Privacy Policy

This Privacy Policy explains how BasePointLabs ("we", "us", "our") collects, uses, shares, and protects personal data when you visit basepointlabs.io (the "Site") or use our software products and services, including the Revit plugin FlexiData (collectively, the "Service").

We respect your privacy and are committed to processing personal data in accordance with applicable data-protection law, including the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA/CPRA) where it applies to you.

---

1. Data Controller

The data controller responsible for your personal data is:

Taras Vyslotskyj, Individual Entrepreneur (ФОП) under the laws of Ukraine, trading as BasePointLabs
Postal address: see our imprint at basepointlabs.io/impressum
Email: support@basepointlabs.io

We have not appointed a Data Protection Officer because we are not legally required to do so.

2. What Personal Data We Collect

We collect the following categories of personal data:

2.1 Information you provide directly

• Purchase and customer data (once paid licenses are offered): name, the email address used for the purchase, and, for business customers, company name and VAT/tax ID where applicable. We do not operate customer accounts or logins on the Site; we identify you by the email address used for the purchase.
• Early-access list: if you join the early-access list on the Site, the data described in Section 12b.
• Communications: messages, support requests, and any information you choose to share when contacting us.
• Marketing preferences: your consent status for newsletters or product updates.

Providing a License Key and the email address used for the purchase is necessary to activate a paid license and to receive support for it; all other information is voluntary.

2.2 Payment data

We do not collect or store payment-card details. When paid licenses are offered, they are sold through Paddle (Paddle.com Market Limited and its affiliates) as reseller and Merchant of Record. Paddle collects the data necessary to process the payment, including billing name, billing address, country, and tax ID where applicable. See Paddle's privacy notice at https://www.paddle.com/legal/privacy.

We receive from Paddle limited transaction data (such as a transaction reference, license purchased, amount, country, and the email associated with the purchase) for our records, to issue the License Key, and for customer support.

2.3 Information collected automatically

• License-validation data: when you activate FlexiData with a license key, and about once a day afterwards while a connection is available, the plugin sends the License Key and a pseudonymous machine fingerprint to our licensing provider Keygen to activate the key on that computer and renew its license file. Keygen also receives the IP address of each request. The fingerprint is a one-way SHA-256 hash of the Windows machine ID (if that ID cannot be read, a hash of the computer name is used instead); it does not contain the machine ID or computer name in readable form, your user name, or any Revit project data. Because it is linked to a License Key, it is pseudonymous personal data, not anonymous data. We do not collect crash reports or session events from the plugin.
• Version-check ping: if you opt into "Check for updates on startup" inside the plugin's Legal panel (off by default), FlexiData makes a once-per-day HTTP request to the Autodesk App Store listing manifest to learn the latest published version. This call carries no personal data beyond the standard HTTP request (IP, user agent).
• Site usage data: when you visit the Site, our hosting provider processes your IP address, browser type and the pages requested to deliver the Site; with your consent, Google Analytics 4 collects usage data as described in Section 12b.

2.4 What we do not collect

• We do not collect, access, or store the content of your Revit projects, models, families, drawings, or other Customer Output.
• We do not use Customer Output to train any AI or machine-learning models.
• We do not collect special-category personal data (health, biometric, etc.).

3. Why We Process Your Data and the Legal Basis

4. Sharing Your Data

We share personal data only with the following categories of recipients, and only to the extent necessary:

• Paddle — payment processing, tax handling, fraud screening, invoicing (once paid licenses are offered).
• Keygen (keygen.sh) — license-key activation and validation for the FlexiData plugin: the License Key, the pseudonymous machine fingerprint, and the IP address of each request. Keygen processes this data on our behalf.
• Google — Google Analytics 4 (only with your consent) and Google Sheets / Google Apps Script for the early-access list (Section 12b).
• Hosting and infrastructure providers — for the Site and supporting services.
• Email-delivery providers — for transactional and (with consent) marketing emails.
• Customer-support tools — to manage support requests.
• Professional advisers — accountants, auditors, and lawyers, where required.
• Authorities — where we are required to disclose by law, court order, or lawful request, or to protect our rights, safety, or property.
• Successors — in connection with a merger, acquisition, or sale of assets, subject to confidentiality.

We do not sell or rent your personal data, and we do not share it for cross-context behavioral advertising.

A current list of our subprocessors is available on request from support@basepointlabs.io.

5. International Data Transfers

We are based in Ukraine; some of our service providers operate in the United Kingdom (Paddle), the European Union, the United States (Keygen, Google), or other countries. Where personal data is transferred to a service provider outside the European Economic Area or the United Kingdom, we rely on appropriate safeguards: the European Commission's Standard Contractual Clauses, as included in the provider's data processing agreement, the UK Addendum, or an adequacy decision of the European Commission where one exists for the recipient's country (for example for the United Kingdom, or for US companies certified under the EU-U.S. Data Privacy Framework).

You can request a copy of the safeguards we use by emailing support@basepointlabs.io.

