Your privacy at Adalense

We collect only the data needed to provide and bill the service. Four categories:

• Account data. First name, last name, email, company, phone (optional), password (bcrypt-hashed — we never see your password in clear text).
• Billing data. Postal address, Stripe customer ID. Your payment card details never pass through our servers — they are entered directly with Stripe (PCI-DSS level 1).
• License and usage data. License keys, named-seat assignments, machine IDs (each workstation's hardware UUID, linked to your license), and how the software is used: plugin connections (activation and periodic ping) plus a count of executions per module, per day and per workstation. This tells us when, from how many workstations and which SmartRouting modules are used. Never what you produce with it: no Revit modelling data, no file, project or network names, and not even which individual commands were run.
• Technical data. Server logs (IP, user agent, page, HTTP status) kept locally for diagnostics. Self-hosted, cookieless and aggregated audience measurement of the website (Umami), hosted by us and never shared. No advertising pixel, no third-party analytics tool.
• Workstations in an on-premise deployment. When your organisation hosts its own licensing server, that server sends us nothing. Each Revit workstation, however, sends us aggregated statistics: executions per module and plugin starts, per day, with the plugin and Revit versions. They are identified by your organisation's contract (the .lic licence file) and by a pseudonymous workstation fingerprint, computed on the workstation, specific to your organisation and renewed every calendar month (a workstation is not followed from one month to the next). The hardware UUID and the user's name and email address are not sent to us. Your IT department can turn this off at installation (USAGEREPORTING=0), and each user can object by unticking "Send anonymous usage statistics to Adalense" in the plugin's "User" window, or by writing to privacy@adalense.com. Separately, when a user opens the online help from the plugin, the help centre (help.adalense.com) receives the workstation's licence token, which carries the activation email address, to grant access without signing in; that address is not kept beyond the help session (12 h).

The data we collect is used only for the following purposes:

• • Provide and operate the SmartRouting service (authentication, license validation, downloads).
• • Handle billing, renewals and refunds through Stripe.
• • Provide technical support when you reach out.
• • Improve the product and size our support using usage statistics. These are tied to your account: they let us flag, for instance, when the number of workstations in use no longer matches the seats you subscribed to. In an on-premise deployment, they are tied to your organisation's contract and to workstation fingerprints, never to a person; we derive no individual measure of user activity from them.
• • Verify compliance with the licence terms (workstations actually in use versus seats subscribed). Legal basis: legitimate interest. No automated decision is made from this data; you may object by writing to us.
• • Keep you informed of Adalense news (products, releases, events), only if you ticked the box provided at sign-up. Legal basis: your consent, which you can withdraw at any time from your account settings or by writing to us. We keep the date of that consent and the version of the text you read.
• • Write to you for business-to-business (B2B) outreach, if your address is a professional one and the message relates to your trade. Legal basis: our legitimate interest. Each message states where your address comes from and unsubscribes in one click; your objection is applied immediately and your address is then kept on a suppression list so that we never write to you again.
• • Let our sales team find the emails one of our administrators has exchanged with you: when they open your record in our follow-up tool, they can display on screen, from their own Outlook mailbox, the subject, date, sender, recipient and a short preview of those messages. These messages are neither copied nor kept by Adalense; only your exchanges with that administrator are concerned. Legal basis: our legitimate interest (following up the business relationship).

Legal basis

We process your data on the basis of: (i) performance of the contract — to provide the service and handle billing; (ii) our legitimate interest — support and product improvement; (iii) our legal obligations — notably accounting and tax; (iv) your consent, where required.

