Skip to content
AI Renovation
Last updated: 19 September 2026

Privacy Policy

AI Renovation, whose registered address is 12 Place Carnot, 93110 Rosny-sous-Bois, France, operates the website ai-renovation.org and the scan-to-scope platform described on it. This policy explains what personal data we process, why, on what legal basis, for how long, and what rights you have under the General Data Protection Regulation (Regulation (EU) 2016/679, the GDPR) and French data protection law.

1. Who is responsible for your data

For the website ai-renovation.org, for accounts on the Run Console, and for our business contacts, AI Renovation is the data controller.

For the content of Capture Sets (laser scan stations and photographs of buildings uploaded by our clients) and for everything derived from them (As-Built Models, Element Ledgers, Trade Lot Takeoffs, Residual Maps, Retrofit Frontiers, Scope Packs), the client who owns or manages the building is the data controller and AI Renovation is the data processor. We process that content only on the client's documented instructions under a data processing agreement that meets Article 28 of the GDPR. Residents of a building whose images appear in a Capture Set should address requests to the building owner or manager; we assist that controller in answering them.

Contact for all data protection matters: privacy@ai-renovation.org, or by post to AI Renovation, 12 Place Carnot, 93110 Rosny-sous-Bois, France.

2. What data we process, why, and on what basis

2.1 Website visitors

  • Data: IP address, browser and device information, pages viewed, referring page, and the cookie choices you make.
  • Purpose: to serve the site securely, to detect abuse, and, only if you accept analytics cookies, to measure which pages are read.
  • Legal basis: our legitimate interest in running a secure website (Article 6(1)(f)); your consent for analytics cookies (Article 6(1)(a)), which you can withdraw at any time through the cookie banner link in the footer.

2.2 Design-partner applications and access requests

  • Data: the organisation name, your role, your work email, the buildings you describe, and the availability of metered consumption and a surveyor, as entered on /design-partners or /signup.
  • Purpose: to evaluate the application, reply to you, and prepare a data processing agreement if we work together.
  • Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b)).

2.3 Run Console accounts

  • Data: name, work email, organisation, role within the programme, authentication data, and a log of actions taken in the Run Console (uploads, exports, access to imagery).
  • Purpose: to provide the service to your organisation, to secure it, and to keep the audit trail that the accuracy commitments and the data processing agreement require.
  • Legal basis: performance of the contract with your organisation (Article 6(1)(b)); our legitimate interest in security and auditability (Article 6(1)(f)).

2.4 Business contacts

  • Data: name, role, organisation, work email, telephone, and correspondence.
  • Purpose: to manage the commercial relationship and answer your requests.
  • Legal basis: performance of a contract or steps preceding it (Article 6(1)(b)); legitimate interest in maintaining business relationships (Article 6(1)(f)).

2.5 Capture Set content (as processor)

  • Data: laser scan stations and photographs of the interior and exterior of buildings, which can show residents, their belongings, screens, and documents; metered energy consumption of the building supplied by the controller.
  • Purpose: reconstruction, element labelling, quantity takeoff, and retrofit simulation, as instructed by the controller.
  • Safeguards: faces, screens, and documents visible in photographs are blurred before any human review; staff access to raw imagery is limited to quality review and logged; raw imagery is deleted 90 days after the Scope Pack is accepted unless the controller extends retention in writing.

We do not sell personal data and we do not use Capture Set content to train models for other clients without the controller's written agreement.

3. Cookies

The site sets only the cookies it needs to run until you choose otherwise:

  • Essential cookies: cookie-choice memory and, for the Run Console, the session cookie that keeps you signed in. These cannot be switched off because the site does not work without them.
  • Analytics cookies: off by default. If you choose "Accept analytics", a first-party analytics cookie measures page views for 13 months at most. You can change your choice at any time through the "Cookie settings" link in the footer.

No advertising cookies are set. We honour the cookie choice you make on the banner and do not read it as consent to anything else.

4. How long we keep data

  • Website logs: 12 months.
  • Analytics data: 13 months from collection, then aggregated.
  • Design-partner applications and access requests: 24 months after the last exchange, or until the contract is signed and the data moves to the account records.
  • Run Console accounts and audit logs: for the duration of the contract plus 5 years, to meet the accuracy commitments and legal obligations.
  • Business contact records: 3 years after the last contact.
  • Capture Set raw imagery: 90 days after Scope Pack acceptance unless the controller extends retention in writing; As-Built Models, Element Ledgers, and Scope Packs: for the duration of the programme as instructed by the controller, then returned or deleted within 90 days of the end of the contract.

5. Who receives data

  • Our staff, on a need-to-know basis and under confidentiality obligations.
  • Hosting and infrastructure providers located in the European Union, acting as our subprocessors under written agreements; the current list is available on request from privacy@ai-renovation.org and is annexed to each data processing agreement.
  • Independent surveyors engaged by the controller for quality sampling, who receive the Element Ledger sample they re-measure and no imagery unless the controller decides otherwise.
  • Public authorities where the law requires it.

We do not transfer personal data outside the European Union. If that ever becomes necessary, we will rely on a European Commission adequacy decision or the standard contractual clauses and tell you beforehand.

6. Security

Data is encrypted in transit and at rest. Access to systems is per programme and per role, with multi-factor authentication for staff and Run Console accounts. Access to raw imagery is logged. Security incidents affecting a Capture Set are notified to the controller within 48 hours of confirmation, with the affected stations listed, so the controller can meet its own obligations under Articles 33 and 34 of the GDPR.

7. Your rights (Articles 13 to 22 of the GDPR)

You have the right to:

  • be informed about the processing of your data (Articles 13 and 14), which this policy provides;
  • access the data we hold about you and receive a copy (Article 15);
  • have inaccurate data corrected (Article 16);
  • have your data erased where there is no longer a lawful reason to keep it (Article 17);
  • have processing restricted while a dispute is examined (Article 18);
  • receive the data you provided in a structured, machine-readable format and have it transmitted to another controller where processing is based on consent or contract (Article 20);
  • object to processing based on our legitimate interests, and to direct marketing at any time (Article 21);
  • not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you (Article 22). The Reconstruction Run, the Element Labeller, and the Scenario Simulator process buildings, not people, and no such decision is made about individuals.

You may also withdraw consent at any time where processing relies on it, without affecting processing that took place before the withdrawal, and you may give instructions on the fate of your data after your death under French law.

To exercise these rights, write to privacy@ai-renovation.org or to AI Renovation, 12 Place Carnot, 93110 Rosny-sous-Bois, France. We reply within one month, extendable by two months for complex requests, and we may ask you to confirm your identity. If you are a resident of a building captured in a Capture Set, we forward your request to the controller and assist it in answering.

You have the right to lodge a complaint with the French supervisory authority, the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr, or with the supervisory authority of your country of residence.

8. Children

The website and the Run Console are intended for professionals. We do not knowingly collect personal data from anyone under 15.

9. Changes to this policy

We may update this policy when the service or the law changes. The date at the top shows the current version. Material changes affecting Run Console users are announced by email before they take effect.