Privacy Policy

Last updated: September 27, 2026

The short version. TRACE is a bridge between Bluebeam Studio and Autodesk Construction Cloud®. TRACE reads markups from Bluebeam and writes issues to Autodesk on your behalf, using the Bluebeam and Autodesk accounts set up for your deployment. We never sell your data, and we use it only for the purposes listed in section 4. If you run TRACE self-hosted, none of your project content reaches us: the software sends us only a small daily operational record of identifiers and counts (section 3b), unless error reporting is turned on for a support case (section 3c). If we host TRACE for you, our server keeps the small amount of markup data the sync needs, described in section 2.

This policy explains what Platform AEC Inc. ("Platform AEC", "we", "us") collects, why, who we share it with, how long we keep it, and how you can have it deleted. It covers the TRACE software and the platform-aec.com website.

1. Who we are

Platform AEC Inc., a Delaware corporation.
Privacy contact: trace@platform-aec.com

2. How TRACE is deployed: this determines where your data lives

Mode	Where your project data goes
Self-hosted	TRACE runs entirely on your own Windows machine. Your credentials, sync state, sheet mappings and coordination records stay on that machine, and it moves content directly between your own Bluebeam and Autodesk accounts. None of your project content reaches our servers. The only thing the software sends us is the operational record in section 3b.
Cloud (hosted by us)	TRACE runs on a server we operate. To keep your Bluebeam session and Autodesk project in sync, it stores there: your OAuth tokens; sync state, which includes each markup's comment text and the title of the issue created from it; your sheet mappings; and coordination records (which also hold markup comment text, names people give coordination items, Revit element and model names captured or imported for them, and project names). We keep a backup copy of the sync state, sheet mappings and coordination records (not the tokens) in Microsoft OneDrive storage we control, so we can recover it. Markup thumbnail images are created or passed through the server on their way to your Autodesk project. To make one, the server may download the drawing file from Bluebeam into memory and render the relevant sheet, and the image sent to your Autodesk project can include a reduced view of that whole sheet. The drawing is held in memory only briefly and is not written to disk; we do not keep copies of your drawings, models or project files. The hosted engine also reports its own health (counts, error types, timings, project identifiers and, on engines configured for it, project names; no markup content) to our internal monitoring regularly, and its server logs record which Autodesk account is connected.

Mode

Where your project data goes

Self-hosted

TRACE runs entirely on your own Windows machine. Your credentials, sync state, sheet mappings and coordination records stay on that machine, and it moves content directly between your own Bluebeam and Autodesk accounts. None of your project content reaches our servers. The only thing the software sends us is the operational record in section 3b.

Cloud (hosted by us)

TRACE runs on a server we operate. To keep your Bluebeam session and Autodesk project in sync, it stores there: your OAuth tokens; sync state, which includes each markup's comment text and the title of the issue created from it; your sheet mappings; and coordination records (which also hold markup comment text, names people give coordination items, Revit element and model names captured or imported for them, and project names). We keep a backup copy of the sync state, sheet mappings and coordination records (not the tokens) in Microsoft OneDrive storage we control, so we can recover it. Markup thumbnail images are created or passed through the server on their way to your Autodesk project. To make one, the server may download the drawing file from Bluebeam into memory and render the relevant sheet, and the image sent to your Autodesk project can include a reduced view of that whole sheet. The drawing is held in memory only briefly and is not written to disk; we do not keep copies of your drawings, models or project files. The hosted engine also reports its own health (counts, error types, timings, project identifiers and, on engines configured for it, project names; no markup content) to our internal monitoring regularly, and its server logs record which Autodesk account is connected.

3. What we collect

a. Information you give us on this website

If you submit the Early Access or contact form, we collect the name, work email, company, and message you enter, plus which button you used (so we know what you were interested in). If you sign up for launch updates, we collect the email address you enter and use it only to send you TRACE updates; ask us and we will remove it. Our form provider may also record the IP address a form was sent from. We do not use advertising trackers. The site loads fonts from Google Fonts and plays demo videos from Loom, so those services receive your browser's IP address when a page or video loads.

b. Operational telemetry from the TRACE software

When TRACE runs, it sends a small operational record to us once at startup and then once every 24 hours. It contains the following, plus the time it was sent; our form provider also records the IP address it was sent from:

Licence identifiers: licence ID, customer ID, and licence tier.
A machine identifier: a one-way SHA-256 hash of your machine's hostname, operating system and architecture, truncated to 16 characters. It lets us tell installations apart. We do not receive your hostname itself, and we do not use this identifier to identify a person.
The Autodesk project ID and Bluebeam session ID TRACE is configured to sync.
The application version.
Two counts: how many markups have been synced, and how many sheets are mapped.

What this telemetry does NOT contain: no markup text, no comments, no drawing or model files, no thumbnails, no sheet contents, no names or email addresses of the people working on the project, and no Autodesk or Bluebeam credentials. It is a licence-and-usage heartbeat, not a copy of your work.

c. Error reports

If error monitoring is enabled on a deployment, error reports are sent to our error-monitoring provider so we can fix faults. A report may include the error message, a stack trace, the software version, the server's hostname, recent log lines (which can include the email address of the connected Autodesk account), and Bluebeam or Autodesk identifiers. We do not intend them to include markup content, but an error message can occasionally quote it. Performance tracing is switched off. On self-hosted installations error reporting is disabled unless it is explicitly turned on.

d. Credentials and tokens

To do its job, TRACE holds OAuth access and refresh tokens for the Bluebeam and Autodesk accounts set up for your deployment. These are stored as files on the machine running the engine: your machine in self-hosted mode, our server in cloud mode. We never see or store your passwords; authentication happens directly with Bluebeam and Autodesk.

e. Your project content

Self-hosted: none of your project content reaches us (unless error reporting is turned on, section 3c). Cloud mode: we store what section 2 lists (markup comment text, issue titles, sheet mappings and coordination records), and we use it only to run the sync for you. We do not keep copies of your drawings, sheets, models, or project documents. The content in your Bluebeam and Autodesk accounts stays governed by your agreements with Bluebeam and Autodesk.