6. How Long We Keep Your Data

We retain personal data only as long as necessary for the purposes set out in this Policy:

• Customer data — for as long as you hold a license, plus up to 24 months afterwards for legitimate business reasons (dispute resolution, audit).
• Transaction and invoicing data — for as long as required by applicable tax and accounting law.
• License-validation data — typically up to 24 months, then deleted or fully anonymized.
• Site analytics data — as described in Section 12b; at most 14 months.
• Early-access list — as described in Section 12b.
• Marketing-consent records — until you unsubscribe, plus a short period to evidence the withdrawal.

7. Cookies and Similar Technologies

The Site uses cookies and similar technologies. We classify them as:

• Strictly necessary — required for the Site to function (e.g. remembering your cookie choice). These do not require consent.
• Analytics — Google Analytics 4, which helps us understand how visitors use the Site (see Section 12b). Set only with your consent.
• Functional — remember your preferences (e.g. language). Set only with your consent.

We do not use advertising cookies or cross-site tracking. You can manage your cookie preferences via the cookie banner on the Site or via your browser settings.

8. Your Rights

Subject to applicable law, you have the following rights:

• Access (Art. 15 GDPR) — request a copy of your personal data.
• Rectification (Art. 16 GDPR) — correct inaccurate or incomplete data.
• Erasure (Art. 17 GDPR, "right to be forgotten") — request deletion of your data.
• Restriction (Art. 18 GDPR) — request that we limit how we process your data.
• Portability (Art. 20 GDPR) — receive your data in a structured, machine-readable format.
• Objection (Art. 21 GDPR) — object to processing based on our legitimate interests, including profiling.
• Withdraw consent — at any time, where processing is based on consent (without affecting the lawfulness of prior processing).
• Complain to a supervisory authority (Art. 77 GDPR) — in particular in the EU or EEA country where you live or work or where the alleged infringement took place. In Germany, these are the data protection authorities of the federal states; in Austria, the Datenschutzbehörde (DSB). In Ukraine, it is the Ukrainian Parliament Commissioner for Human Rights.

To exercise these rights, email support@basepointlabs.io. We will respond within the period required by applicable law (under GDPR, generally one month).

If you are a California resident, you have additional rights under the CCPA/CPRA (right to know, delete, correct, limit use of sensitive information, and non-discrimination). We do not sell or share personal information for cross-context behavioral advertising.

9. How We Protect Your Data

We use reasonable technical and organizational measures to protect personal data, including encryption in transit (HTTPS/TLS), encryption at rest where appropriate, access controls, and regular review of our security practices. No system is completely secure, and we cannot guarantee absolute security. If we become aware of a personal-data breach affecting you, we will notify you in accordance with applicable law.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Automated Decision-Making

We do not engage in automated decision-making that produces legal or similarly significant effects on you within the meaning of GDPR Article 22.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on the Site with a new "Last Updated" date. Material changes affecting how we process your data will be notified by email to customers holding an active license.

12a. FlexiData plugin — endpoints contacted and files written locally

For full transparency, the following table documents every network endpoint the FlexiData plugin may contact and every file it writes on the local machine.

Network endpoints

FlexiData does not send anonymous usage telemetry, crash reports, or session events.

Files written locally

All files live under %LOCALAPPDATA%\BasePointLabs\FlexiData\.

No file under %LOCALAPPDATA%\BasePointLabs\FlexiData\ contains Revit model data, family data, drawings, or other Customer Output.

12b. Website basepointlabs.io

This section describes specifically how the Site handles data.

Analytics

We use Google Analytics 4 to understand how visitors use the Site so we can improve it. Analytics runs under Google Consent Mode with all storage denied by default. No analytics cookie is set until you explicitly accept in the cookie banner. If you decline, or ignore the banner, no analytics or advertising storage is used.

• Legal basis: your consent (Art. 6(1)(a) GDPR; for storing and reading information on your device, the consent rules that implement Art. 5(3) of the ePrivacy Directive, in Germany § 25 TDDDG).
• No advertising, remarketing, or cross-site tracking.
• You can withdraw your consent at any time by clearing this site's data in your browser; the banner then asks again.
• Analytics data is processed by Google on our behalf and is not sold or shared with other third parties. Google may process it in the United States (see Section 5).

Early-access form

If you join the early-access list, we collect the email address and name you enter, plus the optional country, role, and company size. Submissions are stored in a private Google Sheet via Google Apps Script.

• We use this only to email you the FlexiData launch announcement and closely related early-access updates. Legal basis: your consent (Art. 6(1)(a) GDPR).
• We do not sell this data or use it for third-party advertising.
• We retain these details until the launch is complete or until you ask us to delete them, whichever comes first. You can ask us to remove them at any time by emailing support@basepointlabs.io.

13. Contact

For privacy questions or to exercise your rights:

BasePointLabs
Operator: Taras Vyslotskyj, Individual Entrepreneur (ФОП) under the laws of Ukraine
Postal address: see our imprint at basepointlabs.io/impressum
Email: support@basepointlabs.io