Privacy Policy

1. Who we are

1.1 This Privacy Policy explains how RoundTrips LTD, a company registered in Israel under company number 517410148 with its registered office at Nahal Shilo 25, Beer Sheva 8485867, Israel (we, us, our), collects and uses personal data.

1.2 We are the controller of the personal data described in this policy, except where we act as a processor on behalf of our customers as described in section 5.

1.3 You can contact us about anything in this policy at admin@roundtrips.io.

2. What this policy covers

2.1 This policy covers personal data we handle when you visit https://www.roundtrips.io, request or start a trial of RoundTrips, ask us to contact you about pricing, buy or use a Subscription, use RoundTrips Live, contact our support team, or receive marketing from us.

2.2 It does not cover the practices of third parties whose services you connect to RoundTrips, such as Autodesk Construction Cloud, Microsoft OneDrive or Dropbox. Those services handle your data under their own privacy policies.

2.3 This policy is a notice of our practices. It is not part of our Terms of Service.

3. What we do not collect

3.1 We think this is the most important section, so it comes first.

3.2 Your files. We do not collect or store the contents of your models, drawings or documents. RoundTrips processes files on your computer. When a Task moves or builds files, the contents travel directly between your computer and the storage locations you have authorised. They do not pass through our servers and we keep no copies.

3.3 Your sign-ins. When you sign in to Autodesk, Microsoft or Dropbox, the access and refresh tokens are stored in Windows Credential Manager on your computer. They are never sent to us, and we cannot use them to reach your files. The name and email address of the signed-in account, which the Software shows on screen, also stay on your computer.

3.4 Your usage. The Software sends us no telemetry, analytics or crash reports. Your Task names, folder paths, file names, Run history and logs stay on your computer, unless you switch on RoundTrips Live (section 4.12) or send them to us yourself (section 4.5).

3.5 We do not sell personal data, and we do not share it with advertisers or data brokers.

4. Personal data we collect

4.1 Account and billing data. Your name, work email address, company name, job role, country, billing address, VAT or tax number, and purchase history. We take payment by bank transfer against an invoice and hold no payment card details.

4.2 Licence and activation data. Your licence key, the number of Seats assigned, the individuals assigned to them, activation records, the machine fingerprint of each activated computer (a value derived from the computer, used to enforce Seat limits), and the software version installed.

4.3 Licence checks. Once a day, and when you activate or release a computer, the Software contacts our licensing provider, Keygen, with the licence key and machine fingerprint. Keygen receives the computer's IP address as part of that connection.

4.4 Trial activation on your machine. When RoundTrips starts its own trial on first launch it sends a machine fingerprint to our trial service, so that one computer receives one trial. No name or email address is attached to it.

4.5 Support data. The content of emails you send us, and any logs, screenshots or files you choose to attach. The Software's logs have secrets removed as they are written, but they can contain Task names, folder paths and file names, which may include personal data if you name files after people.

4.6 Website data. When you visit the website, our hosting provider processes your IP address, browser and device type and the page requested, in order to serve the page and protect the site. If you agree to analytics in the cookie banner, Google Analytics also receives information about your visit, as described in section 12. Without that agreement nothing about your visit is recorded beyond what serving the page needs.

4.7 Trial request form. When you ask for a trial we collect your first name, last name, work email address and, if you give it, your company name. We record the trial licence issued in response: its key, its identifier, its expiry date, and when it was sent to you.

4.8 Contact sales form. When you ask us to contact you about pricing we collect your name, work email address, your message, your company size if you select one, and which pricing plan's button you pressed. We record whether the notification to our sales inbox succeeded, so that an enquiry cannot be lost silently.

4.9 Anti-abuse data for both forms. We store a salted one-way hash of your IP address rather than the address itself, and use it only to limit how many submissions come from one place in an hour. The hash cannot be turned back into your address. Each form also carries a field hidden from people and visible to automated scripts; we discard anything that fills it in.

4.10 Update checks. Shortly after it starts and every 6 hours while it runs, and whenever you press Check for updates, the Software asks GitHub for the latest release. The automatic check can be switched off in Settings. The request carries nothing about you or your work; GitHub sees your IP address under its own privacy policy. The Software only reports that an update exists; it never downloads or installs one.

4.11 Downloading the Software. The installer is hosted on GitHub Releases. Downloading it is a request to GitHub, who will see your IP address under its own privacy policy. We do not receive a record of individual downloads.

4.12 RoundTrips Live. RoundTrips Live is off unless you switch it on and link a computer to a RoundTrips Live account. If you do:

• we hold the account's email address and password (stored only as a one-way hash), and which computers are linked to it;
• while Live is switched on, the Software sends the names of your Tasks, the status, stage and times of your 50 most recent Runs, the next scheduled time of each scheduled Task, the first 300 characters of any error message (with secrets already removed), and the version of the Software;
• it sends nothing else: no project, hub, folder, file or account names beyond what you have put in a Task's name, and no file contents.

Each update replaces the previous one, so we hold only the latest state of each linked computer.

5. Where we act as a processor

5.1 Task names and error messages sent to RoundTrips Live, and logs you send us for support, can contain personal data belonging to your own clients, staff or project participants. For that data you are the controller and we act as your processor, handling it only to provide RoundTrips Live and support.

5.2 Our commitments as processor are set out in clause 12.3 of our Terms of Service, which is our data processing agreement; no separate agreement is needed. For the data they cover, those commitments take precedence over this policy.

6. Why we use your data, and our legal basis

6.1 To provide the Software and your Subscription: creating your account, issuing and validating licence keys, enforcing Seat, trial and tier limits, and providing RoundTrips Live. Legal basis: performance of a contract.

6.2 To answer a sales enquiry: replying to you, understanding what your team needs, and preparing a quote. Legal basis: taking steps at your request before entering a contract, and our legitimate interest in responding to people who ask to hear from us.

6.3 To provide support: investigating problems you report, reproducing errors, and responding to you. Legal basis: performance of a contract, and our legitimate interest in supporting our customers.

6.4 To keep the Software and the website secure and working: preventing misuse of licence keys and trials, stopping automated and repeated form submissions, and protecting our systems. Legal basis: our legitimate interest in the security and integrity of our service.

6.5 To improve the product: using what you tell us in support requests, and the problems we find while resolving them, to fix and improve the Software. Legal basis: our legitimate interest in improving a product our customers rely on. We do not collect usage data for this purpose.

6.6 To take payment and meet our accounting obligations: invoicing, collecting payment, and keeping financial records. Legal basis: performance of a contract, and compliance with a legal obligation.

6.7 To send you service messages: trial expiry, renewal, security and availability notices, and material changes to our terms. Legal basis: performance of a contract. You cannot opt out of these while you hold a trial or Subscription.

6.8 To send you marketing: product updates and occasional announcements. We send these only where you have agreed to receive them, or where you are a customer, we told you when collecting your address that we might send them, and you did not refuse. Legal basis: consent, or our legitimate interest in marketing to existing customers where the law allows it. You can unsubscribe from any marketing email, at any time, using the link in it or by writing to admin@roundtrips.io.

6.9 To understand how the website is used: counting visits, seeing which pages and forms are used, and which sites send visitors to us, so that we can improve the website. Legal basis: consent, given in the cookie banner and withdrawable at any time (section 12).

7. Who we share data with

7.1 We share personal data only with service providers who help us operate, and only as far as they need it. Our sub-processors are:

• Vercel: hosting the website, the code behind its forms, the trial service and RoundTrips Live
• Supabase: the database holding trial requests, sales enquiries, trial records, RoundTrips Live accounts and Live Data
• Resend: sending transactional email, including the trial email and the notification of your enquiry to our sales inbox
• Cloudflare: the anti-spam check on our forms, which receives your IP address and browser signals to decide whether a submission is automated
• Keygen: issuing and validating licence keys, including trial keys
• Google Workspace: our email, including support correspondence and anything attached to it
• GitHub: hosting the installer download and the update check
• Google: website analytics, only if you agree to it in the cookie banner (section 12)

7.2 We also share invoices and billing records with our accountants, and with tax authorities where the law requires.

7.3 The list in clause 7.1 is the current list of sub-processors, and this policy is updated whenever it changes. Where we act as processor, we give customers notice of changes as set out in clause 12.3 of our Terms of Service.

7.4 We may also disclose personal data where we are legally required to, to establish or defend legal claims, or to a buyer or successor in connection with a merger, acquisition or sale of assets. In the last case we will notify you before your data becomes subject to a different privacy policy.

8. International transfers

8.1 We are based in Israel, which the European Commission and the United Kingdom recognise as providing adequate protection for personal data. Some of our service providers are located outside Israel, including in the United States.

8.2 Where we transfer personal data to a country without such recognition, we rely on the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, as incorporated in our providers' data processing terms, together with any additional safeguards the transfer requires, and on the conditions for transfer under the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001.

8.3 You can request a copy of the safeguards we rely on by writing to admin@roundtrips.io.

9. How long we keep data

9.1 Account and billing data: for the life of your account, and then for 7 years to meet accounting and tax obligations.

9.2 Licence and activation data, including machine fingerprints: for the life of your Subscription, and then for 24 months to handle renewals, disputes and licence misuse.

