Privacy Policy
Last updated: 7 October 2026
Who we are
AllAddin is operated by MeliUX Ltd, a company registered in England and Wales. When this policy says "we", "us", or "our", it means MeliUX Ltd.
What we collect and why
| Data | When | Why | Lawful basis |
|---|---|---|---|
| Email address, optional note | You submit the waitlist form | So we can get in touch about access | Consent (you clicked the button) |
| IP address, user-agent string | Every request to our server | Rate limiting, spam prevention, security | Legitimate interest |
| Your Revit prompt (natural-language text) | You send a command via the add-in | To generate a response from the AI model | Contract performance |
| A structured abstraction of your model context | With each prompt | Gives the AI enough context to write working code | Contract performance |
| The generated code, its error text and what it printed | When the AI fixes an error or summarises a result | To fix the error or tell you what happened. Printed output can include values the script read from your model. Passed to the AI provider and not stored by us beyond the call. | Contract performance |
| What a feature you use needs to do its job | When you use it: exporting a room data sheet (the per-room values in it), dashboard narration (the differences between two snapshots), exporting a dashboard table to Excel (that table), a compliance check or RFI draft (the EIR document, the model title and element names), Keynote suggestions (element and keynote descriptions). | To build the file, text or result you asked for. Processed on our backend and, where AI is involved, by Anthropic or Mistral; not stored by us after the response. | Contract performance |
| Procurement records (costs, quantities, suppliers, approvals, approver names) and saved compliance rule libraries | When you save them, or import a room data sheet workbook that carries them | So your procurement register and rule libraries are there next time. | Contract performance |
| Token hash, request timestamps, token counts | Each API call | Usage tracking, rate limits, abuse prevention | Legitimate interest |
| Prompt, generated code, and execution outcome (improvement corpus) |
After a turn completes, unless you have turned it off.
To turn it off, set share_tricks = false under
[privacy] in
%APPDATA%\AllAddin\alladd.ini. Administrators can
switch it off for every user by deploying
suppress_background_egress = true in the same
section of each user's alladd.ini.
|
Reviewing what worked and what failed so the assistant improves. Identifying fields (file path, document title, worksharing username, project name/number) are redacted by default before any of this leaves your machine. Your original prompt is kept only against your own account and is never shared into the pooled corpus other people retrieve from. | Legitimate interest (improving the product; you can object at any time using the setting above) |
| A published dashboard workspace (share link) | Only when you explicitly publish a share link ("Share Workspace") from a dashboard. | So a recipient can open a frozen snapshot of the dashboard you chose in a browser. The payload is AES-256-GCM encrypted on your device before it is uploaded and stored as ciphertext only in an EU-jurisdiction Cloudflare R2 bucket. It can include 3D geometry (included by default) and the parameter values the dashboard shows. It auto-expires (30-day default) and is revocable by you at any time. Never the underlying Revit file itself. | Consent (you clicked Share) |
| Your practice's detail library (DetailLibrary extension) | Only when you or your practice's library admin explicitly add a drafting view to the practice's detail library ("Add to library" or "Submit for review"), or when you save a private detail to your own stash. | So everyone in your practice can place the same standard details. Each detail is packaged on your machine into a small Revit file that contains that one drafting view, with a thumbnail image and a record (the detail's id, name, tags, scale, who added it and when). These files are stored in an EU-jurisdiction Cloudflare R2 bucket, isolated per practice, served only through time-limited links to tokens of that practice, and deleted when your practice's admin removes the detail or the practice asks us to delete its library. They are the only Revit files we store, and they never contain your project model. | Consent (you or your admin clicked Add / Submit / Save) |
| Snapshot of your Revit model metadata (legacy upload) | The dashboard snapshot-upload button was removed in July 2026. This row covers snapshots uploaded by earlier versions, which always required an explicit click. (Publishing a share link, above, is a separate, encrypted path.) | Cross-time analytics, diff reports, and team dashboards. Contains element identifiers, categories, levels, and the parameters you selected when capturing the snapshot. Never the underlying Revit file itself. | Consent (you clicked upload) |
What we do NOT collect
- We do not collect your Revit project files, drawings, or BIM models. Your files stay on your machine. The one Revit file we hold is a detail your practice adds to its detail library: a small file containing that single drafting view, listed above.
