Backup Sorcery for Autodesk Forma (formerly Autodesk Construction Cloud) and BIM 360 — privacy notice
Version 2026-10-21
Who we are. The controller of the data described here is МАУ ЕООД (MAW EOOD), trading as AEC.codes, Evlogi Hristo Georgiev Blvd 77, 1142 Sofia, Bulgaria. Privacy questions: privacy [аt] aec.codes.
What this notice covers. Backup Sorcery for Autodesk Forma (formerly Autodesk Construction Cloud) and BIM 360: the "Get notified at launch" form, the download registration, the update check the app makes, the invitations we send to partner studios, and the applications we receive from them. Other AEC.codes products have their own notices. The files Backup Sorcery downloads go from Autodesk straight to your computer: they never pass through our servers, and nothing in this notice changes that.
Writing to us
Correspondence. If you write to backupsorcery [аt] aec.codes, we use your email address and what you write only to answer you and to fix problems you report. We keep it as long as we need it to reply and follow up.
The launch notification
What we collect. Your email address; the note you choose to write, if any; the date and time you signed up; and a shortened form of your IP address (the last part removed — /24 for IPv4, /64 for IPv6), kept only to fight abuse of the form.
Why, and on what basis. To send you one email when the first release of Backup Sorcery is available, with the download link and the setup guide. Your note, if you write one, helps us decide what to build. The legal basis is your consent (Article 6(1)(a) GDPR), given by ticking the box on the form. We do not use your address for anything else, we do not add it to any other list, and we do not share or sell it.
How long we keep it. We delete the list within 90 days after sending the launch email. If no release has happened 12 months after you signed up, we delete your entry anyway.
The download registration
What we collect. Your email address; whether you ticked "Also email me when AEC.codes releases a new tool"; the version available when you registered; the date and time; and a shortened form of your IP address, as above.
Why, and on what basis. To run the beta and to keep the people who use Backup Sorcery informed about it: new versions, upgrades and, above all, serious problems with a release that affect your backups. The legal basis is our legitimate interest in running a safe beta and in reaching the people who use the app (Article 6(1)(f) GDPR). Every email we send tells you how to stop receiving them, and you can object at any time by writing to privacy [аt] aec.codes.
If you ticked the box, we also email you when AEC.codes releases a new tool. The legal basis for that is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time. Ticking it is not a condition for the download. We send no newsletters, and we do not share or sell your address.
How long we keep it. For as long as Backup Sorcery is maintained. If you ask us to stop the emails about Backup Sorcery, we delete your entry. If you withdraw only your consent to hear about new tools, we keep your entry and stop those emails.
The app's update check
What the app sends. When the Backup Sorcery window opens, then every 24 hours while it stays open, the app requests one file from our website: https://aec.codes/backup-sorcery/version.json. It says which version is the latest and whether a notice applies to the version you run. The request carries no identifier, no cookie, no account name, and nothing about your hubs, projects or files. It names the app version and the .NET version, in the User-Agent header.
What reaches our server. Like any request to a website, it arrives with your IP address. Our hosting provider's web server writes it to its standard access log, which is deleted after no more than 30 days. We do not link these requests to your registration or to anything else, and we use them only to keep the website running.
Why, and on what basis. So that you learn when a new version is out and, above all, when the version you run has a problem that affects your backups. The legal basis is our legitimate interest in not letting a faulty version keep running unnoticed (Article 6(1)(f) GDPR). The check is always on; the app works without it if our website cannot be reached.
Partner invitations
What we collect. When we invite a studio to our partner programme, we store the email address we write to, the studio's name, the contact's name if we have it, and when we sent the invitation. The invitation link is personal: for each link we count how many times it is opened, per day. We store only that number — no IP address, no browser details, no cookies, no time of day.
Why, and on what basis. To contact studios that may be interested in a partnership and to know whether the presentation was read. The legal basis is our legitimate interest in business-to-business contact (Article 6(1)(f) GDPR). You can object at any time by writing to privacy [аt] aec.codes, and we delete your entry.
How long we keep it. Twelve months after the invitation, unless a partnership follows.
Partner applications
What we collect. The name and the email address you type into the form at /backup-sorcery/apply, and the date and time you sent it. Nothing else: we store no IP address and no browser details. We ask for your studio's email address: an application from a personal mailbox (Gmail, Outlook and similar) is refused and not stored.
Why, and on what basis. To reply to you about the partner programme. The legal basis is taking steps at your request before a possible agreement (Article 6(1)(b) GDPR). We use your address for nothing else and we do not add it to any list. The only party besides us that handles it is our hosting provider, which stores it and delivers the notification email we receive when you apply. We send one confirmation email to the address you entered.
How long we keep it. Twelve months from your application, unless an invitation or an agreement follows: then the rules for partner invitations above apply.
For all of the above
Where it is stored. In the database of the aec.codes website, hosted by Namecheap on servers in the Netherlands (EU). Namecheap processes this data on our behalf under its Data Processing Addendum, which includes the EU Standard Contractual Clauses for any access from outside the EU. Emails are sent from an aec.codes mailbox on the same hosting, in small batches.
Cookies. These pages set two technical cookies. Neither holds personal data. The forms set a session cookie that protects them against forged submissions; it expires when you close your browser. When you register for the download, we also set bs_dl_ok, which remembers for 12 months, in that browser, that you have registered, so you are not asked for your email again. It holds only its expiry date and a signature that stops it from being forged: not your email address, no identifier, no IP address. It is sent only to the Backup Sorcery pages. To remove it, clear this site's cookies in your browser.
Your rights. You can ask to see, correct or delete your data, to restrict or object to its use, or to receive it in a portable format, and you can withdraw your consent at any time — write to privacy [аt] aec.codes and we remove your entry. Withdrawing does not affect anything done before. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) or with the authority of the EU country where you live.