4. Why we use it, and our legal basis

To deliver the service: keeping your Bluebeam session and Autodesk project in sync. (Performance of our contract with you.)
To validate licences and understand usage: so we know a licence is being used, on how many machines, and at what scale, for billing and support. (Legitimate interest / contract.)
To find and fix faults: error reports. (Legitimate interest.)
To reply to you: if you contact us or request Early Access. (Consent.)
To send you launch updates, but only if you signed up for them. (Consent.)

We do not sell your data. We do not share it for advertising. We do not profile you.

5. Who we share it with

We use a small number of established service providers, and we share only what each one needs. Autodesk and Bluebeam are listed for completeness: they are your own vendors, and TRACE sends them only what you direct.

Provider	What they receive	Why
Netlify	Website content; page-request logs, including visitors' IP addresses; contact-form submissions; telemetry records	Website hosting and form storage
Sentry	Technical error reports (when enabled); some internal alerts about engines we host	Error monitoring
DigitalOcean	Cloud-mode server data (tokens, sync state including markup comments and issue titles, server logs); our internal health monitoring	Hosting the cloud engine and our monitoring
Resend	Internal alert emails about the health of engines we host (identifiers and health details, no project content)	Alerting our team
Google Fonts	Your browser's IP address when a website page loads	Website fonts
Loom	Your browser's IP address when a demo video loads	Website demo videos
Microsoft (OneDrive, Microsoft 365 email)	Backup copy of cloud-mode sync state, sheet mappings and coordination records (no tokens); emails you send us and our internal alert emails	Recovery if the server is lost; email
Autodesk / Bluebeam	Data you direct TRACE to send to your own accounts	The integration itself

We may also disclose information if required by law, or in connection with a merger or acquisition, in which case you will be notified and this policy will continue to apply until you are told otherwise.

6. How long we keep it

Contact-form submissions and launch-update sign-ups: kept while we are in contact with you, and deleted when you ask us.
Telemetry records: kept until you ask us to delete them.
Error reports: kept for the retention period of our error-monitoring provider.
Engine health reports (cloud mode): kept in our internal monitoring; the detailed history is pruned regularly.
Server logs (cloud mode): kept for a limited period and rotated out.
Cloud-mode data (tokens, sync state, sheet mappings, coordination records): kept while your subscription is active. When it ends, we delete it from the server when you ask us. We delete off-box backup copies on a rolling basis, normally within about two months, and they may stay briefly in the storage provider's recycle bin after that; server backup images kept by our hosting provider may contain it until they are replaced or deleted.
OAuth tokens: You can revoke TRACE's access at any time: revoke its Autodesk access from your Autodesk account, remove TRACE's Bluebeam account from your Studio Session, or ask us to disconnect both. That stops TRACE renewing its access; access already granted expires within about an hour. In self-hosted mode you can also delete the token files or uninstall.
Self-hosted project data: stays on your machine; we hold none of it.

7. Your rights: how to revoke consent or have your data deleted

You can ask us at any time to:

Tell you what we hold about you.
Correct anything that is wrong.
Delete it: we will erase your contact record and telemetry history, and, for cloud customers, the data we hold on our server (backup copies, server logs and health history age out as described in section 6).
Withdraw consent or object to processing.
Receive a copy in a portable format.

To do any of these, email trace@platform-aec.com. We will respond within 30 days. There is no charge.

Self-hosted: to stop the software sending telemetry entirely, uninstall TRACE: the software then sends nothing further. Cloud customers: ask us to stop syncing your projects. You may also revoke TRACE's access at any time, as described in section 6. Once both its Autodesk and Bluebeam access are revoked and any access already granted has expired (within about an hour), TRACE can no longer read or write anything on your behalf.

Depending on where you live, you may have additional rights under the GDPR or the CCPA/CPRA. We honour these requests regardless of where you are.

8. Security

Traffic to Bluebeam, Autodesk and our public servers uses HTTPS/TLS. Other traffic between our own systems is encrypted (SSH) or stays on our hosting provider's private network.
A pre-commit check blocks credentials from being committed to source control, and our installer build fails if a secret is detected.
Access to our production server is restricted to key-based SSH, with a default-deny firewall.
Self-hosted deployments are the most private option: your project content does not reach us unless error reporting is turned on.

No system is perfectly secure. If we discover a breach affecting your personal data, we will notify affected users and the relevant authorities as required by law.

9. International transfers

We are based in the United States and our providers are primarily US-based, so data may be processed in the US. Where personal data is transferred out of the EEA or UK, we rely on the transfer mechanisms our providers offer, such as the European Commission's Standard Contractual Clauses and the UK Addendum.

10. Children

TRACE is professional construction software. It is not directed at children, and we do not knowingly collect data from anyone under 16.

11. Changes to this policy

If we make a material change, we will update the date at the top of this page and, where the change significantly affects you, notify you directly. Continued use of TRACE after a change means you accept the updated policy.

12. Contact

Platform AEC Inc.
trace@platform-aec.com