- We do not upload your model files. Model-derived data leaves your machine only in the requests and features listed above - for example a script's printed output when the AI summarises a result, or the values in a room data sheet you export. A share link is encrypted on your device first and we store only ciphertext. A detail library file holds one drafting view your practice chose to share with itself, never the model it came from. The legacy dashboard snapshot-upload button was removed in July 2026.
- We do not use cookies, third-party tracking pixels, or third-party analytics. The homepage video thumbnail loads from YouTube's image server, and the video itself from youtube-nocookie.com only when you press play. Marketplace pages load two open-source script libraries from the jsDelivr CDN.
- We do not share or sell your data to advertisers.
- We do not use your prompts or model metadata to train AI models, and your content is contractually excluded from training by both of our AI providers (Anthropic and Mistral).
Server-side page-view logging
We log aggregate page-view statistics server-side for the alladdin.dev website (not the AllAddin add-in). No cookies, no JavaScript beacons, no tracking pixels: a server-side middleware records one row per HTML page render with the URL path, response status, referrer host, and UTM source if present. Your IP address and user-agent string are not stored in plaintext; they are hashed with a daily-rotating salt (for unique-visitor counts) and a two-hour-rotating salt (for sessionising consecutive pageviews). Those hashes are not persistent identifiers and cannot be used to track you across days or devices. Bots (Googlebot, GPTBot, LinkedInBot, etc.) are detected from the user-agent string and flagged so we can separate crawler traffic from human traffic in our dashboards.
Sub-processors
Our backend and its databases run on Railway in the EU (Netherlands); a replica of our production web service runs in the US (Virginia). Chat answers come from Anthropic (US). Requests that fix an error, summarise a result or tag a failure can be processed by Mistral (France, EU) instead, and Keynote suggestions use Mistral for search embeddings.
The current list of third-party services that process personal data on our behalf is on our live sub-processor register. Each sub-processor operates under its own Data Processing Agreement, which includes UK/EU Standard Contractual Clauses (SCCs) or an International Data Transfer Agreement (IDTA) covering transfers outside the UK. The DPA link for each provider is on the register.
How long we keep it
- Waitlist entries - kept until you ask us to remove them, or until we contact you and you decline.
- Audit logs (request timestamps, token usage, IP address) - automatically pruned after 90 days. The audit row stores a one-way hash of your prompt, not its text.
- Security events (failed auth, rate-limit hits) - automatically pruned after 90 days.
- Prompts sent to the AI - the request body is not stored by us beyond the API call. Both Anthropic and Mistral run on zero-data-retention for our account, so neither keeps your prompt once the response is returned, and neither uses it to train models.
- Improvement-corpus submissions (prompt, generated code, outcome - on by default; the table above shows how to turn it off) - kept against your account; they do not expire automatically. Patterns pooled across accounts are stored without your prompts. Email us to have your submissions deleted at any time.
- Published share-link payloads - stored as ciphertext for the link's lifetime (30-day default). Deleted at once when you disable the link; after it expires, deleted by a nightly clean-up within a day. The link record, without its content, is kept for 180 days.
- Procurement records and saved rule libraries - kept until you delete them. Deleting hides a record; email us and we purge it.
- Snapshots (uploaded by earlier versions) - automatically deleted after 365 days, or earlier if you email us a deletion request.
Your rights
Under UK GDPR you can:
- Access - ask what data we hold about you.
- Erasure - ask us to delete your data.
- Portability - ask for a machine-readable copy of your data.
- Object - object to processing based on legitimate interest.
- Complain - file a complaint with the Information Commissioner's Office (ICO).
To exercise any of these, email us at hello@alladdin.dev with "Privacy request" in the subject line. We will acknowledge within 7 days and respond in full within 30 days.
Changes to this policy
We may update this policy as AllAddin evolves. Material changes will be posted here with an updated date. We will not reduce your rights without notice.