1. Who is responsible
The data controller for veksle.com is the operator of Veksle, based in Latvia. Contact for anything in this policy: info@veksle.com. No data protection officer has been appointed; none is required for a service of this size.
OPERATOR: Veksle · Latvia · the legal name, registered address, registration number and, if VAT-registered, VAT number of the operating entity are being added to this page.
2. The files you upload
What: the Navisworks or IFC file you upload, the IFC produced from it, and a 3D preview payload derived from it. Models can contain personal data (a designer's name in a property, for example); we do not look for it, read it or use it.
Why and on what basis: to do what you asked, that is to convert, show, keep or share the model (performance of a contract, GDPR art. 6(1)(b)).
Where: on one server rented from Hetzner Online GmbH in Falkenstein, Germany (EU). Nothing in this policy is transferred outside the European Union. DNS for the domain is provided by Cloudflare; the traffic itself does not pass through Cloudflare.
Never: your files are not read by people, not sold, not shared with anyone but the people you share them with, and not used to train any model or software.
How long:
- Converted or viewed without an account: deleted 30 minutes after the conversion, or sooner if you leave.
- Kept in an account: until you delete the model or the account. Each account's files are encrypted with a key of its own (AES-256-GCM); deleting the account destroys the key.
- Shared by you: readable by every signed-in person who opens the link, until you stop sharing or delete the model. People who open your link see the model name, the IFC and the 3D view, and the first letter and domain of your email address (for example
k***@company.com), never the full address. - Uploads that failed to convert: kept to diagnose and fix the converter (legitimate interest, art. 6(1)(f): improving the tool), used only by the people working on the converter, never published, deleted once the cause is understood. Ask us at any time to delete one sooner.
3. Your account
What: your email address; the sign-in codes we send (stored hashed, valid 15 minutes); your sessions (stored hashed, 30 days); a list of your kept models with their names and sizes; and an audit record of account actions (sign-in, keep, download, share, delete) with timestamps, kept so we can explain what happened to a file if you ask.
Why and on what basis: to run the account you opened (art. 6(1)(b)). The email address is the only thing you must give us, and only if you want an account; converting or viewing a model needs nothing.
How long: until you delete the account. Audit rows about a deleted file or account stay for up to 12 months and carry only internal identifiers, no addresses or names.
Email delivery: sign-in mails are sent through Zoho Mail (Zoho Corporation B.V., EU data centres). Zoho sees the address and the mail; nothing else.
4. Technical records
- Web server log: IP address, time, URL, status and browser type of each request, kept in a rolling file of about 50 MB (days to a few weeks). Used for security and to stop abuse (legitimate interest, art. 6(1)(f)). An automatic tool blocks addresses that attack the site.
- Rate limits and bans: the number of uploads per address per hour and per day is counted in the server's memory only, and reset when it restarts. Addresses with many rejected uploads are blocked for 24 hours.
- Conversion log: for each attempt, the file name, size, outcome, timings, the converter's own messages, where you came from (the referring site or campaign tag) and, if you accepted it, the random visitor id described below. No IP address. Kept as long as it is useful for improving the converter and reporting how it is used. Legitimate interest, art. 6(1)(f).
5. Analytics and what is stored in your browser
Audience measurement. We run our own copy of the open-source tool Umami on the same server, for this site only. Its script sends the page address, the referring page, your browser type, operating system, device type, screen size and language. The server turns your IP address and browser string into a one-way hash together with a salt that changes every month, uses that hash to tell visits apart, and stores neither the IP address nor the browser string. What is kept: page views, events such as "conversion finished", browser, operating system, device type, screen size, language, and the country, region and city derived from the IP address before it is discarded. It sets no cookie and stores nothing in your browser, and nothing is shared with anyone or matched against any other data. Legal basis: our legitimate interest in knowing how the site is used (art. 6(1)(f)). You can object at any time: ESSENTIAL ONLY in the bar at the bottom of the home or account page switches the analytics off in that browser, and the choice is remembered there.
Returning-visitor id. With your consent (ACCEPT in the same bar), the site also keeps two small values in your browser's local storage: a random visitor id, so we can count how many people come back, and the source you first arrived from. They are sent with your conversions and recorded in the conversion log. ESSENTIAL ONLY removes them. You can withdraw consent at any time by pressing ESSENTIAL ONLY or clearing the site's data in your browser; what was recorded before stays recorded.
Cookies. The only cookie the site sets is the sign-in cookie, set when you sign in to an account and needed for the account to work. The page remembers small conveniences (your consent choice, a closed notice) in local storage; these identify nothing.
6. Who else sees data
Processors acting on our instructions: Hetzner Online GmbH (hosting, Germany) and Zoho Corporation B.V. (sign-in mail, EU). No data is sold, rented or given to advertisers. We disclose data only if the law obliges us to. There is no profiling and no automated decision with legal effect.
7. Your rights
Under the GDPR you can ask us for access to your data, to correct it, to delete it, to restrict or object to its processing, to receive the data you gave us in a portable form, and to withdraw any consent you gave. Most of this you can do yourself: the account page lists and deletes everything you kept, deleting the account removes the address, the sessions and the files, and the consent bar withdraws consent. For anything else write to info@veksle.com; we answer within a month. You can also complain to a supervisory authority, in Latvia the Datu valsts inspekcija (dvi.gov.lv), or to the authority of your own country.
8. Children
Veksle is a professional tool and is not aimed at children. We do not knowingly collect data from anyone under 16.
9. Changes
When this policy changes, the date at the top changes. Material changes are announced on the site.
Still a question?
Ask at info@veksle.com. The rules of use are in the Terms of Service.