Back to home

Privacy Policy

Who we are and how to reach us

ArchiMind is operated by Phi Consulting SRL (enterprise number 0791.297.492), Square des Martyrs 1, 6000 Charleroi, Belgium — full company details are in the Imprint. For any privacy question or to exercise your rights, contact contact@archimind.be.

Our roles: controller and processor

  • Where Phi Consulting SRL is the controller — your account, authentication, billing and invoicing data, support correspondence, the security and operation of the service, and the assistant-personalisation profile described below. This policy governs that processing.
  • Where Phi Consulting SRL is a processor — the workspace, project and client content you create, upload or import (specifications, building data, and the client records you enter). For that content you are the controller: we process it only on your documented instructions under a data-processing agreement (GDPR art. 28). You are responsible for the lawfulness of any personal data you enter about third parties (e.g. your own clients) and for informing them.

Personal data we process as controller

  • Account data — name, email and authentication metadata, held in our identity provider (AWS Cognito).
  • Billing data — company and VAT details, plan, invoices and payment status. Card payments are handled by our payment provider; we do not store full card numbers.
  • Usage and device data — feature interactions and performance metrics, and, with your consent, product analytics and session replay; on our public marketing pages, cookieless visit measurement (legitimate interest).
  • Assistant-personalisation profile — see the dedicated section below.
  • Support and communications — messages you send us and the related metadata.
  • Operational logs — request metadata needed to run and secure the service.
  • Prospect and business-contact data — see Prospects and marketing communications below.

Purposes and legal bases

  • Account and authentication — to provide and secure your account. Legal basis: performance of our contract (art. 6(1)(b) GDPR).
  • Billing, invoicing and VAT — to take payment and meet accounting and tax obligations. Legal basis: contract and legal obligation (art. 6(1)(b) and (c)).
  • Service operation, security and reliability — to run, monitor and protect the service, including operational logs and backend error diagnostics. Legal basis: our legitimate interest in a secure, reliable service (art. 6(1)(f)). These are minimised and use pseudonymous identifiers; they are not part of the cookie-consent regime, because a service must be able to detect its own failures.
  • AI-assisted generation — to produce the specifications you request. Legal basis: performance of our contract (art. 6(1)(b)).
  • Assistant personalisation — to tailor the in-app assistant to how you work (see below). Legal basis: our legitimate interest in a helpful assistant (art. 6(1)(f)); you can object at any time.
  • Product analytics and session replay (PostHog), and browser error diagnostics (Sentry, running in your browser) — to understand product use and catch client-side faults. Legal basis: your consent (art. 6(1)(a)); off unless you opt in and withdrawable at any time.
  • Marketing-site visitor measurement (PostHog, EU) — to understand how our public marketing pages are found and used: page views, page leaves and clicks on the sign-up and log-in links, with referrer and campaign parameters. Cookieless — nothing is stored on or read from your device, and no visitor profile is built. Legal basis: our legitimate interest in measuring our own public pages (art. 6(1)(f)); you can object at any time.

Assistant personalisation (memory across sessions)

To make the in-app assistant more useful, it may keep a small profile that it infers from your conversations with it: the terms you use for bill-of-quantities entries (e.g. "postes", "métré"), your communication style (concise, detailed, technical), and short notes about your role and recurring project types. It is stored against your account and used only to adapt the assistant's responses; it drives no automated decision about you.

Legal basis: our legitimate interest in a helpful assistant (art. 6(1)(f)). Retention: kept while your account is active and erased when your account is deleted. Access: limited to the service and to our administrators under access controls. Because it is data we inferred (not data you provided), it falls outside the portable data export — but you can still ask us what is stored, correct it, object to it, or have it erased at contact@archimind.be.

Prospects and marketing communications

If you are an architect or another construction professional we have not worked with yet, we may hold professional contact details to tell you about ArchiMind: the firm's name and impersonal address (for example info@ or the address published for the firm) and — for the telephone step — the name, role and professional number of the person in charge, together with the record of our contacts. We obtain them from public professional sources — the register of the Order of Architects, your firm's website, professional directories — or from you (a reply, a call, a form). This section gives the information owed under art. 14 GDPR for data we did not obtain from you.

Legal basis for holding the record: our legitimate interest in promoting our service to professionals (art. 6(1)(f) GDPR), weighed against your interests: business contact only, professional details only, low frequency, and an objection honoured at once. How we contact you: advertising e-mails go only to a firm's impersonal address (the legal-person exemption of the Royal Decree of 4 April 2003 under art. XII.13 of the Code of Economic Law) or to a person who has given prior consent — never to a named personal address without consent; every e-mail is identifiable as advertising and carries an unsubscribe link. Before any telephone call we screen the number against the Belgian "Do Not Call Me" list (Code of Economic Law, art. VI.111–115) and keep the dated proof of that check.

Recipients: our e-mail provider listed under Recipients and service providers; prospect data is not sold and stays in the EU. Retention: 12 months after our last contact, or until you object — after an objection we keep only your e-mail address or number on a suppression list so that we do not contact you again. Object at any time at contact@archimind.be or with the unsubscribe link.

Recipients and service providers

We share personal data only where needed to run the service, and we never sell it. The role differs by provider.

Processors (act only on our instructions, under a data-processing agreement):

  • Amazon Web Services (AWS) — cloud hosting and storage (EU, Paris region).
  • Google (Gemini) — AI generation of specification content. May process data outside the EU/EEA (see International transfers).
  • Microsoft 365 and AWS SES — sending and handling email.
  • PostHog, Inc. (United States) — product analytics and session replay (consent-gated), and cookieless visit measurement of our marketing pages (legitimate interest); our data is hosted in its EU cloud (Frankfurt, Germany) — see International transfers.
  • Sentry (Functional Software, Inc., United States) — error diagnostics; our data is hosted in its EU region (Germany) — see International transfers.

Independent parties (determine their own purposes for the data they receive):

  • Mollie — our payment service provider. Mollie acts as an independent controller for the payment transaction itself (and as a processor only for its own invoicing feature); its processing is governed by Mollie's privacy statement.
  • VIES (European Commission) — a public VAT-number validation service we query to confirm a VAT number; it is not our processor.

Our sub-processors are listed on the Sub-processors page, and a dated copy is available on request.

International transfers

Our core hosting and storage (AWS) are in the European Union (Paris). However, AI-assisted generation uses Google's Gemini API, which may process your prompts and the generated content — including any personal data they contain — outside the EU/EEA; Google keeps them for up to 55 days for abuse monitoring only and does not use them to train its models; a prompt cache we create to speed up generation lives 30 minutes, and when the assistant grounds an answer with Google Search, Google stores the grounded query and results for 30 days. That processing relies on Google's Data Processing Addendum and the European Commission's Standard Contractual Clauses. Two other processors, PostHog, Inc. and Sentry (Functional Software, Inc.), are US companies that host our data in the EU; any access from the United States (support, engineering) is covered by the EU-US Data Privacy Framework where the provider is certified and otherwise by the Standard Contractual Clauses, as set out in each provider's data-processing agreement. Any other transfer outside the EU/EEA relies on an adequacy decision or the Commission's Standard Contractual Clauses with additional safeguards. You may request a copy of the relevant safeguards at contact@archimind.be.

How long we keep your data

  • Account data — for the life of your account. You can request erasure at any time (self-service account deletion is being added).
  • Workspace, project and client content (where we are processor) — retained while the workspace uses the service and deleted on the workspace owner's instruction. This content belongs to the workspace, which is often shared with colleagues.
  • Billing and invoicing records — retained for 7 years, as required by Belgian accounting and VAT law, even after account erasure.
  • Operational and access logs — API access logs 7 days; application logs 90 days (their content is reduced to identifiers and counts before it is written).
  • Support and communications — for the life of your account, then deleted with it; exchanges about invoicing follow the 7-year rule above.
  • Prospect data — 12 months after our last contact, or until you object (then only a suppression-list entry).
  • Product analytics and marketing-page visit measurement — up to 12 months; session replays — up to 1 month; browser error reports — up to 90 days.
  • Assistant-personalisation profile — until your account is deleted.

What erasure does and does not do: closing or erasing your login removes your account data and assistant profile, but it does not automatically delete content held in a shared workspace (ask the workspace owner) and does not remove invoicing records we are legally required to keep.

Automated decision-making

We do not take decisions producing legal or similarly significant effects about you by solely automated means, and we do not use your data to score or rank you. AI-assisted generation and the in-app assistant produce draft content and suggestions for you to review; the only profile we keep is the assistant-personalisation profile described above.

Is providing your data required?

Account, billing and security data are necessary to provide the service — without them we cannot deliver it. In-app product analytics, session replay and browser error diagnostics are optional and remain off unless you consent; the cookieless measurement of our public marketing pages runs under our legitimate interest and stores nothing on your device.

Your rights

Under the GDPR you may request access, rectification, erasure, restriction or portability of your personal data, object to processing based on our legitimate interest (including assistant personalisation, service diagnostics, marketing-page visit measurement and prospecting), and withdraw consent at any time. To exercise any right, contact contact@archimind.be; we respond within the statutory time limits. Where we act as processor for workspace content, we act on — or refer you to — the relevant controller, usually your workspace owner.

You also have the right to lodge a complaint with the Belgian supervisory authority: the Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels — www.dataprotectionauthority.be.

Changes to this policy

We update this policy when our processing changes and revise the effective date shown above; we notify material changes in the app.