Sharing with subprocessors

We rely on five technical subprocessors, each bound to Adalense by a GDPR-compliant data processing agreement:

• Stripe — payment processing and storage of payment methods. Data limited to email, billing address and customer ID.
• Microsoft (Entra ID, SharePoint, Graph) — federated authentication for our team (Entra ID), on-demand reading by an administrator of their own emails exchanged with a contact (Microsoft Graph), video appointment booking (Bookings, Teams). Data limited to professional email and tenant ID, and, if you book an appointment, your name, email and chosen time slot.
• OVHcloud (OVH SAS) — hosting of the website, its database and downloadable files (installers, templates, documentation). Since October 27, 2026: OVHcloud (OVH SAS), servers in France (Gravelines); previously IONOS.
• IONOS — company email, domain name and delivery of transactional emails. Data limited to the recipient email and message content.
• Brevo — Brevo (France): sending of newsletters, only to people who ticked the box provided at sign-up, and of business-to-business (B2B) outreach messages to contacts with a professional address. Data limited to the email address, first and last name, company, licence status, the source of the address and follow-up tags.

Adalense never sells, rents or transfers your data to third parties for commercial or advertising purposes.

For professional customers acting as data controllers, a Data Processing Agreement (DPA) compliant with Article 28 of the GDPR is available on request at privacy@adalense.com.

At any time you can exercise the following rights over your personal data:

• Right of access. Obtain a copy of the data we hold about you.
• Right to rectification. Correct any inaccurate or outdated data from your account area or by contacting us.
• Right to erasure. Request deletion of your account and associated data, subject to legal retention obligations (e.g. invoices).
• Right to portability. Retrieve your data in a structured, machine-readable format.
• Right to object. Object to the processing of your data on legitimate grounds, or withdraw consent.
• Right to restriction. Request restriction of the processing of your data in the cases provided for by the GDPR (e.g. when you contest the accuracy of the data).

To exercise any of these rights, write to us at privacy@adalense.com. You also have the right to lodge a complaint with your local data protection authority (CNIL in France — cnil.fr).

Your data security is enforced by dedicated technical and organisational measures:

• • TLS 1.2+ encryption required for every exchange between your browser and our servers.
• • Passwords stored exclusively as bcrypt hashes (adaptive cost, unique salt per password).
• • Short-lived authentication tokens (15 min access, 30-day refresh), rotated on each use, revoked on sign-out.
• • Database access restricted to the strict minimum, auditable logging of administrative actions.

Adalense only uses strictly necessary cookies. No advertising or third-party analytics cookies.

We use neither Google Analytics, Meta Pixel, nor any third-party cookie for audience measurement or advertising.

We keep your data only as long as needed for the stated purposes, or to comply with legal obligations:

• • Account data: as long as your account is active, plus 30 days after deletion to allow restoration in case of error.
• • Billing data: 10 years (French legal obligation).
• • Technical logs: 12 months maximum.
• • Plugin connection history and usage statistics (including those from on-premise workstations): 180 days, then automatically deleted.
• • Business contacts and newsletters: 3 years after the last active contact. After an unsubscribe, bounce or complaint, we keep only your address (in a normalised form) on a suppression list, in order to honour your refusal.
• • Emails viewed from a contact record: Adalense keeps no message, they are only displayed on screen. Only the administrator's access to their own mailbox is kept, encrypted, until they disconnect it.

Your data is hosted in the European Union. Some subprocessors (Stripe, Microsoft, Brevo) may operate or access data from countries outside the Union, notably the United States; for Brevo, this access (United States, Canada, India) is limited to customer support and maintenance. In that case, the transfer is governed by the Standard Contractual Clauses adopted by the European Commission.

For any question about your personal data or this policy:

For sales or product questions, please use the contact page.

We may update this policy to reflect changes to the product, to our infrastructure or to the law. Not all changes carry the same weight: we distinguish two cases.

• Substantial changes. Collecting data of a different nature from those described above (your project content, location, sensitive data), extending usage measurement to workstations or users it did not cover, pursuing a purpose unrelated to the service you subscribed to, adding a new processor receiving your data, or transferring it outside the European Union. These are notified by email to holders of an active account at least 30 days before they take effect.
• Scope clarifications. Clarifying processing already described, adjusting a retention period, or an editorial correction. These updates take effect as soon as they are published on this page.

In every case, the last-updated date is shown at the top of this page, and your right to object (section 3) remains open at any time by writing to privacy@adalense.com.