Privacy Notice
Last updated: October 2025
About this Privacy Notice
This Privacy Notice is meant to give you information about what personal data we collect about you, how we use it, why we use it, and how you control the data processing.
Executive Summary
We do not use your data to train AI models (or any other algorithm or software program), and we do not sell or share your personal data with any third parties for any independent use, including advertising or marketing. We share limited data with our service providers only to support our operations (e.g., hosting, analytics, and communications), under strict contractual confidentiality obligations.
1. The Basics
1.1 Who We Are
Bimrock Ltd. provides a software and AI based solution that assists architects, engineers and builders with creating, annotating and modifying Building designs through our plugin / platform. Our offices are located at Borochov St. 24, Jerusalem, Israel, and our registration number is 517102703.
If you have questions about our company or your privacy, or want to exercise your rights, you can contact us at contact@bimrock.ai.
1.2 Our Role: Controller and Processor
Certain data protection laws, including the laws in the EU, differentiate between a party that determines why and how personal data is processed (called a "controller" or a "database controller" in Israeli law) and a party that processes personal data solely on the controller's behalf and according to the controller's instructions (called a "processor"). We are the controller/database controller in respect of the processing described in this Privacy Notice. That said, in respect of certain personal data, we serve as a processor. Please see the section Personal Data We Collect as a Processor below.
1.3 Definitions and Recommendations
- When we refer to "services", we mean activities related to creating, annotating and modifying Building designs.
- When we refer to "personal data", we mean information that is defined as personal data under law. This includes information that identifies you directly or indirectly, including unique identifiers like IP addresses or cookie IDs.
- When we refer to "you", we mean visitors to our website and any user of our plugin/platform.
- In general, we recommend that you routinely review this privacy notice and your preferences on our plugin/platform.
1.4 A Note on Legal Bases
Certain jurisdictions only allow the processing of personal data where a legal basis has been established. Under the EU's General Data Protection Regulation ("GDPR"), the possible legal bases include (but are not limited to): your consent; the processing is necessary to perform a contract with you; the processing is necessary to fulfill our legal obligations; or a company has a legitimate business interest to process your personal data. Where we are a controller, we only collect and process data where we have established a legal basis. Below you can find more details about specific legal bases.
2. Personal Data We Collect as a Processor
We process certain personal data about our customers' end users/employees when we provide services to our customers. In that case, we serve as a processor and the customer serves as a controller. We process that data on behalf of the relevant customer and according to its instructions. If you are an end user/employee of one of our customers, we may process personal data about you that includes email addresses. We may share this data with the relevant customer. To learn more about our processing activities in this capacity or to exercise your privacy rights regarding them, please contact the applicable customer directly.
3. Personal Data We Collect as a Controller, How We Use It, and Why
Below is a description of the types of personal data we collect, how we use it, and the reason why we consider each use lawful. You have no legal obligation to provide us with personal data, but if you don't provide us with certain information, we may not be able to provide you with the associated services.
3.1 Website Visitors
When you visit our site, we may collect the following types of data about you.
3.1.1 Contact Form Information
When you send us a message through the contact form on our site, we collect any data you provide, such as your name, company, email, and the content of your message. When you sign up for our mailing list or request a demo, we collect your name and email address.
How We Use this Data: To respond to your message and to provide you with promotional materials we think may be of interest to you.
Legal Basis: We process this personal data based on the performance of a contract with you. Processing your Personal Data to share our newsletters/promotional materials is based on your consent. You may withdraw your consent at any time by emailing us at contact@bimrock.ai.
3.1.2 Activity and System Data (Including Cookies)
When you visit our site, we automatically collect data about your computer or mobile device, including personal data such as your IP address, device ID, browsing history (e.g. the other sites you've visited before ours), usage data, metadata, and your activity on our site (e.g. what pages you visited, for how long, and what links you clicked on). For more information about the cookies we use and how to adjust your preferences, see the Cookies and Similar Technologies section below.
