Privacy Policy

Who we are

FIMIT is the controller responsible for your personal data. For any privacy question, or to exercise your rights, contact us at info@fim-it.com.

Data we collect

We collect the following categories of data:

• Account data — your name, email address, phone number, organization name and type, and role.
• Scan content — the 3D LiDAR scans, floor plans, room measurements, project details and files you create or upload.
• Billing data — subscription and transaction records. Card details are handled directly by Stripe; we never see or store them.
• Usage and technical data — log data, device and browser information, and IP address, used for security and to operate the service.
• Enquiry data — if you submit a demo request on our website: your name, email address, company, how many spaces you manage, your message, the page on our site where you got in touch, the website or campaign that referred you, and the country your request came from. We do not store your IP address with your enquiry.

How we use your data (purposes)

We use personal data to:

• Provide and operate the FIMIT service (create your account, store and render your scans, manage your organization and projects).
• Process subscriptions, payments, taxes and invoices.
• Send service communications (confirmations, password resets, important notices).
• Keep the service secure, prevent abuse, and debug problems.
• Comply with our legal and accounting obligations.
• Respond to demo requests and sales enquiries you send us, and understand which channels bring people to our website.

Legal basis for processing

We rely on the following GDPR legal bases (Art. 6):

• Performance of a contract — to provide the service you signed up for.
• Legal obligation — to keep accounting/tax records as required by Spanish and EU law.
• Legitimate interests — to secure, maintain and improve the service (balanced against your rights).
• Consent — where we ask for it explicitly (you can withdraw consent at any time).
• Legitimate interests / pre-contractual steps — to respond to enquiries you send us and take steps at your request before entering a contract.

Sharing and sub-processors

We do not sell your personal data. We share it only with the service providers (sub-processors) needed to run FIMIT, each bound by a data-processing agreement, and with authorities where the law requires it. Our current sub-processors:

• Supabase — Application hosting, PostgreSQL database, authentication and file storage (European Union (Frankfurt region)).
• Stripe — Payment processing and subscription billing (we never store card numbers) (EU/US — transfers covered by Standard Contractual Clauses).
• Brevo — Transactional email (sign-up confirmation, password reset, notifications) (European Union).
• Cloudflare — Web hosting, content delivery and DNS for the dashboard (Global edge network — transfers covered by Standard Contractual Clauses).
• Umami — Privacy-first, cookieless analytics for the marketing website (aggregate visit metrics only, no cookies) (EU/US — transfers covered by Standard Contractual Clauses).

International transfers

Your data is hosted in the European Union. Where a sub-processor processes data outside the EU (for example Stripe or Cloudflare), the transfer is protected by the European Commission’s Standard Contractual Clauses or an equivalent safeguard.

Data retention

We keep account and scan data for as long as your account is active. When you or your organization is deleted, data moves to Trash and is permanently anonymized after 30 days. Financial records (invoices/transactions) are retained for the period required by Spanish tax and accounting law, even after account deletion.

If you send us a demo request or sales enquiry through our website, we keep it for 24 months from the date you contact us, and then delete it.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, and to withdraw consent. FIMIT provides in-product account deletion and anonymization so you can exercise the right to erasure directly. To make any other request, email info@fim-it.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

Security

We protect your data with encryption in transit, hashed passwords, strict per-organization database isolation (row-level security), and access controls. No system is perfectly secure, but we work to protect your information and will notify you and the authorities of a breach where the law requires.

Children's data

FIMIT is a business tool not intended for children. We do not knowingly collect data from anyone under 16.

Changes to this policy

We may update this policy as the service evolves. We will post the new version here and update the "last updated" date; significant changes will be communicated to you.

Contact

Questions about this policy or your data? Email info@fim-it.com.