How we use your data.

Who we are and what this covers

MicroEng Pty Ltd, Queensland, Australia ("MicroEng", "we", "us") makes software for the built environment. This policy explains how we handle personal information when you:

• visit microeng.app or ask for early access;
• create or use a MicroEng account, including subscriptions and billing;
• use MicroEng desktop (Directory, Vision and Automate), its Revit and Navisworks plugins, or the MicroEng web app at microeng.app/projects;
• use MicroEng Field on iOS or Android;
• use MicroEng AI;
• contact us for support or send a bug report.

Most people use MicroEng as part of an organisation, such as their employer, or on a project they have been invited to. That organisation decides who can see its projects and which features and integrations are switched on. You can raise questions about project content with that organisation or with us, and we will help either way.

Information we collect

Information you give us

• Early access: your work email address and, if you choose, your name, company, and what you would like to automate.
• Your account: your name, email address and user identifier, held by our sign-in provider, Auth0, and your role in your organisation and its projects.
• Billing: your name, email address, billing address and subscription details, held by Stripe. Card details go straight to Stripe; we never see or store full card numbers.
• Support and bug reports: anything you send us by email. A bug report from MicroEng desktop includes your description, contact email, the project and workflow names, and, if you choose, a screenshot of the MicroEng window and the app's logs.

Project content you and your team create

MicroEng stores the work you and your team create, such as workflows, documents and the text extracted from them, records and their history, assets, issues and comments, field notes, form submissions, photos, signatures, reports, 3D models and project locations. This can include personal information, for example:

• your name against the records you create, edit, review or are assigned;
• signatures, stored as the pen strokes together with the signer's name and time;
• contacts and other people your team enters, such as names, email addresses, phone numbers, companies, job titles and notes.

How you use MicroEng with your team

We record when you last signed in and when you were last active, and show other members of your organisation whether you are online. Organisation admins can see each member's name, email address, role and last activity, and can export the member list. When you work on a shared workflow, collaborators see your name, email address, cursor and selection.

Memory and expertise in MicroEng AI

If your organisation uses MicroEng AI's memory, it remembers useful facts from your projects, which can include facts about people, and keeps a short profile of each person's work that project collaborators can view. Only you can edit your own profile. MicroEng also builds an index of who has written about which topics, from the documents people create, so it can suggest who to ask. Your organisation can turn memory off.

Location and photos in MicroEng Field

On iOS and Android, if you allow location access, MicroEng Field reads your device's location:

• when you scan an asset code, and sends it to your project, which can save it as the asset's position;
• when you open a field capture, and saves it with the capture along with its accuracy;
• when you take a photo, and prints the time, street address and coordinates onto the photo;
• when you tap “Use my location” in a form.

Field reads location only while you are using it, never in the background. To turn coordinates into a street address, your device uses its own map service (Apple on iOS, Google on Android). On iOS and Android, hidden location data inside a photo file is removed before upload. If you use Field in a web browser, photos are uploaded as they are, including any location data your camera saved in the file. You can turn off location or camera access at any time in your device settings. MicroEng desktop does not read your computer's location.

Connected services

Your organisation can connect MicroEng to other services, such as Autodesk Construction Cloud, Aconex, Procore, Microsoft 365 (SharePoint, OneDrive and Outlook), Google Workspace (Drive, Sheets, Calendar and Gmail), Dropbox, Slack, Jira, ServiceNow, Revizto, Speckle, TeamBinder, ArcGIS and databases. MicroEng then reads and writes the information in those services that your workflows direct it to, which can include personal information held there. Information fetched from a connected service stays on your computer unless a workflow saves it to MicroEng's cloud. The sign-in details for connected services are encrypted on your computer and in MicroEng's cloud, so they follow you between devices.

If your organisation connects a vehicle or equipment tracking system, MicroEng stores the positions, speed, ignition and fuel data it reports, which can relate to the people using that equipment.

Technical information

Our hosting and service providers process technical information needed to run and protect our services, such as your IP address, browser and device type, timestamps, and security and error logs. Auth0 keeps a record of your sign-in sessions, which you can see and end from your account page. Our website uses your IP address for a few seconds to stop form spam; we do not store it. MicroEng desktop may send crash reports to Sentry, with email addresses, tokens and your computer's folder names removed. We do not use analytics or tracking tools in our apps.

How we use information

We use personal information to:

• provide MicroEng, including sign-in, running workflows, syncing your project content, and showing it to the people your organisation shares it with;
• provide MicroEng AI features you or your organisation use;
• manage subscriptions, billing and support;
• respond to early-access requests and send the updates you asked for;
• keep our services secure and detect spam, fraud or unauthorised access;
• fix problems and improve our services;
• meet legal, tax and accounting obligations.

We do not sell personal information, share it for targeted advertising, or use your content to train AI models.

MicroEng AI

When you use MicroEng AI, we send the content needed for your request to Anthropic's Claude models, through our servers and under our business account. Depending on what you ask, that can include your message and attachments, screenshots of MicroEng windows, workflows, document text and page images, records and photos, and the contact details and profiles of project members relevant to the request.

