Last updated: 26 October 2026

Only the German text is legally binding, in every country. Any other language version is a translation and serves only to aid understanding. Where it differs from the German text, the German text applies.

1. Controller and Contact

The controller responsible for data processing under applicable data protection laws (including the Swiss Federal Act on Data Protection (revDSG) and the EU General Data Protection Regulation (GDPR)) is:

bimover GmbH
Hammer 19
5000 Aarau
Switzerland
UID: CHE-132.862.302
Email: support@bimover.ch

2. Scope of This Privacy Policy

This Privacy Policy covers what happens around the apps: our website at bimover.ch including subdomains, and the account, sign-in, licensing, payment, support and security data that goes with it. We aim to process only the data required to operate those.

What an app does with data is on its own page, where it has one. Most apps have one, because every app has its own exceptions, and a general policy that grows an app-specific paragraph every time an app ships is a policy nobody can read to the end. The bimover support app and CloyaBridge have no page of their own; this policy covers them.

AppWhat it does with dataTerms
CloyaCloya PrivacyTerms
LocusLocus PrivacyTerms and the Locus Licence Terms
FilumFilum PrivacyTerms
CuolmaCuolma PrivacyApple’s standard EULA, see Terms 3.3
VadumVadum PrivacyApple’s standard EULA, see Terms 3.3
bimover (support app)this policyTerms
CloyaBridgethis policyTerms
LykoiLykoi PrivacyTerms
OrtheraOrthera PrivacyTerms
TesseraTessera PrivacyTerms

Where an app page and this policy could be read differently, the app page wins for that app. It is the more specific text and the one written for it.

For some apps the honest answer is “not us”. Filum writes its archive into storage the customer chooses and we never receive it; Cuolma, Vadum and CloyaBridge send us nothing at all. Where bimover is not the controller of what an app processes, the app’s own page says so and says who is.

3. Data We Process

Depending on your usage, we process the following categories of personal data:

We do not build advertising profiles and we do not use analytics or marketing pixels on our website.

In-app notices (bimover app)

The bimover app can display notices from us inside the app: operational and security notices (always shown) and product news (can be disabled in the app settings at any time).

For this feature we store only your choice (allow product news yes/no) linked to your account. If you also made a choice about offers in an earlier app version, that choice remains stored with your account; the app no longer shows offers. Which notices you have read is stored locally on your device only. We do not track reading behaviour on our servers, and we do not build profiles from this feature. Notices are delivered when the app fetches them; no marketing emails and no advertising push notifications are sent.

If you submit a feature request or vote on one in the app, we process the content you wrote, your vote and your account identifier. Submissions are reviewed before publication and are shown to other users without your name or email address; internally we keep the link to your account so we can inform you about the status and remove your submission on request. Legal basis: our legitimate interest in improving our products together with our customers (Article 6(1)(f) GDPR); submitting is entirely voluntary. Please don’t put personal data of others or confidential project information into a submission (see Terms §9.2).

We also process support ratings you choose to give: after a support ticket is solved you may rate it in the app (an overall score, or separate scores for solution, process and friendliness, plus an optional comment). Rating is voluntary, one rating per ticket, and is linked to your account and that ticket so we can improve our support. Please don’t put sensitive information into the free-text comment.

Legal basis: operational and security notices are processed for contract performance (Article 6(1)(b) GDPR); product news to existing customers relies on our legitimate interest in informing customers about our own, similar products and services (Article 6(1)(f) GDPR and Swiss law incl. the Unfair Competition Act), always combined with the free, immediate opt-out in the app. Support ratings are processed on the basis of your voluntary submission and our legitimate interest in support quality (Article 6(1)(f) GDPR). Images shown in notices are hosted by us; for notices the app fetches nothing from third-party servers. Your choice about product news is kept until you change it or your account is deleted; an earlier choice about offers until your account is deleted.

Remote support (bimover app)

Our support team sees your screen only if you allow it in the app, and only until you or we end the session. During the session your computer shows that it is being shared. The screen image, mouse and keyboard input and requests from support to your bimover apps are encrypted between your device and the support team’s device; only these two devices hold the key. On the way, our network provider Cloudflare and our server in Frankfurt (Germany) only pass the data on. Where your network allows it, the image goes directly from your device to the support team’s device; both devices then see each other’s IP address, and your app asks a Cloudflare service at which address it can be reached (Cloudflare sees only this address). We neither store nor analyse any of it.

