Qikbim

The Privacy Policy and Consent Agreement define user-submitted prompts, files, drawings, and models as 'Inputs' but never state who owns them; ownership terms would typically live in the Terms and Conditions, which was inaccessible. The Consent Agreement requires users to warrant they have all rights to submit Inputs but grants no explicit ownership assurances back to the user. The silence on ownership is a risk for a tool handling proprietary architectural work product.

The documents define AI-generated drawings, plans, and models as 'Outputs' but are silent on who owns them; ownership would be governed by the inaccessible Terms and Conditions. The Consent Agreement stresses that Outputs are preliminary, may contain errors, and require professional review, but does not address ownership or licensing. This silence leaves output rights unresolved in the supplied text.

The vendor explicitly reserves the right to use Inputs and usage data to develop, improve, and train its AI models. Opt-out of training is only a conditional future possibility ('if and when' the Company offers such settings), meaning by default user design files may feed model training. This is a significant risk for professional users submitting proprietary work.

The Privacy Policy states data is retained 'as long as necessary' but provides no defined retention schedule or deletion SLA. Users may request deletion by contacting support, and the vendor commits to respond within timeframes required by applicable law. The absence of concrete retention periods or an audit-log retention commitment lowers confidence.

The vendor discloses sharing with named service providers (Wix, Stripe, and cloud/analytics/security providers), affiliates, and in legal or business-transfer contexts. It states it does not sell personal information for money and offers opt-out where a disclosure constitutes a 'sale' or 'sharing.' Sharing is disclosed and limited to service operations, but the broad affiliate and business-transfer language warrants a moderate rating.

Users can opt out of marketing emails, exercise deletion/access rights, and opt out of any 'sale'/'sharing' with recognized signals like Global Privacy Control honored where required. However, opt-out of model training is only a conditional future feature ('if and when'), so a key opt-out for a design-automation tool is not currently guaranteed.

The documents reference GDPR and CCPA/CPRA obligations and legal bases but claim no third-party certifications or attestations (no SOC 2, ISO 27001, ISO 27018, ISO 27017, CSA STAR). For a developer/enterprise-oriented tool, the absence of any named security certification or audit report is a material gap. Only privacy-law compliance is referenced, without evidence of external attestation.

The Privacy Policy notes AI/ML is used to process Inputs and generate Outputs and states no legally significant decisions are made solely by automated processing, but it offers no enterprise auditing capability or model transparency commitment. The documents provide no explainability tooling or audit access. This limits transparency for professional review needs.

The Privacy Policy describes 'reasonable administrative, technical, and organizational measures' but names no specific controls such as encryption at rest/in transit, penetration testing, or a bug bounty, and no trust center or security page is referenced. No breach history is disclosed. The generic, unspecific security language and absence of a dedicated security page reduce confidence.

The supplied documents are consumer/standard terms and describe no differentiated free-versus-paid data handling; payment and subscription processing is mentioned but no tier-specific privacy carve-outs. No enterprise agreement or DPA was accessible to compare. The absence of any enterprise data-handling distinction means professional users get the same default terms, including default training use.

The vendor explicitly reserves the right for authorized personnel to review Inputs and Outputs for safety, abuse prevention, quality assurance, and service improvement. This human-review right applies to proprietary design files and is broadly framed. Combined with the instruction not to submit sensitive personal information, this is a notable confidentiality risk.

The Privacy Policy discloses that personal information may be disclosed to comply with law, legal process, or governmental request and to establish or defend legal claims. No specific litigation, breach, or law-enforcement request history is disclosed. The language is standard but broad, and cross-border Cayman/US processing adds jurisdictional complexity.

The vendor collects a range of PII including name, email, company/role, IP address, device identifiers, approximate location, and usage data, plus payment details processed by Stripe (not stored in full). It instructs users not to submit sensitive personal information and states the service is not directed at children. PII collection is significant but disclosed with purpose limitation, and SPI is discouraged rather than collected.

Both documents carry an Effective Date of July 20, 2026, less than one month before the analysis date, and they demonstrably address the AI/ML processing, model training, and automated Input/Output handling visible in the product surface (an AI-assisted BIM design-automation platform). The policy explicitly acknowledges AI use, human review, and training. The named third-party providers (Wix, Stripe) match disclosed infrastructure, though ETABS/SAFE/Revit integrations from the product surface are not addressed.

Two documents were supplied — the Privacy Policy and the Consent Agreement — and they are mutually consistent on AI processing, training use, human review, international transfers, and consent withdrawal. No contradictions were found between them. Both share the same Effective Date and reinforce each other's provisions, though the referenced Terms and Conditions and System Use Disclaimer were not accessible to cross-check.