RoundTrips.io ("the Platform", "we", "our") is a file processing and management platform that integrates with Autodesk Construction Cloud (ACC) via Autodesk Platform Services (APS) APIs. This privacy policy describes what data we collect, how we use it, how we store it, and your rights regarding that data.
When your administrator creates your account or you are invited to the platform, we collect:
| Data | Purpose |
|---|---|
| Email address | Account identification, login, and invite delivery |
| User ID | Internal account reference (generated by Supabase Auth) |
| Password (hashed) | Authentication — stored by Supabase Auth, never accessible in plaintext |
| Company assignment | Multi-tenant access control |
| Role (member/admin) | Authorization and access level |
When you connect your Autodesk account via OAuth, we collect:
| Data | Purpose |
|---|---|
| Autodesk User ID | Link your Autodesk identity to your platform account |
| Autodesk email | Display your connected Autodesk identity |
| Autodesk display name | Display your connected Autodesk identity |
| OAuth access token | Access ACC files on your behalf (encrypted at rest) |
| OAuth refresh token | Maintain your connection without re-authenticating (encrypted at rest) |
We use the standard 3-legged OAuth 2.0 flow with PKCE (Proof Key for Code Exchange). We never see or store your Autodesk password.
| Data | Purpose |
|---|---|
| ACC hub, project, and folder names | Navigation and file selection UI |
| File names and metadata | Display file lists, track processing status |
| File contents (temporarily) | Processing files through Navisworks conversion pipeline |
| Processed output files | Stored locally until uploaded back to ACC or manually cleared |
| Data | Purpose |
|---|---|
| Task/job records | Track file processing requests, status, and history |
| Admin audit log | Record administrative actions |
| Server logs | Debugging, error tracking, and operational monitoring |
We use collected data exclusively for:
| Data Type | Storage Location | Security |
|---|---|---|
| Account data | Supabase (cloud PostgreSQL) | Row-Level Security, encrypted in transit |
| Autodesk OAuth tokens | Supabase database | Fernet encryption at rest, RLS |
| APS app credentials | Supabase database | Fernet encryption at rest |
| File cache | Local server filesystem | Company-scoped directories |
| Passwords | Supabase Auth | Bcrypt hashed |
| Data Type | Retention Period |
|---|---|
| Account data | Until account is deleted by admin |
| Autodesk OAuth tokens | Until user disconnects or account deleted |
| Cached files | Until manually cleared or cache eviction |
| Task/job records | Indefinite (for history/audit) |
We do not sell, rent, or share your personal data with third parties. Data is shared only with:
| Recipient | Data Shared | Purpose |
|---|---|---|
| Autodesk (via APS APIs) | OAuth tokens, API requests | Access your ACC files on your behalf |
| Supabase | Account data, application data | Database hosting and authentication |
Both services have their own privacy policies: Autodesk Privacy · Supabase Privacy
This platform is not intended for use by individuals under the age of 16. We do not knowingly collect data from minors.
We may update this privacy policy from time to time. Material changes will be communicated via the platform or email. Continued use of the platform after changes constitutes acceptance of the updated policy.
For privacy-related questions or data requests: