scored options), the proposal, the verification result and your decision. Names, levels, systems and other identifiers are replaced by hashes first. You can turn sharing off at any time in the add-in's Settings; with sharing off, the add-in may ask after a Reject whether to share that one rejection, and sends nothing unless you say yes.
3.7 When you visit this website
Our hosting provider, Cloudflare, processes your IP address, browser user agent and the pages requested to deliver the site and protect it from abuse. We run no advertising and no third-party analytics on this website.
4. What we never collect
- Your Revit model, its geometry files, clash report files or exported views.
- Project, file, folder, model, user or machine names, or file paths.
- Your AI provider's API key: it is stored encrypted for your Windows user on your computer and sent only to your AI provider.
- Your chat messages with the AI, except as part of a clash content record you chose to share, after scrubbing.
- Payment details: the beta is free.
5. How we use it, and our legal bases
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Run the beta: sign-up, invite codes, activation, trial, updates, support | Sign-up, activation, contact data | Performance of a contract (b) |
| Improve ClashFree: measure what works, find and fix failures | Usage analytics, diagnostics | Contract, as a condition of the beta (b), and our legitimate interest in improving the product (f) |
| Evaluate and improve the AI's fix judgement | Clash content | Legitimate interest (f), with an off switch in Settings as your right to object; your consent (a) where you share a single rejection when asked |
| Understand who the beta serves and follow up on your needs | Optional sign-up fields | Legitimate interest (f) |
| E-mails about your beta access: confirmation, invite, activation codes, trial reminders, important changes | Name, e-mail | Contract (b) |
| Keep the service secure and prevent abuse | IP address, rate-limit counters, spam checks | Legitimate interest (f) |
| Meet legal obligations | As required | Legal obligation (c) |
We do not use your data for automated decisions that have legal or similarly significant effects on you. We do not send marketing e-mails without your consent; e-mails about your beta access are part of the service.
6. AI providers
When the add-in asks an AI for a fix, the request goes from your computer straight to the AI provider you configured, today Anthropic, using your own API key, or through Claude Desktop or Claude Code on your own Claude plan. It contains a text description of the clash and its surroundings, not your model. That processing is between you and your AI provider under its terms and privacy policy; the provider is not our processor and we do not receive those requests.
7. Who we share it with
We never sell or rent personal data, and we do not share it for cross-context behavioural advertising. We use these service providers (processors), bound by data processing terms:
- Cloudflare, Inc.: website hosting, the beta gateway (Workers), its database (D1) and file storage (R2, EU jurisdiction), and Turnstile spam protection.
- Resend: sending our e-mails (confirmation links, invite codes, activation codes, trial and support e-mails).
We may disclose data if the law requires it, to protect our rights or users' safety, or to a successor if ClashFree is reorganised or acquired, who would remain bound by this policy.
8. International transfers
Clash content and diagnostics files are stored in the EU. Our providers may process other data, such as e-mail delivery and edge requests, in other countries, including the United States. Where personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or the EU-US Data Privacy Framework where the provider is certified.
9. How long we keep it
| Data | Kept for |
|---|---|
| Unconfirmed sign-ups | 30 days |
| Your beta account (sign-up, activation, trial) | Until you ask us to delete it, and no longer than we need it to run the beta and its successor |
| Usage analytics and shared clash content | 395 days (13 months) |
| Diagnostics | 90 days |
| Contact messages | 365 days |
| Activation codes | 10 minutes; rate-limit counters for hours |
In the add-in, Settings → Beta → Delete my data on the server removes that installation's usage events, diagnostics and clash content at once.
10. Security
Data is sent over TLS. Invite codes and activation codes are stored only as hashes; the add-in uses signed, expiring tokens. Access to our admin tools is restricted to named staff behind single sign-on. Identifiers in telemetry are scrubbed or hashed on your computer before they are sent. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the authorities as the law requires. To report a vulnerability, see security.
11. Your rights
Depending on where you live, including under the GDPR and UK GDPR, you have the right to:
- access the personal data we hold about you and get a copy;
- rectify data that is wrong or incomplete;
- erase your data ("right to be forgotten");
- restrict how we process it;
- portability: receive it in a machine-readable format;
- object to processing based on legitimate interest, including clash content sharing (switch it off in Settings);
- withdraw consent at any time, without affecting processing before;
- complain to your data protection supervisory authority.
To exercise a right, send a privacy request or e-mail [email protected] from the address you signed up with. We answer within one month, and may ask you to confirm your identity. Usage data is keyed to a random installation id; to include it, tell us the e-mail you activated with, or use Delete my data on the server in the add-in.
12. California residents
Under the CCPA as amended by the CPRA, you have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and not to be discriminated against for exercising these rights. The categories we collect are listed in section 3, the purposes in section 5 and the recipients in section 7. We do not sell or share personal information as those terms are defined, and we do not use sensitive personal information. Send requests as described in section 11; an authorised agent may make a request on your behalf with your signed permission.
13. Children
ClashFree is a professional tool. It is not directed to children, and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
14. Cookies and local storage
This website sets no advertising or analytics cookies, and we show no cookie banner because we do not need one.
- Cloudflare Turnstile, the spam check on our forms, may set or read strictly necessary cookies or similar data to tell people from bots, under Cloudflare's privacy policy.
- Cloudflare may set strictly necessary security cookies when it protects the site from attacks.
- Your browser's local storage keeps one setting if you choose it: your light or dark colour theme (cf-theme). It never leaves your browser.
The website loads fonts from Google Fonts, which receives your IP address to deliver them.
15. Changes to this policy
We will update this policy as ClashFree changes and show the date at the top. If a change materially affects how we use data you already gave us, we will tell beta testers by e-mail or in the add-in before it applies.
16. Contact
Questions or requests about privacy: privacy request form or [email protected].