Privacy Policy — OSTACOLO

1. Introduction

This Privacy Policy explains how OSTACOLO ("the Add-in"), developed and published by AvantLeap ("we", "us", "our"), handles information when you install and use the Add-in within Autodesk® Revit®.

OSTACOLO is a Revit add-in for clash detection, tracking, and coordination management. It operates entirely on your local machine. AvantLeap does not operate any server that receives, processes, or stores your project data or personal information.

By installing and using OSTACOLO, you agree to the practices described in this policy. If you do not agree, do not install or use the Add-in.

2. Who Is the Data Controller

For the purposes of the General Data Protection Regulation (GDPR) and applicable data protection laws, AvantLeap is the data controller for any personal data processed by the Add-in.

Contact: Email: support@avantleap.com Website: https://www.avantleap.com

3. What Data the Add-in Processes

3.1 Data Stored Locally on Your Machine

When you run clash detection, the Add-in stores the following data in two locations on your machine:

a) Project JSON File Path: %USERPROFILE%\Documents\AvantLeap\Tools\Ostacolo\{ProjectName}\Revit{Version}\Clashes.json

Each clash record in this file contains:

Field	Description	Personal Data?
`globalClashId`	Integer identifier for the clash within the project	No
`localClashId`	Integer identifier within a building	No
`workflow`	Detection protocol used (e.g., Structural vs MEP)	No
`status`	Clash status: Open, In Progress, Closed, Ignored	No
`intersectionPoint`	XYZ coordinates of the clash location in the model	No
`description`	Free-text note added by the user	Potentially (if you write personal names)
`IDS`	Revit element ID strings of the two clashing elements	No
`size`	Volume of the clash intersection	No
`creationDate`	Date and time when the clash was detected	No
`releaseDate`	Date the clash was marked Closed or Ignored	No
`creator`	The Revit application username of the person who ran detection	Yes

The creator field captures the display name set in Revit's Options (typically the user's full name or network login). This is the only personal data field stored by the Add-in.

b) Revit Model Extensible Storage A subset of the same fields is also embedded in the Revit model file (.rvt) inside the clash sphere family instances using Revit's Extensible Storage API. This data travels with the Revit model file and is subject to the same access controls as the model itself.

3.2 Data Transmitted Externally — Autodesk Entitlement Check

When the Add-in loads at Revit startup, it performs a single license validation call to the Autodesk App Store Entitlement API:

GET https://apps.autodesk.com/webservices/checkentitlement
    ?userid={AutodeskLoginUserId}
    &appid={AppStoreAppId}

What is sent: Your Autodesk Account Login User ID (an anonymised identifier generated by Autodesk, not your name or email address) and the Add-in's App Store App ID.

Who receives it: Autodesk, Inc. — not AvantLeap. This request goes directly from your machine to Autodesk's servers.

What it does: Autodesk returns a boolean IsValid response indicating whether your Autodesk account has a valid purchase or subscription for this Add-in. AvantLeap does not receive, log, or store the User ID or the response.

Result caching: The result is cached in memory for the duration of the current Revit session only. It is not written to disk. The check is repeated the next time Revit starts.

Autodesk's privacy policy governs how Autodesk processes the User ID on their servers: https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement

3.3 Data We Do Not Collect

AvantLeap does not collect, receive, or have access to any of the following:

Your name, email address, or Autodesk account details
Your Revit project files or model data
Your clash detection results or JSON files
Analytics, telemetry, crash reports, or usage statistics
IP addresses or location data
Cookies or browser tracking of any kind

Processing activity	Legal basis
Storing the `creator` username in local clash records	Legitimate interest — identifying which team member detected a clash supports project coordination workflows. The user who runs detection is responsible for the data written on their machine.
Transmitting the Autodesk Login User ID to the Autodesk Entitlement API	Contractual necessity — verifying a valid purchase or subscription is a requirement of the Autodesk App Store distribution agreement.

5. Data Storage and Security

All project data created by the Add-in is stored exclusively on your local machine or within your Revit model file. AvantLeap has no access to this data at any time.