So that support can reach you, the app registers your device while it is running: an identifier of this installation, device name, operating system, app version, whether you are available or away for a moment (after three minutes without mouse or keyboard input the app shows you to support as inactive) and a technical system report (model, processor, memory, free storage, screen resolution, installed bimover apps, granted permissions, reachability of our server). If you enter a callback number or set up audio for a support call, we also store that number, the name of the selected output device and whether the audio check succeeded. For every access request we store who in support asked, when, whether you allowed it and when the session ended.

We keep the details about your device until you delete the bimover app’s data or your account. Access requests remain; once your account is deleted, they remain without your name, your email address and your phone number. Legal basis: contract performance (Article 6(1)(b) GDPR) where you use support; for the system report, our legitimate interest in recognising problems quickly (Article 6(1)(f) GDPR).

AI help (bimover app for Mac)

AI help is optional. It uses a program that you have set up yourself on your Mac (Claude Code, Codex or GitHub Copilot), with your own account or API key with the respective provider.

Before anything leaves your Mac, the app shows you the package: your description, the affected app, the system report (see Remote support) and, if you choose, the end of the log files of bimover apps on your Mac. From the log files the app first removes keys, tokens, email addresses and the path of your user folder. Only after you click “Send” does the app pass the package to the program, which sends it to its provider. During the conversation the program can also read the state of the app (version, open section, whether you are signed in, granted permissions); this information also goes to its provider. This route does not pass through us; we receive neither the package nor the answers. The provider is responsible for the processing on its side, under your contract with it.

The app stores the conversations only on your Mac. If AI help searches our help articles, the search text goes to our website, only after you have confirmed the search.

If you have received an internal key from us and enter it, the app has it confirmed by our server; a confirmation is valid for one hour. In doing so we receive the key and your IP address. All we store is a checksum of the key, together with the name we issued it for, when it was issued and, if we withdraw it, when and for what reason. Withdrawn entries are kept as a record.

Legal basis: contract performance (Article 6(1)(b) GDPR); for keeping withdrawn entries, our legitimate interest in being able to document which keys were issued (Article 6(1)(f) GDPR).

Recording a ticket (bimover app for Mac)

On your Mac. When you record a ticket, the app listens to your voice (can be switched off) and reads text and clicks on the screen. Transcription and redaction are done by language models on your Mac: Whisper by OpenAI and Qwen3 by Qwen, which we have reduced in size. The audio is gone after transcription. Only text is kept, for at most 30 days, and you can discard it at once. If you write the ticket instead of recording it, the same applies without audio and screen.

With us. Only after “Send to support” does the text you saw in the preview reach us, exactly that text. Audio, screen and the mapping of redacted names never leave your Mac. We receive a screenshot only if you add it to the ticket yourself after sending. From it we open a ticket, with the individual requests and a quotation for each. We note any wishes in it as an idea. An idea becomes public only after our review and without your name. The ticket is kept. If you delete your account, we remove your wording, the quotations and the details about you, and we delete your ideas.

If you tick the box for the log and Archicad status, a diagnosis goes with the ticket: the system report (see remote support), the logs of the bimover apps and add-ons and, from Archicad, the versions, the language and the installed bimover add-ons. It appears in the preview before you send, and in the ticket as a separate part. The app removes keys, tokens, email addresses and the name of your user folder beforehand. Paths may contain the name of a project folder, and you see whatever else the logs name in the preview. The diagnosis is deleted like your wording when you delete your account. If the AI review is switched on, Anthropic reads the diagnosis as well.

With third parties. For offices with a licence, we can switch on the AI review. We then pass the text to Anthropic: Anthropic first checks it for email content and then picks out the individual requests. The AI answers questions only for members of an office with its own licence, with the sender “bimover-KI”. If the AI review is off or the month’s quota is reached, people handle the ticket without AI. The app downloads the language models once from GitHub, at your request. GitHub sees your IP address when it does.