How We Use this Data: We mainly use this data to generate aggregated analytics data about the use of our site so we can maintain and improve the site and develop new products or services. We also use statistical data to prevent fraud and protect the security of our site. Some cookies may be used to provide you with advertising for our products and services [or those of third parties], based on your preferences and interests. One of the tools we use to collect and analyze this data is "Google Analytics". For more information about how Google collects information and how you can control such use, see: https://policies.google.com/technologies/partner-sites.
Legal Basis: We process this personal data based on our legitimate interests to develop and improve our products and services, and to prevent fraud. When we collect your activity data to advertise to you, we do so on the basis of our legitimate interest to market our own products and services. We will process your request as soon as reasonably possible, however it may take a few days for us to update our records before any opt out is effective. Additional information regarding Our Marketing Activities is provided below.
3.2 Users
If you are a user of our plugin/platform, we collect the following information from and about you.
3.2.1 Registration Data
In order to access certain premium services of our plugin/platform, you must first create an account. When creating an account, you will be asked to provide your name and email address. [If you access our plugin/platform using a third-party login service (such as Autodesk, Facebook, Google, …), we also receive personal data about you from that service, such as names and email addresses.
How We Use this Data: We use your registration information to allow you to access our plugin/platform, save your preferences, protect the security of our plugin/platform, prevent fraud, and address any issues that arise. We use your contact details to communicate with you about our plugin/platform.
Legal Basis: When we process your registration data to provide you with our services, we do so to perform a contract with you, in this case our Terms of Service. When we process your registration data to maintain our plugin/platform, including to prevent fraud, protect the security of and/or address issues with our plugin/platform, we do so on the basis of our legitimate interest to maintain our assets. When we use your Personal Data to send you promotional materials relating to our services, we do so based on your consent. You may withdraw your consent at any time by emailing us at contact@bimrock.ai.
3.2.2 Materials You Upload
We collect any personal data that may be included in any materials, including images or documents you may upload to the plugin/platform.
How We Use this Data:
- To Provide Services: We use your Project Data solely to perform the functions you request, such as automatically generating annotations and dimensions. This processing occurs on our secure cloud infrastructure.
- Confidentiality: Your Project Data is your intellectual property. We treat it as confidential and do not use your Project Data to train our models/algorithms.
- Your Responsibility: When you upload Project Data that may contain third-party information (such as a client's address), you represent and warrant that you have the necessary rights and permissions to do so.
Legal Basis: We process the materials you provide to perform our contract with you, specifically, the Terms of Service.
3.2.3 Activity and System Data (Cookies)
We collect data about your device and your activity, as described more fully above in section 3.1.2, when you use our plugin/platform.
3.3 Job Applicants
3.3.1 Application Details
If you apply for a job with us, we collect the information you provide as part of your application and during the course of the application process. This may include your name, contact details, resume, recommendations, and any other information we may request or that you choose to share with us.
How We Use this Data: We use this data to process your job application, including using your contact details to contact you for scheduling purposes and to provide you with updates. We also use this data to manage our recruitment campaigns, as well as to analyze their results and improve future campaigns.
Legal Basis: When we use this data to process your job application, we do so based on performance of a contract with you or in order to take steps at your request prior to entering into a contract. When we use this data to manage our current campaigns and improve future campaigns, we process your application data based on our legitimate interest to attract and assess candidates for employment.
4. Our Marketing Activities
As described above, we may use personal data we collect for advertising and marketing purposes. We try to limit the marketing material we send to a reasonable and proportionate level. Below we describe how you can control the marketing material you receive from us.
4.1 Email Marketing and Services Communications
If you have provided your consent, we may use your contact details to send you informational newsletters [and other marketing material] about our products and services, as well as that of third parties. You may withdraw your consent at any time by emailing us at contact@bimrock.ai.
