What VUE collects and why, how long it is kept, and who processes it. Embed analytics are cookieless by design: no cookie, and no identifier that survives the day.
Last updated 9 August 2026
VUE is operated by Bimstore Limited, which is the data controller for the information described in this policy. ICO registration: 12235544.
Write to privacy@vue-3d.com about anything on this page. Our postal address is on the contact page.
This policy covers two groups, and it matters which one you are in:
| What | Why | Lawful basis |
|---|---|---|
| Name and email | To identify your account, sign you in, and send service messages such as invitations and conversion failures. | Contract |
| Password | Stored only as a bcrypt hash. We cannot read it, and we cannot tell you what it is. | Contract |
| Profile picture | Optional. Shown to your colleagues in the same organisation. | Consent |
| Organisation membership and role | To decide what you can see and change. You may belong to more than one organisation; each membership carries its own role. | Contract |
| Models you upload | Revit families, FBX and OBJ files and their textures, plus everything derived from them. These are your commercial data rather than personal data, but a file’s metadata can contain an author name. | Contract |
| Usage of conversion time | To meter your plan allowance and to bill correctly. | Contract |
| Support tickets | Whatever you write in them, and the account and models they refer to. | Contract |
| Revit connections | If you use our Revit add-in: which of your computers is connected, the name it reported, when it was authorised and when it was signed out. This is what lets you end one machine’s access without signing yourself out everywhere. | Contract |
| Administrative action records | When our staff take an action affecting your account, we record who, what, when, their IP address and browser. This protects you, so it is kept even if you would rather it were not. | Legitimate interests |
The VUE application sets one cookie, vue_session, which holds your signed session. It is strictly necessary — without it you cannot stay signed in — so it does not require consent, and it is the reason you will not find a cookie banner here.
A second cookie exists only while a member of our support staff is accessing your account with permission, and is described in section 7. Your light or dark theme preference is stored in your browser’s local storage and is never sent to us.
Embeds set no cookies at all. A VUE viewer on a manufacturer’s website does not store anything on a visitor’s device, which is why a page carrying one does not need to mention us in its own cookie banner.
When a visitor interacts with an embedded model we record the interaction — the model was seen, a type was changed, augmented reality was launched — so the manufacturer can tell which of their products and finishes people actually look at.
We record:
The visitor hash is a keyed hash of a truncated IP address, areduced browser identifier and the host domain, computed with a salt that changes every day and is never stored. Three consequences follow, and they are the point of the design:
We do not use advertising networks, we do not embed third-party trackers in the viewer, and we do not sell or share this data with anyone other than the manufacturer whose model was viewed.
Two sub-processors, because those are the only two the platform calls:
| Who | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting, file storage and the database. Everything you upload lives here. | London (eu-west-2), United Kingdom |
| Autodesk | Converting Revit families that you upload through the website. The family file is sent to Autodesk Platform Services, converted, and the result returned. Autodesk is the only party that can read a .rfa properly, so a cloud conversion cannot be done anywhere else. | Per Autodesk’s regional processing |
FBX and OBJ conversion runs on our own infrastructure and involves no third party.
If you use VUE Publisher for Revit, our add-in for Autodesk Revit, none of that applies to the family file. The conversion runs inside your own copy of Revit, on your own computer. The `.rfa` is never uploaded — not to us, and not to Autodesk. What leaves your machine is the finished 3D model, and with it:
The add-in signs in with a token issued to that one installation, stored on your computer using Windows DPAPI so that only the Windows account which authorised it can read it. The add-in shows the email address of the signed-in account and the name of the organisation it publishes to, so you can see which is which. Signing out from the add-in tells us to stop accepting that token as well as deleting it locally.
We do not receive a list of the files on your computer, the folders you browse, or any family you do not publish.
Our support staff can enter a customer account to reproduce a problem. We think you should know exactly how that works, because most platforms do it and few say so:
You can ask us for the record of any support access to your account at any time.
Under UK GDPR you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, object to processing based on legitimate interests, and ask for your data in a portable form. Write to privacy@vue-3d.com. We answer within one month.
If you are unhappy with how we have handled it you can complain to the Information Commissioner’s Office. We would rather you told us first, but it is your right either way.
If you saw a VUE viewer on a manufacturer’s website and want to know what we hold about you: as explained in section 5, we hold nothing that can be connected to you. There is no identifier we could search on, because the key needed to compute one was discarded the same day. This is a limitation we built in deliberately, and it means an access request has nothing to return.
When we change this policy we update the date at the top. For a change that materially affects customers, we email the account owners rather than relying on anyone noticing a date.
Related: terms and conditions · contact us