Privacy Policy

Vemvio is the data controller for the personal data we process about website visitors, prospective customers, business contacts and platform users’ account information, as described in this policy.

When an organisation (“Customer”) uploads documents, models, drawings or other content to the platform, the Customer is the data controller for that content, and Vemvio acts as data processor on the Customer’s behalf in accordance with our data processing agreement (DPA).

Company

Vemvio

Email

support@vemvio.com

This policy applies to:

• the website vemvio.com and its subpages;
• the Vemvio platform, including the web application, APIs, AI agents, browser extension and integrations;
• communication with us by email, demo and partner requests, support and events.

It does not apply to third-party services that you connect to the platform (for example Autodesk Construction Cloud, Microsoft SharePoint or external MCP servers). Those services are governed by their own privacy policies.

Depending on how you interact with us, we process the following categories of personal data:

• Account and identity data: name, work email, organisation, job role, Microsoft Entra ID object ID and your roles in hubs and projects.
• Customer Content: documents, BIM models, drawings, images, chat messages, prompts, uploaded files and AI-generated output that you or your organisation add to the platform. Customer Content may incidentally contain personal data, such as names in a document.
• Integration data: access tokens and metadata needed to connect third-party services you authorise, such as Autodesk Platform Services or Microsoft SharePoint. Tokens are stored encrypted and used only to perform actions you request.
• Technical and usage data: IP address, browser and device type, timestamps, error logs, security events and feature usage needed to operate, secure and bill the service.
• Website and marketing data: information you submit through the demo or partner form (name, work email, company and optional message) and — only with your consent — Google Analytics data about how the website is used.
• Communication data: the content of emails and support requests you send us.

We do not intentionally collect special categories of personal data (Article 9 GDPR) or data about criminal offences. Do not upload such data to the platform unless your organisation has a lawful basis and has agreed this with us in writing.

We process personal data only for specified purposes and on a lawful basis under Article 6 of the GDPR:

• To provide the platform and perform our agreement with you or your organisation, including sign-in, storage, AI features, integrations and support — Article 6(1)(b).
• To keep the service secure and reliable, prevent abuse, fix errors and keep audit logs — our legitimate interest, Article 6(1)(f).
• To respond to demo and partner requests and communicate with business contacts — our legitimate interest in B2B communication, Article 6(1)(f).
• To measure website traffic with Google Analytics — only on the basis of your consent, Article 6(1)(a) and the Danish Cookie Order.
• To comply with legal obligations, such as bookkeeping and responding to lawful requests from authorities — Article 6(1)(c).

Where we rely on legitimate interest, we have balanced our interest against your rights and freedoms. You can object at any time (see section 11).

Vemvio uses large language models to provide AI features such as chat, document analysis, model queries and report generation.

• We do not use Customer Content, prompts or output to train, fine-tune or otherwise develop AI models — neither our own nor third-party models.
• We use AI providers only under commercial or enterprise terms in which the provider commits not to use our customers’ inputs or outputs to train its models.
• Content is sent to an AI model only when needed to answer a request made by you or your users, and only the content needed for that request.
• AI providers may retain inputs and outputs for a limited period (typically up to 30 days) solely to detect abuse and comply with law, after which they are deleted.
• We do not use AI to make decisions that produce legal or similarly significant effects for you (Article 22 GDPR).

We may use aggregated technical metrics that contain no Customer Content — for example response times, error rates and feature usage counts — to operate the service and improve its reliability.

Customer Content and account data are stored in the European Union. The platform’s databases, file storage, search indexes and application servers run in Microsoft Azure’s North Europe region (Ireland). AI models (Google Gemini and Anthropic Claude) are accessed through Google Cloud Vertex AI and called in EU regions wherever the model is available there.

If a sub-processor processes data outside the EU/EEA, for example because a model is not yet offered in an EU region, such transfers take place only on the basis of a valid transfer mechanism under Chapter V of the GDPR, such as the European Commission’s adequacy decision for the EU–US Data Privacy Framework or the EU Standard Contractual Clauses, supplemented by additional safeguards where necessary.