You can stop the delivery of all marketing emails by following the "unsubscribe" link in any messages we send you. Alternatively, you can contact us at contact@bimrock.ai to request to unsubscribe.
Note that if you are a registered user, we may need to contact you about administrative or service-related issues as part of the services we provide to you. This is not marketing communication and you will continue to receive these messages even if you opt-out of marketing emails.
4.2 Web Ads
We serve online ads based on the activity data we collect using cookies. You can change the way your browser manages cookies by adjusting the settings on your browser as explained below in the How to Adjust Your Preferences section.
6. International Transfers
Some of our service providers are located in countries other than your own. When we transfer your personal data internationally, we will do so safely and securely and in accordance with applicable law.
6.1 EU Transfers
If you are located in the EU, when we share your personal data with third parties based outside of the European Economic Area ("EEA"), we will ensure that they sign agreements that require them to comply with applicable law, keep your data secure at similar levels to the level described in this Privacy Notice, and make sure that your data protection rights are protected. We will also implement the following safeguards:
When we transfer your personal data to Israel or any other jurisdiction, as applicable, we rely on the decision by the European Commission that says that those countries are considered to provide an adequate level of data protection.
When we transfer your personal data to entities in the US that are covered under the Data Privacy Framework, we rely on the decision by the European Commission that says that these entities are considered to provide an adequate level of data protection.
Where we transfer your personal data to other countries, we (i) take additional security measures to protect the data and (ii) use specific contracts approved by the European Commission, known as the Standard Contractual Clauses, to give your personal data the same protection it has in the EEA.
Please contact us at contact@bimrock.ai if you would like further information on the specific mechanism used by us when transferring your Personal Data out of the EEA.
7. Security
The security of your personal data is our highest priority. We work hard to make sure that your personal data will be held securely and that it will not be shared or lost accidentally. However, it is impossible to guarantee absolute security. The security of your data also depends on the security of the devices you use and the way in which you protect your user IDs and passwords. The measures we take include:
7.1 Technical Measures
The electronic safeguards we employ to protect your personal data include secure servers, firewalls, and antivirus protections. We encrypt data in transit and at rest using secure protocols. Our infrastructure is hosted on Google Cloud Platform (GCP), which maintains industry-standard security certifications and employs advanced safeguards such as physical data center protections, network security, and continuous monitoring.
7.2 Access Control
We limit access to your personal data only to authorized personnel who have a need to know, including account managers, customer support staff, and software developers. We review these permissions regularly and revoke an employee's access immediately after his/her termination.
7.3 Internal Policies
We maintain and regularly review and update our privacy related and information security policies.
7.4 Personnel
We require employees to sign non-disclosure agreements according to applicable law and industry customary practice.
8. Your Rights - How to Control Our Use of Your Personal Data
[Depending on which laws apply, you have certain legal rights over your data. Below is some general information about rights that may apply to you but we recommend checking the law or consulting with a lawyer to understand what applies in your specific case. To exercise your rights, please contact us at contact@bimrock.ai. We may ask for reasonable evidence to verify your identity before we can comply with any request.
8.1 Right of Access
You may have a right to know what personal data we collect about you. We may charge you with a fee to provide you with this information, if permitted by law. If we are unable to provide you with all the information you request, we will do our best to explain why. See Article 15 of the GDPR for more details, if your personal data is subject to GDPR.
8.2 Right to Correct Personal Data
You may request that we update, complete, correct or delete inaccurate, incomplete, or outdated Personal Data. See Article 16 of the GDPR for more details, if your personal data is subject to GDPR.
8.3 Deletion of Personal Data ("Right to Be Forgotten")
If you are located in the EU, you may have the right to request that we delete your personal data. Note that we cannot restore information once it has been deleted. Even after you ask us to delete your personal data, we may be allowed to keep certain data for specific purposes under applicable law. See Article 17 of the GDPR for more details, if your personal data is subject to GDPR.
