Privacy Policy

1. Who this applies to

This policy covers personal information that Momentum (operated by the GetMomentum team) processes through:

• The Momentum web dashboard at getmomentum.studio
• The Momentum addin running inside Autodesk Revit
• The MomentumHub local server (legacy, optional)
• Cloud Functions and Firebase services that back the above

If you are an admin (the person who created your firm's Momentum workspace), you are our customer and we are your data processor. If you are a modeler whose Revit work is tracked by Momentum, your employer is the controller of that data — we process it on their behalf, under their direction.

2. What we collect

Account information

Revit session activity (collected by the addin)

Tasks, projects, and team data

• Tasks created by admins (title, description, assignee, due date, comments, status)
• Projects (name, project number, allocated hours, trade, assigned modelers, checklist items)
• Team membership and invitation tokens
• Per-tenant settings (idle threshold, billing plan, webhook subscriptions)

Billing

If your firm subscribes to a paid plan, billing is handled by Stripe. Stripe collects payment information (card number, billing address, etc.) under Stripe's own privacy policy. Momentum receives only a customer ID, subscription status, and plan type — never raw card data.

3. What we DO NOT collect

We deliberately collect the minimum needed to do project tracking. We do not capture:

• Screenshots or screen recordings — never, on any plan
• Keystrokes or typed content — never. The system input check returns only "did any input happen recently," not what was typed
• File contents from Revit models — only metadata about events (counts, names, timestamps)
• Activity outside Revit — we do not record which other apps you use, browser history, emails, or anything else on your machine. The addin runs inside Revit and only watches Revit's events
• The name of the foreground window — explicitly excluded by design (see How Momentum works)
• Microphone, camera, or location — never accessed
• Health data, biometric identifiers, or characteristic data — not collected; not applicable
• Children's data — Momentum is a B2B workplace tool not directed at children under 13

4. How we use it

The information we collect is used only to:

• Show your firm's admins and modelers who is working on what, when, and for how long
• Compute time-on-project and active/idle aggregates for project management
• Route tasks created by admins to the correct modeler's Revit addin
• Authenticate you and authorize access to your workspace
• Send service-related notifications (billing receipts, security alerts, account changes)
• Respond to support requests and diagnose technical issues
• Detect and prevent abuse (e.g., repeat trial signups)
• Improve the product, in aggregate and de-identified form, based on usage patterns

We do not use your data to:

• Train AI models (yours or anyone else's)
• Sell to advertisers, data brokers, or any third party
• Profile you for marketing
• Make automated employment decisions about you (Momentum is a measurement tool — your employer makes any decisions based on it)

5. Who can see your data

Inside your workspace

• Workspace admins see all sessions, tasks, projects, and modelers in the workspace.
• Modelers (members) see their own assigned tasks. They do not see other modelers' session details, team-wide activity cards (Live Now, full team activity), or team-management controls — those are admin-only.

Outside your workspace

• Other tenants cannot see your data. Multi-tenant isolation is enforced at the Firestore rule level: every document carries a tenant ID, and authentication tokens are scoped to a single tenant. A tenant token cannot read or write any document outside its tenant.
• Momentum staff have administrative access to diagnose issues. We access your data only when necessary to provide support or investigate a security incident, and only when authorized internally.
• Your subprocessors (the cloud providers that host Momentum) see encrypted data at rest and in transit. They are listed in section 8.
• Outbound webhooks: if your admin configures a webhook subscription to your own systems, we send signed event payloads to that URL. You control which events go where.

6. Where data lives and for how long

• Region: Google Cloud Firestore nam5 (US central). Cloud Functions in us-central1.
• Encryption: at rest (Google-managed AES-256) and in transit (TLS 1.2+).
• Retention: session events are retained for the life of your subscription. The dashboard shows the last 14 days; older sessions remain queryable. When you cancel your subscription, data is retained for 30 days to allow reactivation, then deleted on request or in the next quarterly purge.
• Backups: Firestore exports are taken weekly. Backups follow the same encryption and isolation rules as live data.

7. Your rights

Depending on where you live, you may have rights under laws like the GDPR (EU/UK), CCPA/CPRA (California), or other regional privacy statutes — including rights of access, correction, deletion, portability, and objection. Who you direct those requests to depends on which data we're talking about:

If you are a modeler (your firm's workspace contains your Revit activity)

Your employer is the data controller for your Revit session data. Momentum hosts that data on their behalf — we do not own it and cannot release it to you without their authorization. Direct your access, correction, deletion, or export requests to your workspace admin. Your employer can fulfill them through their dashboard or by emailing us; we'll act on their instructions, not on a request from you directly. If your employer ignores a request you believe you're entitled to under applicable law, you can complain to your local data-protection authority (the Information Commissioner's Office in the UK, your state attorney general in the US, your DPA in the EU).

If you are an admin (you signed up your firm's workspace)

You can email Info@getmomentum.studio directly for your own account information, your firm's workspace data, or to request deletion of your tenant. We respond within 30 days. Some requests may require additional verification of your authority to act on the firm's behalf.

Everyone

• Complain: you can always contact your local data-protection authority if you believe Momentum or your employer has mishandled your data, regardless of which party the request was directed to.
• Right to be informed: this Privacy Policy and the How Momentum works page describe our processing in plain English. Both are public; no sign-in required.

8. Subprocessors

We rely on a small set of vendors to operate the service. Each is contractually bound to handle your data only as we direct.

9. International transfers

Our infrastructure is in the United States. If you are in the EU, UK, or another region with cross-border transfer restrictions, your data is transferred to the US under Standard Contractual Clauses with appropriate technical and organizational safeguards. Email us for a Data Processing Addendum (DPA) if your firm requires one.

10. Workplace monitoring laws

• Connecticut requires written notice of electronic monitoring (Conn. Gen. Stat. § 31-48d).
• Delaware requires the same (19 Del. C. § 705).
• New York requires written notice on hire and posted conspicuously (NY Civil Rights Law § 52-c; effective 7 May 2022; civil penalty up to $500/$1,000/$3,000 for first/second/third+ violations, AG enforcement only).
• Other states may have similar or evolving requirements; consult employment counsel.

For EU/UK customers, employee monitoring is additionally constrained by the GDPR (Article 88, plus Member State law). Most jurisdictions require a documented justification (legitimate interest assessment), proportionality, and transparent notice to employees.

11. Security

• Microsoft 365 SSO only — no passwords stored by Momentum
• Per-tenant API keys (revocable without rebuilding the addin)
• Firestore security rules enforce tenant isolation at the database layer
• HMAC-SHA256 signed outbound webhooks
• HTTPS / TLS 1.2+ everywhere
• Two-step deploy + secret manager for cloud secrets

If you discover a security issue, please email Info@getmomentum.studio with the details. We respond to security reports within 48 hours.

12. Cookies

The Momentum dashboard uses only cookies essential to the service: an authentication cookie set by Firebase Auth so you stay signed in, and a small localStorage entry that remembers your dashboard preferences (such as Presentation Mode). We do not use advertising or analytics cookies on the application surface. The marketing site at getmomentum.studio may use minimal first-party analytics in the future; if so this policy will be updated and a banner will be added before any change takes effect.

13. Changes to this policy

If we make a material change, we will update the "Last updated" date at the top, post a banner on the dashboard, and email workspace admins. Your continued use of Momentum after a change indicates acceptance of the updated policy.

14. Contact

Questions, requests, or complaints — including all access, correction, deletion, and export requests:

Info@getmomentum.studio