01
Who we are
ai-rfi is operated by DeckardDesigns. For the personal information described in this policy, DeckardDesigns is the controller unless another organisation is identified as responsible for its own processing.
You can contact DeckardDesigns about privacy at gareth@deckarddesigns.com.
This policy applies worldwide. It covers the ai-rfi marketing website, Chrome extension, application programming interface (API), and AI-assisted features. Autodesk, Google, OpenAI, and other third-party services have their own privacy notices for processing they control.
02
Information we collect
Autodesk account and authentication information
When you connect Autodesk, we receive identifiers associated with your Autodesk account, including your name, email address, Autodesk identifiers, and OAuth access and refresh tokens. You authenticate through Autodesk; ai-rfi does not receive your Autodesk password.
Project and RFI information
To provide ai-rfi, we process Autodesk hub and project names and identifiers, project-member details, RFI questions, descriptions, statuses, dates, comments, responses, attachments, assignments, and related project metadata. This may include names, email addresses, and content written by other project participants.
Information you choose to submit
We process information you enter through the extension, including RFI questions, comments, responses, proposed answers, edits, reference files, and text you select on an Autodesk Build page when you invoke a supported ai-rfi action.
AI summaries and source material
When AI features operate, ai-rfi processes relevant RFI source material and stores a bounded source record, source fingerprint, generation status, generated summary, model information, and generation timestamps.
Information stored in Chrome
The extension stores settings needed to operate, such as your ai-rfi session token, selected Autodesk hub and project identifiers, workspace association, and temporary information needed to complete context-menu actions. Some temporary information is removed after the action is handled.
Website data, cookies, and analytics
The ai-rfi marketing website does not use analytics, advertising trackers, or cookies. ai-rfi does not intentionally retain server access logs or use crash-reporting or behavioural-monitoring services. Basic network information is necessarily transmitted while your browser connects to the website or API, but it is not used to build advertising or behavioural profiles.
03
How we use information
DeckardDesigns uses the information described above to:
- authenticate you and maintain your ai-rfi session;
- connect to Autodesk and act on requests you make;
- display, search, prioritise, create, update, and respond to RFIs;
- generate and cache AI-assisted titles and summaries;
- preserve your selected workspace and extension preferences;
- secure, maintain, and troubleshoot the service;
- respond to support, privacy, or deletion requests; and
- meet applicable legal obligations.
Where UK or EEA data protection law applies, our lawful bases are performance of a contract or steps requested before entering a contract, our legitimate interests in providing and securing ai-rfi, and compliance with legal obligations. Our legitimate interests include delivering the product functions users expect, protecting the service, and resolving faults. We do not rely on consent as the ordinary lawful basis for the automatic AI processing described below.
ai-rfi does not use personal information to make solely automated decisions that produce legal or similarly significant effects. AI output is provided as an assistive summary and should be checked against the source RFI.
04
AI processing
ai-rfi uses OpenAI services to generate supported RFI titles and summaries. Relevant project and RFI content is sent to OpenAI automatically when an AI-assisted feature is used; ai-rfi does not present a separate AI-consent prompt.
The information sent may contain personal information or confidential project information included in the source RFI. AI summaries are visibly labelled, may be incomplete or inaccurate, and are not a substitute for reviewing the source material or exercising professional judgement.
06
International transfers
ai-rfi is hosted in the United States. Information from users in the UK, EEA, and elsewhere is therefore transferred to and processed in the United States. Autodesk, OpenAI, and their service providers may also process information in countries other than the country where you live.
Where data protection law requires safeguards for an international transfer, we rely on legally recognised transfer mechanisms made available by the relevant provider or otherwise applicable to the transfer. You may contact us for more information about the safeguards relevant to your information.
07
Retention and deletion
Account records, OAuth tokens, hub and project metadata, cached RFI source material, AI summaries, and other service data are kept until you request deletion. We may retain information for longer where required by law or where reasonably necessary to establish, exercise, or defend legal claims.
To request deletion, email gareth@deckarddesigns.com. We may ask you to verify your identity and authority over the relevant Autodesk account or project before completing the request. Where routine backups exist, deleted information may remain in backups until those backups are overwritten.
Disconnecting Autodesk in the extension clears the local ai-rfi session but does not itself delete information held by DeckardDesigns. You must email us to request server-side deletion. You can also manage or revoke connected-app access through Autodesk.
08
Chrome permissions and Limited Use
The extension requests permissions for these purposes:
- Storage: save session, workspace, project, and extension settings.
- Identity: complete Autodesk's OAuth sign-in flow.
- Side panel: show the ai-rfi interface beside Autodesk Build.
- Active tab, context menus, and scripting: provide user-invoked actions involving selected Autodesk Build content.
- Host access: communicate with ai-rfi and Autodesk services and operate on supported Autodesk Build pages.
DeckardDesigns' use and transfer of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.
Chrome-derived user data is used only to provide or improve the user-facing ai-rfi functionality, for security, or as required by law. It is not used for personalised advertising or transferred for unrelated purposes. Humans do not read this data except with the user's permission for support, when necessary for security or legal compliance, or after it has been aggregated and anonymised for permitted internal operations.
09
Security
DeckardDesigns uses administrative and technical safeguards designed to protect information. Production communications use encrypted HTTPS connections, Autodesk credentials are obtained through OAuth rather than by collecting your password, and access is restricted to the purposes described in this policy. No method of transmission or storage can be guaranteed completely secure.
10
Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of your personal information. You may also have the right to appeal our response or complain to a data-protection authority.
UK users may complain to the Information Commissioner's Office. EEA users may complain to their local supervisory authority. US residents may have additional rights under applicable state privacy law. Because we do not sell personal information or use it for targeted advertising, there is no sale or targeted-advertising opt-out process.
To exercise a right, email gareth@deckarddesigns.com. We may need to verify your identity and may decline or limit a request where permitted by applicable law.
11
Children
ai-rfi is a professional construction product and is not directed to children under 18. We do not knowingly collect personal information from children.
12
Changes to this policy
We may update this policy when ai-rfi, our providers, or legal requirements change. We will publish the revised policy here and change the effective date above. Where required, we will provide additional notice of material changes.
13
Contact us
For questions, privacy-rights requests, or deletion requests, contact:
DeckardDesignsgareth@deckarddesigns.com