9.3 Trial fingerprints: for 24 months from the start of the trial, so that one computer receives one trial.

9.4 Support correspondence and attachments: for 24 months after the request is resolved.

9.5 RoundTrips Live: the latest Live Data for a computer is replaced with each update. Unlinking the computer in the Software stops the updates; removing the computer from your account at live.roundtrips.io deletes its Live Data. We delete your Live account and everything in it when you ask us, and in any case within 90 days after your Subscription ends.

9.6 Trial requests and the trial licences issued from them: for 24 months from the request, so that we can answer questions about a trial and recognise a repeat request.

9.7 Sales enquiries: for 24 months from the enquiry, or for the life of your account if you become a customer.

9.8 The hashed IP address attached to a form submission: deleted with the record it belongs to.

9.9 We may keep data for longer where we are legally required to, or where it is needed for a legal claim that is active or reasonably anticipated.

10. How we protect data

10.1 Every connection between the Software, our services and Connected Services is encrypted in transit. Our providers encrypt the data they store for us at rest.

10.2 Access to personal data within our organisation is limited to the people who need it to do their job.

10.3 We keep the fact that model and document contents, and your sign-in tokens, never reach our systems as a deliberate design decision. It is the strongest protection we can offer for the data you care most about.

10.4 No system is completely secure. If a personal data breach occurs, we will notify the Israeli Privacy Protection Authority and any other supervisory authority as the law requires, including within 72 hours where the GDPR requires it, and will notify you without undue delay where the breach is likely to put your rights at high risk.

11. Your rights

11.1 Depending on where you live, you have some or all of the following rights over your personal data: to access it; to have it corrected or deleted; to restrict or object to our use of it; to receive it in a portable format; and to withdraw consent where our use relies on consent. Under Israeli law you have the right to inspect personal data about you held in a database, and to ask for it to be corrected or deleted if it is inaccurate, incomplete, unclear or out of date.

11.2 Where we rely on legitimate interests, you may object at any time and we will stop unless we have compelling grounds to continue.

11.3 To exercise any right, write to admin@roundtrips.io. We will respond within 30 days, and will tell you if we need longer because the request is complex.

11.4 We will not charge you for exercising your rights, or treat you differently for doing so.

11.5 If you are unhappy with how we have handled your data you may complain to a supervisory authority: in Israel, the Privacy Protection Authority at gov.il/en/departments/the_privacy_protection_authority; in the United Kingdom, the Information Commissioner's Office at ico.org.uk; in the European Economic Area, the data protection authority where you live or work. We would appreciate the chance to address your concern first.

12. Cookies and website analytics

12.1 We use Google Analytics to count visits and to see which pages and forms are used, but only if you agree in the cookie banner. Until you do, the Google Analytics code is not loaded and nothing is sent to Google. If you decline, it never is.

12.2 If you agree, Google Analytics sets two cookies on our domain, _ga and _ga_<id>, which last up to two years, and receives your browser and device type, your approximate location (country and city, derived from your IP address, which Google Analytics does not store), the pages you view and the site that referred you. We also record that a trial request or a sales enquiry was sent, and which pricing plan prompted it, but never anything you typed into a form. Google's advertising features and Google Signals are switched off, so we do not use this data for advertising or link it to a Google account. We keep it for 14 months.

12.3 Your answer is stored in a cookie named rt_consent for six months, after which we ask again. You can change it at any time with Cookie settings at the foot of every page. If you withdraw your agreement, we delete the Google Analytics cookies and the code stops loading.

12.4 Some of our providers store data in your browser where it is strictly necessary for the page to work, and these do not need your agreement: Cloudflare, for the anti-spam check on our forms, so that you are not asked to prove you are human twice; and Vercel, our host, where it protects the site from automated traffic. RoundTrips Live keeps you signed in with a cookie that is strictly necessary for it to work. None of these is used to profile you or measure your visit.

12.5 We do not use advertising or cross-site tracking cookies.

13. Children

13.1 RoundTrips is a tool for construction and design professionals. It is not directed at children, and we do not market it to them.

13.2 We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, write to admin@roundtrips.io and we will delete it.

14. Changes to this policy

14.1 We may update this policy. Whenever we do, we update the date at the top. Where a change affects how we use data you have already given us, we will notify you by email before it takes effect.

14.2 Previous versions are available on request from admin@roundtrips.io.

15. Contact us

15.1 For any question about this policy, or to exercise your rights:

• RoundTrips LTD, company number 517410148
• Nahal Shilo 25, Beer Sheva 8485867, Israel
• admin@roundtrips.io

15.2 We are not currently required to appoint a data protection officer or a representative in the EU or the UK. Questions that would go to one go to admin@roundtrips.io.