Privacy policy of the BauKIT app

Devion Digitalagentur Wien, Etrichstraße 41/18, 1110 Wien, Austria. Email: office@baukit.at.

We are the controller for account, contract and billing data. For the data contained in the plans and input you upload (including personal data of third parties, e.g. building owners), you are generally the controller and we process this data on your behalf. To that extent the data processing agreement (DPA) applies.

• Account and access data: email address, authentication data.
• Company/profile data: e.g. company name, address, VAT ID, details of the person in charge (for generating documents).
• Content data: uploaded permit plans (PDF), chat input and the quantity takeoffs and bills of quantities generated from them. Plans may contain personal data of third parties.
• Billing data: plan, payment and customer identifiers (payment details are collected and processed directly by Stripe).
• Usage and log data: technical data for provision, security and error analysis (e.g. IP address, timestamps).

• Provision and performance of the user agreement: Art. 6(1)(b) GDPR.
• Billing and compliance with tax and commercial law obligations: Art. 6(1)(c) GDPR.
• Security, stability and further development of the service (legitimate interest): Art. 6(1)(f) GDPR.
• Processing of content data on behalf of the customer: Art. 28 GDPR (see DPA).

To provide the service we use carefully selected service providers that process data on our behalf:

• Anthropic PBC (Claude)(USA)· third countryAI processing of plan and chat data (analysis of permit plans, quantity takeoff, answers).
• OpenAI, L.L.C.(USA)· third countryGeneration of vector embeddings for searching the construction work item catalogue.
• Supabase Inc.(EU)Database, file storage and authentication: storage of accounts, conversations, transcripts, results and uploaded plans.
• Stripe Payments Europe, Ltd. / Stripe, Inc.(Ireland / USA)· third countryPayment processing and subscription/billing management.
• Railway Corp.(EU)Hosting and execution of the backend application (containers).
• Vercel Inc.(USA (global CDN))· third countryHosting and delivery of the web interface (frontend).
• Resend (resend.com)(USA)· third countrySending transactional emails (e.g. enquiries via the website).

A detailed list including data categories and safeguards is contained in the data processing agreement.

Some service providers process data outside the EU/EEA (including the USA). In particular, plan and chat data are transferred to Anthropic (Claude, USA) for AI-assisted analysis. Such transfers are based on appropriate safeguards under Art. 46 GDPR, in particular the EU Standard Contractual Clauses (SCC).

• Account and profile data: for the duration of the contract.
• Uploaded plans, conversations and results: until you delete them in the service or until the contract ends. After the contract ends you can export them for 30 days; the data is then deleted. Data may remain in backups for up to 30 days.
• Invoice/billing data: according to the statutory retention periods (in Austria generally 7 years under § 132 BAO).

BauKIT generates quantity takeoffs and bills of quantities automatically using AI. There is no automated decision-making within the meaning of Art. 22 GDPR with legal effect on data subjects, and no profiling. The results must be professionally reviewed by the user.

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. To exercise these rights, contact office@baukit.at. You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde).