Privacy Policy

Biminent EOOD, Bulgaria, is responsible for the personal information described here. This notice covers biminent.com, our customer portal, and the licensing and diagnostics services used by Biminent add-ins. Contact us at support@biminent.com about privacy or your rights.

Where we process customer project information solely on a customer’s instructions, the customer is responsible for that processing and our agreement with them also applies.

We receive your name, email address, subject, message and anything else you choose to provide. We use these details to answer questions, provide support and discuss requested services. Providing them is voluntary, but we need a reply address and enough information to respond. Please avoid sending unnecessary personal or sensitive information.

Our legal basis is taking steps at your request before entering a contract, or performing a contract with you (GDPR Article 6(1)(b)). For general enquiries and people contacting us on behalf of an organisation, we rely on our legitimate interests in responding to enquiries and supporting customers (Article 6(1)(f)).

Website submissions are delivered through Resend to our Google-hosted email mailbox. They are not saved in a separate contact-form database. The email services still process and store the correspondence. Submitting an enquiry does not subscribe you to marketing.

We process account email addresses, authentication information, organisation and role assignments, licence entitlements and membership records. Your organisation’s administrator may supply your name and work email address. For add-in licensing, Autodesk supplies verified account identifiers, email and, where available, your name after sign-in. We also process machine identifiers, device labels, tool versions, licence requests, releases and security events to administer licences and enforce seat limits.

Supabase provides authentication and database services. Your organisation’s authorised administrators can access the membership, seat and licence information needed to manage its licences. We use contract necessity where you are the contracting customer, and our legitimate interests in delivering and protecting business licences for organisation users. Without the required account and licensing information, we cannot provide protected access.

Add-ins connected to our licensing and diagnostics services may send event times and types, organisation and licence identifiers, machine and session identifiers, Windows usernames, Autodesk account identifiers, tool versions, feature names, result counts and technical diagnostic details. Our server also records the originating IP address. Diagnostic messages can contain identifiers or file paths; they should not be treated as anonymous information.

We use these records to investigate failures, support customers, and detect licence misuse or tampering. Our legal basis is our legitimate interests in reliable software and protecting our services (Article 6(1)(f)), balanced against your rights. The fields sent depend on the product and version. This is separate from website visitor analytics. Local troubleshooting files remain on your device unless you share them with support or the product sends diagnostic details through these services.

We do not include advertising pixels or a visitor analytics service in the website. Vercel hosts the site and processes requests and infrastructure logs, which may include IP addresses, browser details and requested pages. We also temporarily use IP addresses to limit abusive requests, based on our legitimate interests in keeping the service secure.

The portal uses necessary first-party Supabase authentication cookies, normally named sb-<project-ref>-auth-token, sometimes split into numbered parts. Authentication flows may also use a cookie ending in -code-verifier. These hold authentication session information or verify a sign-in exchange. They are not used for advertising. The current cookie configuration allows a lifetime of up to 400 days and refreshes authentication cookies during use; this does not mean an access token remains valid for 400 days. Signing out clears the portal session cookies. You can also delete or block cookies in your browser, but protected portal functions require them.

Some pages embed YouTube videos using its privacy-enhanced domain, youtube-nocookie.com. The player can connect to Google/YouTube when it loads, before you press Play, disclosing your IP address and browser/request information. Playing a video may involve additional requests and browser storage. The domain name does not mean that no personal information is processed. See Google’s privacy policy.

Our retention schedule is based on the purpose of each record:

• Raw telemetry: 90 days from receipt by our server.
• Licence and security event history: 12 months from the event.
• Released machine-seat history: 12 months after release. Active seat records remain while needed to administer the licence.
• Enquiries that do not become customer projects: 12 months after the last correspondence.
• Portal accounts, membership and customer project correspondence: while needed for the customer relationship, support and closing the account or project. We review them when that relationship ends.
• Temporary rate-limit records: the applicable 5- or 10-minute window, followed by cleanup while the server is running or on its next request.

Scheduled database cleanup runs daily, so removal can occur on the next daily run after a period expires. Email, hosting logs and provider backups have separate deletion and retention controls. Deleted data may remain in restricted backups until those expire; it is not used for ordinary operations. If a backup is restored, expired records must be removed again before normal use resumes.

Specific records may be retained longer where necessary to meet a legal obligation or establish, exercise or defend a legal claim. Such records are restricted to that purpose and reviewed separately, rather than keeping all operational history indefinitely.

Our service providers include Vercel (website hosting), Supabase (authentication and databases), Resend (email delivery), and Google (email and embedded YouTube videos). Autodesk processes Autodesk sign-in and App Store services under its own privacy statement. We may also disclose information where required by law or necessary for legal claims.

Provider processing, support and subprocessors may involve countries outside the EU/EEA. Such transfers require an applicable adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses, together with additional measures where necessary. Contact us for information about the arrangements applicable to your data and how to obtain a copy of the relevant safeguards.

Depending on the circumstances, you can request access to your personal information, correction, deletion, restriction of processing or a portable copy. You can object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time without affecting earlier lawful processing. These rights are subject to the conditions and exceptions in the GDPR.

Email support@biminent.com to make a request. We may need proportionate information to verify your identity. We normally respond within one month and will explain any permitted extension.

You can complain to Bulgaria’s Commission for Personal Data Protection (CPDP), or to a supervisory authority in the EU/EEA country where you habitually live, work, or believe an infringement occurred. See the directory of authorities. You do not have to contact us before making a complaint.

We update this notice when our processing changes and show the revision date above.