• Anthropic does not use content sent through its business services to train its models.
• To read text in scanned documents, MicroEng sends document pages and PDFs to Mistral, in the European Union. Your organisation can turn this off, and MicroEng then reads the text on your computer instead.
• Search across your documents runs inside our own database; that text is not sent to another provider.
• We keep a log of AI usage (the model, the amount used and its cost), not the content of your requests.
• AI chat conversations are deleted after 30 days. Memories are kept until your organisation removes them.
• If your organisation uses its own Anthropic API key, or you sign in with your own Claude account, requests go straight from your computer to Anthropic under your own agreement with them.
• Your organisation can turn MicroEng AI off entirely, or for particular projects or features.

Who we share it with

We share personal information only as needed to run MicroEng. The service providers we use today are:

• Supabase, Sydney, Australia: our database, file storage and server functions, including project content and early-access requests.
• Auth0 (Okta), United States: sign-in and account security.
• Stripe, United States and other countries: checkout, payments, subscriptions and invoices.
• Anthropic, United States: MicroEng AI.
• Mistral AI, European Union: reading text in scanned documents.
• Resend, United States: sending email, including invitations, workflow emails, bug reports, and copies of website form submissions to our support inbox.
• Cloudflare, global network: hosting, content delivery and security for our websites.
• Google, United States: maps, travel times and fonts in MicroEng desktop and the web app, which receive your IP address and the project locations shown.
• OpenWeather and NewsAPI: weather and news for a project's location in MicroEng desktop and the web app. They receive project locations and search terms, not your personal details.
• Sentry, United States: crash reports from MicroEng desktop, where enabled.

These providers process information for us under their own terms and security controls. We may also share information:

• with other members of your organisation and projects, as their sharing settings allow;
• with the services your organisation connects to MicroEng, when a workflow sends information to them;
• with professional advisers, such as accountants and lawyers;
• where the law requires it, or to protect our users, our services or our rights;
• with a buyer or successor if MicroEng is sold or restructured, under the same protections.

If you tap “Open in Maps” in MicroEng Field, the coordinates go to Apple Maps or Google Maps under their privacy policies.

Overseas processing

Our main database is in Sydney, Australia. Some providers process information outside Australia: mainly in the United States (Auth0, Stripe, Anthropic, Resend, Google and Sentry) and the European Union (Mistral). Cloudflare serves our websites from data centres around the world. We choose established providers with strong security and contractual protections for personal information.

Product updates and marketing emails

We send early-access invitations, release milestones and product news only to people who asked for them. Every such email says who it is from and includes a way to unsubscribe, and you can also unsubscribe by emailing us. Service messages about your account, security or billing are sent regardless, because they are part of providing the service.

How long we keep information

• Your account: until you delete it. Deleting your account from your account page on microeng.app cancels active subscriptions and permanently deletes your sign-in account.
• Project content: for as long as the project exists. Records you created in a shared project belong to that project and stay after you leave or delete your account; ask us if you want your name or details removed from them. When a project is deleted it is hidden straight away and its records are permanently deleted after 60 days.
• AI chat conversations: 30 days.
• Billing records: as long as tax and accounting law requires, generally five years in Australia. Stripe also keeps its own records.
• Early-access requests, support emails and bug reports: until you ask us to remove them, or they are no longer needed.
• Logs: for the periods our providers set, which are generally short.

Security and data breaches

We protect personal information with encryption in transit, verified sign-in, access controls, encryption of stored connection details, and providers with strong security practices. No service can be guaranteed to be completely secure. If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires, and anyone else the law requires us to notify, including under US state breach-notification laws.

Your choices and rights

Wherever you live, you can ask us to:

• tell you what personal information we hold about you, and give you a copy;
• correct information that is wrong, out of date or incomplete;
• delete your information, subject to what we must keep by law;
• stop sending you product update emails.

Email [email protected]. We may need to confirm your identity first, and we will respond within 30 days. Requests are free. You can browse our website without telling us who you are, but we need your email address to give you an account.

If you live in a US state with a consumer privacy law, you may also have rights to know, access, correct, delete and port your information, and to opt out of its sale, targeted advertising or profiling that produces legal or similarly significant effects. We do not do any of those three things. You can make a request yourself or through an authorised agent. If we decline a request, you can ask us to reconsider by replying to our decision; if you are still unhappy, you can contact your state's attorney general. We will not treat you differently for using your rights.

Do Not Track and Global Privacy Control

We do not track you across other websites, sell personal information, or let third parties collect it for advertising, so there is nothing for Do Not Track or Global Privacy Control signals to switch off. We treat a Global Privacy Control signal as a request to opt out, and our practices already meet it.

Automated decisions

One automated process can significantly affect you: if an organisation's subscription lapses, our systems automatically suspend access for its members until the subscription is paid. That decision uses the organisation's subscription and payment status from Stripe, and the billing contact's email address.

Otherwise, MicroEng applies rules your project sets up, such as flagging overdue items or marking a form as passed or failed, to project records, and people in your project review and act on them. MicroEng AI's profiles and expertise index help people find each other's work; we do not use them to make decisions about anyone.

Children

MicroEng is a professional tool and is not intended for anyone under 18. We do not knowingly collect personal information from children under 13. If you think a child has given us personal information, contact us and we will delete it.

Complaints

If you think we have mishandled your personal information, email [email protected]. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. If you are in the United States, you can contact your state's attorney general.

Changes to this policy

We will update this policy when our services or the law change, and post the new version here with a new date. If a change materially affects how we use your information, we will tell you by email or in the product before it takes effect.

Contact

MicroEng Pty Ltd, Queensland, Australia
[email protected]