Privacy Policy

Last updated: July 13, 2026

The short version. TRACE is a bridge between Bluebeam Studio and Autodesk Construction Cloud®. We never collect your markups, drawings, models, or project files. TRACE reads them from Bluebeam and writes to Autodesk on your behalf, using your own accounts - the content passes between those two services and is never stored by us. If you run TRACE self-hosted, your project data never leaves your own network at all.

This policy explains what Platform AEC Inc. ("Platform AEC", "we", "us") collects, why, who we share it with, how long we keep it, and how you can have it deleted. It covers the TRACE software and the platform-aec.com website.

1. Who we are

Platform AEC Inc., a Delaware corporation.
6205 Halifax Ave S, Edina, MN 55424, United States.
Privacy contact: privacy@platform-aec.com

2. How TRACE is deployed - this determines where your data lives

Mode	Where your project data goes
Self-hosted	TRACE runs entirely on your own Windows machine. Your credentials, sync state, sheet mappings and coordination records stay on that machine. Your project data never reaches our servers.
Cloud (hosted by us)	TRACE runs on a server we operate. Your OAuth tokens and sync state are stored there so the engine can keep your Bluebeam session and Autodesk project in sync. Markups and drawings still move directly between Bluebeam and Autodesk - we do not retain their content.

3. What we collect

a. Information you give us on this website

If you submit the Early Access or contact form, we collect the name, work email, company, and message you enter, plus which button you used (so we know what you were interested in). That is the only information the website collects from you. We do not use advertising trackers.

b. Operational telemetry from the TRACE software

When TRACE runs, it sends a small operational record to us once at startup and then once every 24 hours. It contains exactly the following:

Licence identifiers - licence ID, customer ID, and licence tier.
A machine identifier - a one-way SHA-256 hash of your machine's hostname, operating system and architecture, truncated to 16 characters. It lets us tell installations apart. It cannot be reversed to reveal your hostname, and we cannot use it to identify a person.
The Autodesk project ID and Bluebeam session ID TRACE is configured to sync.
The application version.
Two counts - how many markups have been synced, and how many sheets are mapped.

What this telemetry does NOT contain: no markup text, no comments, no drawing or model files, no thumbnails, no sheet contents, no names or email addresses of the people working on the project, and no Autodesk or Bluebeam credentials. It is a licence-and-usage heartbeat, not a copy of your work.

c. Error reports

If error monitoring is enabled on a deployment, technical error reports (the error message, a stack trace, and the software version) are sent to our error-monitoring provider so we can fix faults. Performance tracing is switched off. On self-hosted installations this is disabled unless it is explicitly turned on.

d. Credentials and tokens

To do its job, TRACE holds OAuth access and refresh tokens for your own Bluebeam and Autodesk accounts. These are stored as files on the machine running the engine - your machine in self-hosted mode, our server in cloud mode. We never see or store your passwords; authentication happens directly with Bluebeam and Autodesk.

e. What we never collect

We do not collect, store, or process the content of your markups, drawings, sheets, models, or project documents. TRACE reads them from Bluebeam and writes issues to Autodesk in real time, using your accounts. That content is governed by your agreements with Bluebeam and Autodesk, not by us.

4. Why we use it, and our legal basis

To deliver the service - keeping your Bluebeam session and Autodesk project in sync. (Performance of our contract with you.)
To validate licences and understand usage - so we know a licence is being used, on how many machines, and at what scale, for billing and support. (Legitimate interest / contract.)
To find and fix faults - error reports. (Legitimate interest.)
To reply to you - if you contact us or request Early Access. (Consent.)

We do not sell your data. We do not share it for advertising. We do not profile you.

5. Who we share it with

We use a small number of service providers, and we share only what each one needs. We require every processor to provide protection for your data equivalent to that described in this policy, to process it only on our instructions, and to keep it confidential.

Provider	What they receive	Why
Netlify	Website content; contact-form submissions; telemetry records	Website hosting and form storage
Sentry	Technical error reports (when enabled)	Error monitoring
DigitalOcean	Cloud-mode server data (tokens, sync state)	Hosting the cloud engine
Autodesk / Bluebeam	Data you direct TRACE to send to your own accounts	The integration itself

We may also disclose information if required by law, or in connection with a merger or acquisition - in which case you will be notified and this policy will continue to apply until you are told otherwise.

6. How long we keep it

Contact-form submissions: kept while we are in contact with you and for up to 24 months afterwards, then deleted.
Telemetry records: kept for the life of your licence and for up to 12 months after it ends, then deleted.
Error reports: retained for up to 90 days, then automatically deleted.
OAuth tokens: kept only while TRACE is configured to sync. You can revoke them at any time from your Bluebeam or Autodesk account, which immediately ends our access. In self-hosted mode you can simply delete the token files or uninstall.
Self-hosted data: we hold none of it, so there is nothing for us to retain.

7. Your rights - how to revoke consent or have your data deleted

You can ask us at any time to:

Tell you what we hold about you.
Correct anything that is wrong.
Delete it - we will erase your contact record and telemetry history.
Withdraw consent or object to processing.
Receive a copy in a portable format.

To do any of these, email privacy@platform-aec.com. We will respond within 30 days. There is no charge.

To stop the software sending telemetry entirely, uninstall TRACE - the software then sends nothing further. You may also revoke TRACE's access from your Bluebeam and Autodesk accounts at any time, which immediately and permanently ends its ability to read or write anything on your behalf.

Depending on where you live, you may have additional rights under the GDPR or the CCPA/CPRA. We honour these requests regardless of where you are.

8. Security

All traffic to Bluebeam, Autodesk and our servers uses HTTPS/TLS.
Credentials are never committed to source control, and our build process fails if a secret is detected.
Access to our production server is restricted to key-based SSH, with a default-deny firewall.
Self-hosted deployments are the most private option - the data never leaves your network.

No system is perfectly secure. If we discover a breach affecting your personal data, we will notify affected users and the relevant authorities as required by law.

9. International transfers

We are based in the United States and our providers are primarily US-based, so data may be processed in the US. Where personal data is transferred out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

10. Children

TRACE is professional construction software. It is not directed at children, and we do not knowingly collect data from anyone under 16.

11. Changes to this policy

If we make a material change, we will update the date at the top of this page and, where the change significantly affects you, notify you directly. Continued use of TRACE after a change means you accept the updated policy.

12. Contact

Platform AEC Inc.
6205 Halifax Ave S, Edina, MN 55424, United States
privacy@platform-aec.com