8.4 Right to Restrict Processing
If you are located in the EU, you may have the right to ask us to stop processing your personal data. See Article 18 of the GDPR for more details, if your personal data is subject to GDPR.
8.5 Right to Data Portability
If you are located in the EU, you may have the right to request that we provide you with a copy of the personal data you provided to us in a structured, commonly-used, and machine-readable format. See Article 20 of the GDPR for more details, if your personal data is subject to GDPR.
8.6 Right to Object
If you are located in the EU, you may have the right object to certain processing activities. See Article 21 of the GDPR for more details, if your personal data is subject to GDPR.
8.7 Withdrawal of Consent
If we are processing your data based on your consent, you are always free to withdraw your consent, however, this won't affect processing we have done from before you withdrew your consent.
8.8 Right to Lodge a Complaint with Your Local Data Protection Authority
If you are located in the EU, you have the right to submit a complaint to the relevant data protection authority if you have any concerns about how we are processing your personal data, though we ask that as a courtesy you please attempt to resolve any issues with us first.
8.9 Your Rights Under the CCPA
If you are a resident of the State of California, depending on the applicability of certain laws and exemptions, you may have certain rights over your data, as detailed in Annex A to this Privacy Notice.
9. Data Retention
9.1 General Retention
We retain your personal data as long as necessary to fulfill each of the purposes we described above.
9.2 Retention Considerations
When deciding how long to store personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized access, the purposes for which the personal data was collected, as well as applicable legal requirements. Please note that we may delete information from our systems without notifying you first. Retention by any of our service providers or subcontractors may vary in accordance with each business's retention policy.
9.3 Legal Requirements
In some circumstances, we may store your personal data even after we're finished using it if required to do so by law (e.g. to fulfill tax or audit requirements), or to keep accurate records of our interactions in case there is a prospect of litigation relating to your personal data. In such cases, we will maintain the same security measures as described above.
9.4 Uploaded Data
To speed up the processing of your requests, we may store the data you upload (e.g floor plan information) on our servers. All such data is deleted at most 60 days after the last relevant request has been completed.
9.5 Contact for Details
Please contact us at contact@bimrock.ai if you would like details about the retention periods for each type of personal data we process.
11. Third-Party Services
You may have access to third-party services through our services. Please note that all use of third-party services is at your own risk and subject to such third party's terms and privacy policies. We do not take any responsibility for the performance of other services.
12. Children
We do not knowingly collect nor transfer personal data from/of children under the age of sixteen (16). In the event that you become aware that an individual under the age of sixteen (16) has registered without parental permission, please advise us immediately.
13. Changes to the Privacy Notice
We may update this Privacy Notice from time to time to keep it up to date with legal requirements and the way we operate our business. We will place any updates on this webpage. Please come back to this page every now and then to make sure you are familiar with the latest version.
Annex A
Your Rights Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA)
If you are a resident of the State of California, depending on the applicability of certain laws and exemptions, you may have certain rights over your data. Below is some general information about rights that may apply to you. We recommend that you check the law or consult with a lawyer to understand what applies in your specific case. We may ask for reasonable evidence to verify your identity or to verify that you have been authorized to act on behalf of the relevant individual. For the purposes of this section, "personal data" shall have the meaning of "Personal Information" as defined under the CCPA.
1. Right to Know
You have the right to request that we disclose to you any or all of the following in respect of the 12-month period preceding your request:
- The specific personal data we have collected about you.
- The categories of personal data we have collected about you.
- The categories of sources from which we collected the personal data about you.
- The categories of third parties to whom we disclose personal data about you.
- The categories of personal data about you we have sold and the categories of third parties to whom we have sold such personal data.
- The categories of personal data about you we have disclosed for a business purpose and the categories of third parties to whom we have disclosed such personal data.
- Our business or commercial purpose(s) for collecting or selling your personal data.
2. Right to Delete
Subject to certain exceptions, you have the right to request that we or any of our service providers delete your personal data.