Organisations that require all processing to take place within the EU/EEA can contact us to discuss an EU-only configuration.

We use carefully selected sub-processors that are bound by data processing agreements. The main ones are:

• Microsoft Azure (Microsoft Ireland Operations Ltd.) — hosting, databases, file storage, search, embeddings and identity (Entra ID). Location: EU (Ireland).
• Google Cloud Vertex AI (Google Cloud EMEA Ltd.) — AI language models (Google Gemini and Anthropic Claude, both provided through Vertex AI) and speech. Location: EU regions where available.
• Browserbase — isolated browser sessions for web tasks you request. Location: EU (Frankfurt).
• Google Analytics (Google Ireland Ltd.) — website statistics on vemvio.com, only with your consent.

An up-to-date list of sub-processors, including their locations, is available on request at support@vemvio.com. Customers with a DPA are informed of changes to sub-processors in accordance with the DPA.

We keep personal data only as long as necessary for the purposes described:

• Customer Content: for the duration of the agreement. After termination it is deleted within 30 days unless the Customer requests an export or longer retention is required by law. Backups are overwritten in line with our backup cycle of up to 35 days.
• Account data: while the account is active and up to 30 days after it is closed.
• Technical logs and security events: typically up to 90 days, longer if needed to investigate a security incident.
• Demo and partner requests: up to 24 months after our last contact.
• Google Analytics data: up to 14 months.
• Accounting records: 5 years from the end of the financial year, as required by the Danish Bookkeeping Act.

We never sell or rent personal data. We share data only:

• with sub-processors who process data on our behalf and on our instructions;
• with third-party services that you or your organisation choose to connect;
• with your organisation’s administrators, who can see data in the hubs and projects they manage;
• with public authorities, courts or professional advisers where required by law or necessary to establish, exercise or defend legal claims;
• in connection with a merger, acquisition or sale of assets, subject to confidentiality and this policy.

We use appropriate technical and organisational measures to protect personal data, including:

• encryption in transit (TLS 1.2 or higher) and encryption at rest;
• single sign-on via Microsoft Entra ID and role-based access control at hub and project level;
• separation of data per organisation and project;
• isolated sandboxes for code execution and web browsing;
• least-privilege access for staff, logging and monitoring;
• regular updates and vulnerability management.

No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the Danish Data Protection Agency and — where required — the affected Customers or individuals without undue delay.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data rectified;
• have your data erased;
• restrict processing;
• data portability;
• object to processing based on legitimate interest;
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, write to support@vemvio.com. We respond within one month. If your request concerns Customer Content, we will forward it to the organisation that controls that content.

You can lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk, or with the supervisory authority in the country where you live or work.

Cookies are small text files stored in your browser. We use the following categories:

• Strictly necessary (always on): sign-in and session cookies, your language preference and the record of your cookie choice (stored in your browser for 12 months). These are required for the site to work and do not require consent.
• Statistics (optional): Google Analytics 4 (_ga and _ga_<ID>, expire after 13 months). Set only if you accept. Google Analytics 4 does not log or store IP addresses, Google signals and ad personalisation are disabled, and data is kept for 14 months.
• Marketing: not used. We do not use advertising or remarketing cookies, and Google’s advertising signals are always denied.

Until you consent, Google Analytics runs in Consent Mode with all storage denied and sets no analytics cookies. The logged-in platform does not use Google Analytics.

You can change or withdraw your consent at any time via “Cookie settings” below or in the footer of every page. When you withdraw consent, the analytics cookies are deleted.

The platform is intended for businesses and professional users. It is not directed at children, and we do not knowingly collect personal data from persons under 18.

We may update this policy to reflect changes in the service or in the law. The date at the top shows when it was last updated. Material changes are notified to Customers by email or in the platform before they take effect.

Questions about this policy or our processing of personal data can be sent to support@vemvio.com. Please write “Privacy” in the subject line.