Privacy Policy
Draft for review. This describes what the service actually does, but it has not been reviewed by a lawyer. The retention periods in section 7 are proposed defaults — confirm they match what you actually do.
This policy explains what personal information GA Drawings Agent collects, why, and what we do with it. It is written to meet the New Zealand Privacy Act 2020 and its Information Privacy Principles.
1. Who we are
GA Drawings Agent is operated by BOA Studio Ltd, a company registered in New Zealand. We are the “agency” responsible for the personal information described here.
Contact: boa_studio@outlook.com
2. The most important thing
Your Revit model geometry never leaves your machine. The agent reads your model locally and sends only text-based context — sheet names, level names, room names and numbers, view types, grid references and similar descriptive data — to the planning service. No geometry, no families, no .rvt file, and no drawing content is transmitted or stored by us.
3. What we collect
Account information
- Your name and email address
- A cryptographic hash of your password — we never store the password itself, and cannot recover or read it
- If you sign in with Google: your email address, name and Google account identifier
Session information
- A session token stored in a cookie on your device
- Your IP address and browser user-agent string, recorded against active sessions so you and we can identify unfamiliar sign-ins
Billing information
- Your Stripe customer identifier, subscription status, plan, and renewal or trial end date
- We never see or store your card details. Payment pages are hosted by Stripe; card data goes directly to them and never touches our servers
- Stripe collects a billing address, which it uses to calculate GST
Licence keys
- A SHA-256 hash of your licence key, plus its last four characters for display
- When the key was created and last used
Planning jobs
- The text-based Revit context described in section 2, for the duration of the planning run
- The resulting drawing plan (the “manifest”), so your Revit panel can retrieve it after a disconnection
- A record of which account submitted which job, so nobody else can read your results
4. Why we collect it
| Information | Purpose |
|---|---|
| Name, email, password hash | Create and secure your account |
| Session token, IP, user-agent | Keep you signed in; detect unfamiliar access |
| Stripe customer & subscription | Take payment and decide whether your subscription is active |
| Licence key hash | Authenticate your Revit panel without storing a usable key |
| Revit text context | Generate your drawing plan — the core function of the service |
| Job ownership records | Ensure only you can read your planning results |
We do not sell personal information, and we do not use it for advertising or profiling.
5. Who we share data with
We use the following providers. Each processes data on our behalf, under their own terms.
| Provider | What they handle | Where |
|---|---|---|
| Cloudflare | Website hosting, application database, security filtering | Global edge network |
| Stripe | Payments, card data, invoices, tax calculation | United States and other regions |
| DigitalOcean | Hosting for the planning service | To be confirmed on deployment |
| Sign-in (only if you use it) and web font delivery | United States | |
| Beijing Zhipu Huazhang Technology Co., Ltd (Zhipu AI) | Generates the drawing plan from the text-based Revit context described in section 2 | China |
We may also disclose information where the law requires it, or to protect our legal rights.
6. Where your information is stored
Our providers store and process data outside New Zealand.
The planning service is provided by Zhipu AI, which processes data in China. The text-based context described in section 2 — sheet, level, room and view names and similar descriptive data — is sent there to generate your drawing plan. Your model geometry, families and .rvt files are not.
Account and billing information is handled by Cloudflare and Stripe, which process data in the United States and other regions. It is not sent to Zhipu AI.
By using the service you acknowledge these transfers. Laws in these countries may differ from New Zealand law, and in some cases may allow government access to data on terms different from those that apply here. If your client agreements restrict where project information may be processed, review section 2 and this section before using the hosted planning service, and contact us if you need to discuss it.
7. How long we keep it
- Account information — while your account exists, and for a short period afterwards in case of accidental deletion
- Sessions — 30 days, or until you sign out
- Billing records — seven years, as required by New Zealand tax law
- Planning results — retained on the planning service so you can retrieve them, then deleted
- Licence keys — until revoked or replaced
8. Your rights
Under the Privacy Act 2020 you may:
- Ask what personal information we hold about you, and get a copy
- Ask us to correct anything inaccurate
- Ask us to delete your account and associated data, subject to records we must keep for tax
- Complain to the Office of the Privacy Commissioner if you are unhappy with our response
Email boa_studio@outlook.com and we will respond within 20 working days.
If you are in the United Kingdom or European Economic Area, you may also have rights to data portability and to object to processing. The same address applies.
9. Cookies
We use one cookie: a session cookie that keeps you signed in. It is HttpOnly, Secure and SameSite=Lax, so it cannot be read by scripts and is not sent from other sites.
We use no analytics and no advertising cookies. Cloudflare may set a short-lived cookie as part of automated-traffic filtering. Web fonts are loaded from Google, which means Google receives your IP address when a page loads.
10. Security
- All traffic is encrypted in transit with TLS
- Passwords are stored only as salted hashes
- Licence keys are stored only as SHA-256 hashes; a full key is shown once, at creation, and cannot be recovered afterwards
- Card details never reach our systems
No system is perfectly secure. If a breach affects you, we will notify you and the Privacy Commissioner as the Privacy Act requires.
11. Children
This is a professional tool and is not directed at anyone under 16. We do not knowingly collect their information.
12. Changes
We may update this policy. Material changes will be notified by email or on this page, and the “last updated” date above will change.
13. Contact
Questions or privacy requests: boa_studio@outlook.com