Legal basis: performance of contract (Art. 6(1)(b) GDPR), insofar as you use support. For the AI review we rely on our legitimate interest in handling tickets quickly and completely (Art. 6(1)(f) GDPR).

Internal work with AI

For our own administration (customer care, licences, acquisition) we use an AI assistant. It is a program from an AI provider (currently Anthropic, OpenAI or GitHub) that runs on our computer. For a task it reads information from our administration: about an office, for example its address, phone number, email address, website, size and our customer care notes; about its contact persons, their name, role and email address; as well as open tasks, support cases with their subject and contact person, and accounting records and entries. This information goes to the provider. The assistant does not receive emails, personnel and payroll data or confidential records.

For individual tasks that we approve one at a time, the assistant may search the internet, for example for the size of an office. Only the office’s name, town and website go into the search. From the internet we take only the number of people in an office together with its source, never names of people.

Legal basis: our legitimate interest in efficient administration and customer care (Article 6(1)(f) GDPR).

What the apps themselves do

Most apps have their own page, and those pages are listed in Section 2. This policy deliberately does not repeat them. An app changes, ships a feature, adds a data source. A general policy that grows a paragraph each time is a policy nobody reads to the end, which helps no one.

So: for what an app collects, why, on what legal basis and for how long, read that app’s page. It is the complete answer for that app. For the support app and CloyaBridge, which have no page of their own, it is this policy.

4. Cookies and Similar Technologies

Our website uses strictly necessary cookies for account login/session management:

CookiePurposeDurationType
bimover_web_sessionKeeps you logged in to your website accountUp to 30 days or until logoutEssential, first-party
bimover_web_deviceStable device identifier for secure web session issuanceUp to 365 daysEssential, first-party

The website now sets these cookies only when a device is approved (device approval).

These cookies are required to provide the login/account service requested by you. Cookie attributes used for these cookies include HttpOnly and SameSite=Lax; Secure is used on HTTPS/production.

Storage in the browser

StoragePurposeDurationType
bimover-anmeldung (IndexedDB)Keeps you signed in on the website: your sign-in, a device key that signs only in this browser and cannot be read out, and a device identifierThe sign-in until you sign out, at most 30 days if unused; device key and device identifier until the next sign-in or until you clear the website dataEssential, first-party

We do not use analytics/marketing cookies.

If you use third-party login or checkout components (Apple, Microsoft, Payrexx), those providers may use their own technologies under their own policies.

5. Sign in with Apple or Microsoft (Unified Account for Apps and Website)

We use Sign in with Apple and Sign in with Microsoft for website authentication and app authentication. Which of the two an app offers depends on the app. Filum signs in with Microsoft only, because the same sign-in also reaches the mailboxes it archives; there is no second login.

The same identity is used across website and supported apps. If you created your bimover account with Apple and later sign in with Microsoft, you link the two once in your account on bimover.ch, and both then lead to the same account.

When you sign in, we process:

We do not process passwords. Authentication is performed by Apple or by Microsoft.

Address already known

If you sign in with Apple or Microsoft for the first time and the email address Apple or Microsoft has verified already belongs to a bimover account with the other provider, we do not silently create a second account. We tell you which provider the existing account signs in with, and you choose: sign in there, connect the new sign-in to the existing account (only after you have signed in there), or create a new account anyway. The choice is valid for 10 minutes; for it we store a check value, the sign-in (provider, identifier, verified address), the app and device, and the accounts with the same address (retention: Section 11). We do not reveal any other details about those accounts.

Sign in with Microsoft

When you sign in with Microsoft, we process the identity token Microsoft issues and take from it the identifier Microsoft gives your account and your email address, in order to find or create your bimover account. Where the token names your Microsoft organisation, we process that identifier as well. We do not process passwords. Authentication is performed by Microsoft.

In Filum the same sign-in also authorises the app to read in your mailbox; what it reads there and where any of it goes is described in Filum Privacy. That mail travels between your device and Microsoft; it does not pass through us, and we never store it.

