BauKIT

GDPR overview

Implementation is concrete rather than declaratory. Devion Digitalagentur Wien, Etrichstraße 41/18, 1110 Vienna, is named as controller and reachable at office@baukit.at. A full Article 28 processing agreement dated June 2026 is published openly, alongside a separate privacy notice for the application. It sets out the Article 32 measures — TLS in transit, authentication with role-based access, tenant separation, secured cloud storage, vetted subprocessors — offers a detailed technical and organisational measures document on request, and commits to notifying breaches without delay. Transfers outside the EEA rest on Standard Contractual Clauses under Article 46. Access, rectification, erasure, restriction, portability and objection are all listed, with a right of complaint to the Austrian data protection authority. One reservation: the website privacy notice still states that the text is a template to be completed and legally reviewed before publication.

Who owns the data?

The terms are explicit: Devion acquires no ownership rights over the drawings and inputs a customer uploads, and processes them solely to deliver the service. Rights in the software and the underlying technology stay with Devion. On the generated results, the quantity take-off and the priced bill of quantities, the customer receives the rights needed for contractual commercial use. For personal data contained in uploaded plans, including third parties such as building owners, the customer is normally the controller and Devion acts as processor under the published Article 28 agreement; for account, contract and billing data Devion is itself the controller.

Reuse rights

The customer can reuse the output without asking permission: the rights granted on the take-off and the priced bill of quantities cover commercial use under the contract, so the results can be turned into a tender, an offer or an ONLV import into an existing AVA package with no further clearance. Devion's own use of the material is confined to delivering the service. Plan text and rendered plan extracts go to Anthropic for the AI analysis and search phrases go to OpenAI for embeddings, in both cases through commercial APIs that the processing agreement states do not use the data for model training. Processing takes place only on the customer's documented instruction, and contractual use of the service counts as that instruction. Deleting a conversation or a drawing in the service removes the associated files and database entries.

Data retention & training

Hosting summary

Storage of the material that matters most stays inside the EU. Supabase holds the database, file storage and authentication — accounts, conversations, transcripts, results and uploaded drawings — and Railway runs the backend application containers, both declared as processing in the EU under a data processing agreement. Everything else sits outside. Vercel hosts and delivers the front end from the United States over a global CDN, handling technical connection data such as IP addresses. Anthropic processes plan and chat data for the AI analysis in the United States, and OpenAI generates the vector embeddings for the item-catalogue search there too. Stripe Payments Europe in Ireland and Stripe in the United States handle payment and subscription management, and Resend sends transactional e-mail from the United States. Every transfer outside the EEA is said to rest on appropriate safeguards under Article 46, in particular Standard Contractual Clauses supplemented by any additional measures required, with the specific guarantees documented in each provider's processing agreement. The controller itself is established in Vienna, and Austrian law applies.