Privacy Policy

Last updated: May 29, 2026

1. Introduction

OSUMA arkkitehdit Oy ("we", "our", "us") operates the Trivecta® platform at trivecta.ai. This Privacy Policy explains how we collect, use, and protect your personal information when you use our service.

2. Information We Collect

We collect the following types of information:

Account information: Email address and name when you sign up directly or via Google Sign-In.
Usage data: Credit consumption, feature usage, and session information to improve our service.
Content you create: Projects, assets (images, videos), workflows, and canvas data stored in your account.
Technical data: Browser type, IP address, and device information for security and performance purposes.

3. How We Use Your Information

To provide, maintain, and improve our services.
To process AI-generated content requests through third-party AI providers.
To manage your account, credits, and subscription.
To communicate with you about service updates and support.
To detect and prevent abuse, fraud, and security threats.

4. Third-Party Services

We use the following third-party services:

Supabase: Authentication and database hosting (EU region).
Google & Apple:OAuth authentication when you choose to sign in with Google or Apple. With Sign in with Apple you may use Apple's Private Relay to hide your email; we only receive the relay address.
AI providers: Your prompts and input images are sent to AI model providers to generate content. We do not store your prompts on third-party servers beyond what is required for processing.

5. AI Data Processing

When you use AI features in Trivecta, your content (images, text prompts, and IFC model data) is transmitted to the following third-party AI service providers for processing:

fal.ai (image generation) — San Francisco, USA
Together.ai (language models) — San Francisco, USA
Google Cloud / Vertex AI (video, vision) — EU/US regions
KIE.ai (video generation proxy)

These providers process your content solely to generate the requested output. Together.ai and Google Cloud have confirmed that they do not use API customer data for model training. We are seeking the same confirmation from fal.ai and KIE.ai.

You can request deletion of all your data at any time by contacting privacy@trivecta.ai.

6. Data Storage and Security

Your data is stored securely using industry-standard encryption. Project data (assets, workflows, canvas state) is stored in your browser's local storage and IndexedDB. Account data is stored in Supabase infrastructure. We implement rate limiting, CAPTCHA verification, and other measures to protect against abuse.

7. Your Rights (GDPR)

If you are located in the EU/EEA, you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data ("right to be forgotten").
Export your data in a portable format using the built-in export feature.
Object to the processing of your data.
Withdraw consent for data processing at any time.

To exercise any of these rights, contact privacy@trivecta.ai.
Data controller: OSUMA arkkitehdit Oy (business ID / Y-tunnus: 2362162-7), Helsinki, Finland.

8. ArchiCAD Integration

When you use the Trivecta ArchiCAD Plugin, a small companion application ("Trivecta Bridge") runs on your computer to connect ArchiCAD with Trivecta. The following applies in addition to the rest of this policy:

The connection between ArchiCAD and Trivecta Bridge is local (loopback only) and does not traverse the internet.
Your BIM project data is sent to Trivecta only when you explicitly initiate a transfer (for example by running the bridge's sendcommand or clicking "Send to Trivecta").
IFC files are uploaded over encrypted HTTPS connections and stored in the same Supabase infrastructure described above.
Your authentication token is stored in your operating system's secure credential store (macOS Keychain / Windows Credential Manager / libsecret on Linux), not in plain-text configuration files.
Temporary IFC files created during transfer are deleted from your machine after upload (unless you pass --keep-file for debugging).
The Tapir Add-On is a third-party open-source ArchiCAD extension (MIT license) that the bridge uses to drive ArchiCAD. Tapir may contact github.com to check for its own updates; this traffic is independent of Trivecta and is not initiated by Trivecta.
Your ArchiCAD license information is never accessed or transmitted by the bridge.

9. Cookies

Trivecta uses essential cookies for:

Authentication — your Supabase session.
Session management — the tv_sid concurrent-session token.

We use PostHog for product analytics when enabled; you can opt out in your settings. We do not use advertising cookies or third-party tracking cookies.

10. Data Retention

We retain your account data for as long as your account is active. When you delete your account, we remove your personal data within 30 days. Anonymized usage statistics may be retained for service improvement.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the service. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Contact

For privacy-related questions or requests, contact us at privacy@trivecta.ai.