Sign in with a code

Programs without a sign-in window of their own, such as the Archicad add-ons Orthera and Tessera, sign in with a code. The program shows the code and opens the page bimover.ch/anmelden/code; there you sign in with Apple or Microsoft and approve or decline the sign-in. What a program itself does in the process is described on its own page, such as Orthera Privacy and Tessera Privacy.

For this we store, per sign-in, the code, a checksum of the secret counterpart only the program knows, the identifier and public key of the device, the operating system and version of the program and, once decided, who approved or declined and when. We store a device name only if the program sends one; Orthera and Tessera send none. A code is valid for 10 minutes. We delete the entries once their expiry lies more than one day in the past, at the next start of a sign-in with a code; what happened is recorded in the audit logs (Section 8).

Copilot from outside the office

If you connect an AI program such as Claude to your office’s Copilot (the Archicad add-on bimover Copilot), you sign in on bimover.ch for this and agree on the page bimover.ch/anmelden/zugriff. bimover then passes your requests from the AI program on to the Copilot in the office and its answers back. What they contain (such as the project name, layout names, the number of elements) passes through our server and on to the provider of the AI program; we do not store it. The export itself stays in the office.

For each request we store the time, the person, the office, the AI program, the type of request, the tool and the result, so your office can see who used the Copilot from outside; we delete these entries after 6 months. For the connection we store the AI program with the name and redirect addresses it states itself, who agreed, for which office and when, and checksums of the access keys. When connecting, the Copilot in the office reports its office, the Archicad version and the project name; of these we keep only which office is connected, for as long as the connection is open. Access ends when you leave the office, delete your account or do not use it for 30 days. The provider of the AI program is responsible for its processing, under your contract with it.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for the log of requests, the legitimate interest of your office and ours in detecting misuse (Art. 6(1)(f) GDPR).

6. Licensing and Account Data

To operate licensing, we process:

This processing is required to enforce license rules, entitlement integrity, and anti-abuse controls.

Where an app is licensed by something it counts, we keep what the count is measured against. For Filum that is the mailbox hashes per billing recipient and licence year, and for each archive the reported numbers of records and messages and the checksum of the latest record; see Filum Privacy.

Where an office assigns its licences to its members, as with Orthera and Tessera, we keep which member holds which licence and since when; see Orthera Privacy and Tessera Privacy.

7. Payments, Invoicing and Payrexx

We sell our subscriptions ourselves; bimover GmbH is the contracting party and issues the invoice. Card payments are processed by our payment service provider Payrexx AG (Switzerland), which processes payment method data on our behalf. Business customers may instead be invoiced.

From Payrexx transactions and webhooks, we may process and store:

We use this data to activate, renew, suspend and end subscriptions correctly, and to meet our bookkeeping obligations.

We never receive or store full card numbers or CVV. Those stay with the payment service provider.

Payrexx privacy policy: https://www.payrexx.com/en/privacy-policy/

8. Security, Session and Audit Logging

We process technical security/session data, including:

Error and audit logs may include operational request context (for example bundle ID, offer code, request ID, and status/error codes). Sensitive token/secret fields are redacted in structured error logging. Audit logs are used for security monitoring, incident handling, and legal defense.

9. Data Sharing

We do not sell personal data.

Data may be shared with:

10. International Transfers

Depending on provider infrastructure (for example Apple, Microsoft, the providers of the AI assistant, hosting/network providers), data may be processed outside Switzerland/EU/EEA. Payment processing itself runs with a Swiss provider.

Where required, transfers are based on applicable legal transfer mechanisms and safeguards.

11. Data Retention

We retain data only as long as necessary for the stated purposes and legal obligations.

Typical retention logic:

You may request deletion of your data at any time, unless retention is legally required or needed to enforce an unpaid invoice. You can also delete your account yourself, in your account on this site or in the Cloya app: see Delete your bimover account.

Under GDPR, processing is generally based on:

Under Swiss law, processing is based on lawful purpose, proportionality, transparency and data security under the revised FADP (revDSG).

13. Your Rights

Depending on applicable law, you may have rights to:

Contact: support@bimover.ch

You may also contact the competent supervisory authority.

14. Changes to This Privacy Policy

We may update this Privacy Policy as our services evolve or legal requirements change.

The current version is always published on our website.