3. Right to Correct
You have the right to request that we correct any inaccurate personal data that we maintain about you, considering the nature of the personal data and the purposes of the processing of the personal data.
4. Right to Opt-Out of the Sale or Sharing of Personal Data
If you are 16 years of age or older or have consented to the sale of your personal data, you have the right to direct that we do not sell or share your personal data at any time. You may change your mind and opt back into the sale of your personal data at any time by contacting us. We may deny any request to opt-out of the sale of personal data that we deem in our good-faith, reasonable and documented belief is fraudulent.
5. Right to Limit Use and Disclosure of Sensitive Personal Data
To the extent we collect any sensitive personal data about you, you have the right to instruct us to limit our use of such personal data only to for the purpose of providing you with our services and certain business operation purposes.
6. Right to Non-Discrimination for Exercising your Consumer Privacy Rights
You have the right not to be discriminated against for exercising any of your consumer privacy rights, such as, not being denied any goods or services or charged different prices or rates.
7. How to Exercise your California Privacy Rights
Contact Information
To exercise any of the rights detailed above, please submit a verifiable request to us by contacting us at contact@bimrock.ai. You may only request to exercise your right of access twice within a 12-month period.
Submitting a Verifiable Request
In order to exercise your right to know or right to delete you must submit a request containing sufficient information that allows us to reasonably verify you are the person about whom we collected the applicable Personal Data or an authorized agent of such person, which may include details relating to your account. Any requests made through your password protected account will be verified through our existing authentication procedures for such an account.
Submitting Requests through an Authorized Agent
An authorized agent may exercise requests on your behalf. In order to exercise your right to know or right to delete through an agent, we may ask for reasonable evidence to verify your identity and the agent's identity, and written authorization permitting the agent to act on your behalf before complying with your request. In order to submit a request to opt-out of the sale of your personal data through an agent, we may ask for written authorization permitting the authorized agent to act on your behalf before complying with your request. We reserve the right to deny the request of any agent that does not provide proof that they have been authorized to act on behalf of the applicable consumer in accordance with applicable law.
8. The Past 12 Months
In the past 12 months we have not "sold" nor "shared" (as such terms are defined in the CCPA) any personal data about you. In the past 12 months, we have disclosed the following categories of personal data for a "business purpose" (as defined in the CCPA), all as specifically detailed in Section 2 of the Privacy Notice:
- Category A: Identifiers such as a real name, alias, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers.
- Category B: Any personal information described in subdivision (e) of Section 1798.80, such as his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.
- Category C: Characteristics of protected classifications under California or federal law, such as age, ethnicity, citizenship, religion or creed, marital status, physical illness, mental illness or disabilities, gender, veteran status.
- Category D: Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
- Category F: Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer's interaction with an internet website application, or advertisement.
- Category G: Geolocation data.
- Category H: Audio, electronic, visual, thermal, olfactory, or similar information.
- Category I: Professional or employment-related information.
- Category J: Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
- Category K: Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
- Category L: Sensitive personal information, such as a consumer's account log-in, access code, password, or credentials allowing access to an account or racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
3.4 Visitors to Our Social Media Pages
3.4.1 Visitors' Interactions
When you engage with our social media outlets, such as when you post on our Facebook or LinkedIn page, like, share, comment on our posts, answer surveys, or similar activities, we collect the personal data you provide, such as the content of your post and the information available to us through your profile or account. The social media companies we use may also provide us with aggregate and analytical information about activity relating to us.
How we use this data: We may use this information to engage with you or respond to your posts and comments and to analyze the effectiveness of our social media efforts and to improve how we manage them, and for marketing purposes.
Legal Basis: When we process your personal data to engage with you or respond to your posts and comments and to, we do so on the basis of our legitimate interest to engage with and serve our audiences in an effective manner. When we process your personal data to improve our social media outlets or for marketing purposes, we do so based on our legitimate interest to [effectively market our products and services,] improve our services, and develop new ones.