The security of the data is governed by:

Your Windows user account permissions and file system access controls
Your organisation's Revit model access and worksharing policies
Your organisation's network and device security policies

We recommend that you apply appropriate access controls to the JSON files stored in your Documents folder, consistent with the sensitivity of your project data.

AvantLeap does not share, sell, rent, or disclose any data from the Add-in to any third party.

The only external transmission performed by the Add-in is the Autodesk entitlement check described in section 3.2. That transmission goes directly from your machine to Autodesk — it does not pass through AvantLeap systems.

You may choose to share the JSON files generated by the Add-in with your project team (for example, to sync clash status updates between team members). Any such sharing is entirely within your control and at your discretion.

7. Data Retention

The Add-in does not manage a data retention schedule. Data persists as long as you choose to keep it:

JSON files remain in your Documents folder until you delete them manually or use your operating system's file management tools.
Extensible Storage data remains in the Revit model file until the model is purged or the elements are deleted.
In-memory entitlement result is discarded automatically when Revit closes.

Uninstalling the Add-in removes the software but does not automatically delete the JSON files in your Documents folder. You can delete them manually at the path described in section 3.1.

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights regarding the personal data processed by the Add-in:

Right	How to exercise it
Access	Because all data is stored locally on your machine, you can access it directly by opening the JSON file at the path described in section 3.1.
Rectification	You can edit or correct the `creator` field in the JSON file using any text editor, or update records through the Add-in's JSON Manager.
Erasure	You can delete individual clash records or the entire JSON file. Deleting the model also removes Extensible Storage data.
Restriction of processing	You can stop the Add-in from writing new clash records by not running the Find Clashes command.
Portability	The JSON file is a plain-text, open-format file. You can copy or transfer it freely.
Object	If you object to the `creator` field being populated, you may edit the JSON file after detection and replace the value with an anonymous identifier.

Because AvantLeap does not hold or receive your data, requests cannot be fulfilled by contacting AvantLeap directly — the data is on your machine and under your control. If you have a question about exercising these rights, contact us at support@avantleap.com and we will assist where possible.

9. International Data Transfers

The only data that leaves your machine is the Autodesk Login User ID sent to Autodesk's entitlement API (see section 3.2). Autodesk, Inc. is a US-based company. Your Autodesk account agreement and Autodesk's Privacy Statement govern any cross-border transfer of that identifier.

AvantLeap does not transfer any data internationally.

10. Children's Privacy

OSTACOLO is professional software designed for use in the Architecture, Engineering, and Construction industry. It is not intended for use by persons under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided personal data through use of this Add-in, please contact us at support@avantleap.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, where appropriate, notify users through the Autodesk App Store listing or our website. Continued use of the Add-in after a policy update constitutes acceptance of the revised terms.

12. Contact

For privacy questions, concerns, or requests:

AvantLeap Email: support@avantleap.com Website: https://www.avantleap.com

We aim to respond to all privacy-related enquiries within 10 business days.

Appendix — Technical Summary for Compliance Review

This appendix provides a concise summary for DPOs, IT security teams, and compliance reviewers.

Topic	Detail
Software type	Revit add-in (.dll), installed locally on Windows machines
Personal data collected	Revit display name of the user who runs clash detection (stored in local JSON files and Revit model Extensible Storage)
Data location	User's machine only — no AvantLeap cloud storage
External network calls	One call per Revit session to `apps.autodesk.com` (Autodesk Entitlement API)
Data sent externally	Autodesk Login User ID (anonymised account identifier) + App Store App ID — to Autodesk, not AvantLeap
Analytics / telemetry	None
Crash reporting	None
Cookies	None
Third-party SDKs with data access	None
GDPR legal basis	Legitimate interest (clash creator attribution) · Contractual necessity (entitlement check)
Data controller	AvantLeap — support@avantleap.com
Data processor	None (no AvantLeap-operated processing infrastructure)
Sub-processors	Autodesk, Inc. (entitlement check only, governed by Autodesk Privacy Statement)