Privacy Policy

This Privacy Policy explains how AssetorKit handles personal information when you visit assetorkit.com, browse our marketplace website, create an account, purchase or claim plugins, download licensed software, or contact us.

AssetorKit is a marketplace for Revit plugins and BIM assets. This Policy describes practices that match how the AssetorKit application works today. It is not a certification of compliance with any particular privacy law.

If you do not agree with this Policy, please do not use the Service. For questions about personal data, contact us using the details in the Contact section below.

This Policy applies to the AssetorKit website (assetorkit.com), related account and checkout flows, transactional emails we send, and the systems that power them.

It does not cover third-party websites or services that we link to (for example, payment apps you use to transfer money, or authentication screens operated by our identity provider), except to describe how we receive data from those providers when you use AssetorKit.

Our separate admin application is used by AssetorKit operators to manage the marketplace. Admin operators process customer data as described here in order to fulfill orders, support users, and operate the Service.

We collect information in three ways: (1) you provide it directly; (2) it is created when you use the Service; and (3) it is provided by service providers acting on our behalf (for example, our authentication provider).

Account authentication is provided by Clerk. When you sign up or sign in, Clerk processes credentials and session data according to Clerk’s own terms and privacy notice.

In our systems, we store a local user record linked to your Clerk user identifier. That record typically includes:

• Your display name (full name)
• Email address (synced from Clerk when available)
• Clerk user ID and our internal user ID
• Optional profile photo URL
• Optional date of birth, if provided through our profile API
• Account role used for access control (for example, customer or administrator)
• Account creation and update timestamps

Passwords, multi-factor authentication settings, and session management for your login are handled by Clerk. AssetorKit does not operate a separate local password store for new accounts.

You can update certain profile details in your account settings. Email and password changes are managed through Clerk’s account controls in our profile experience.

Purchases are recorded as invoices in our database. Depending on the purchase, we may store:

• Items purchased (plugin and plan details, price and currency snapshots)
• Amounts, discounts, coupon metadata (when a coupon is applied), and billing period
• Invoice status (for example, pending, approved, or rejected)
• Payment method selected for checkout
• Invoice / receipt number assigned when entitlement is granted
• Admin review notes and review timestamps related to payment approval or rejection
• Checkout identifiers used for idempotency and fraud/abuse prevention

Currency for purchases on the AssetorKit website is Egyptian pounds (EGP).

Free plugins and fully discounted (zero-total) checkouts create invoice records without requiring a transfer proof upload.

AssetorKit’s live paid checkout currently uses manual bank-transfer style methods: InstaPay and Vodafone Cash. You complete the transfer outside AssetorKit, then submit proof in checkout so our team can verify payment.

For paid checkouts we may collect and store:

• InstaPay username or Vodafone Cash phone number used as payment proof
• Optional payer name you enter at checkout
• A screenshot of your transfer confirmation (image upload)
• Encrypted storage of the payment reference string associated with the invoice

We do not collect card numbers, CVV codes, bank login credentials, or full bank account credentials through AssetorKit checkout.

Card and wallet processors such as Stripe, PayPal, or Paddle are not currently processing live customer payments in the AssetorKit application. Any references to those providers in configuration are inactive placeholders or scaffolding only.

Payment screenshots are stored on our application hosting environment as private uploads and are shown to operators through short-lived signed URLs for review. They are not published publicly.

For subscription plugins, we store subscription records linked to your account and licenses, including status, billing period dates, cancellation preferences, and related timestamps.

Renewals currently follow a manual payment flow (you are directed back to checkout to submit proof again). We do not automatically charge a saved card or third-party payment method on a recurring basis today.

To deliver plugins securely we store license and entitlement data, which may include:

• License status (for example, active, trial, expired, revoked)
• License key material stored in protected/hashed form (not displayed as a permanent plaintext secret in ordinary API responses)
• Expiry and trial timing fields
• Device activation records used to enforce activation limits (machine fingerprints / activation metadata)
• Download attempt logs (user, plugin, version, success or denial reason, timestamp)

Plugin package files are stored in private Cloudflare R2 object storage. Downloads use short-lived authorized URLs after we verify your entitlement.

A download log field for hashed IP addresses exists in our schema; the current application path does not routinely populate raw or hashed client IPs on those logs.

Like most web services, our hosting and security layers may process technical data such as IP addresses, request metadata, and approximate timing information for rate limiting, abuse prevention, reliability, and diagnostics.

Application error monitoring (Sentry) may capture crash and error diagnostics from the AssetorKit website, our internal admin tools, and our servers. By default we configure Sentry not to send default personally identifying fields; request bodies and cookies are scrubbed where our instrumentation is applied. Internal user identifiers may be attached to events for debugging. Email may be included only if explicitly enabled in configuration.

We may also store guest cart contents and notification read-state in your browser’s local storage to support the product experience.

The AssetorKit website uses PostHog (EU cloud) to understand product usage. Browser analytics runs without a consent step while the cookie banner is switched off. Analytics may include:

• Page views and navigation paths
• Product, cart, checkout, trial, and related interaction events
• A distinct analytics identifier; when you are signed in, we may associate events with your Clerk user ID and optional internal app user ID and role (not your email by default)
• Session replay recordings configured with input masking for sensitive fields

Our API may also send a server-side purchase completion event to PostHog after a successful free checkout grant or after an operator approves a paid invoice, so revenue funnels remain accurate even if the browser session is interrupted.

We apply client-side scrubbing intended to drop or redact sensitive keys and patterns (for example, tokens, payment screenshots, email-like and phone-like substrings) before browser events are sent.

If you previously chose Reject non-essential, we keep not tracking you: an explicit refusal stored in your browser is honoured even while the banner is switched off. Clearing this site's storage removes that stored choice.

We do not currently use Google Analytics, Google Tag Manager, or similar advertising pixels on the AssetorKit website.

We use the following categories of cookies and similar technologies:

• Strictly necessary — Clerk authentication and session cookies so you can sign in and stay signed in securely; first-party local storage for guest cart contents, notification read markers, and your cookie preference itself; short-lived session storage for one-time in-app prompts. These are required for the Service to work and are not controlled by the analytics toggle.
• Preferences — we do not currently store separate preference cookies beyond your cookie consent choice (listed above as necessary).
• Analytics — PostHog cookies and local storage (persistence may use both), used for product analytics and optional masked session replay. These are activated without a consent step while the cookie banner is switched off; an explicit earlier refusal is honoured.
• Marketing / advertising — not used on the AssetorKit website. We do not load advertising pixels or marketing cookies.

The cookie banner and its Cookie settings control are currently switched off, so browser analytics runs without a preference step. If you made a choice while the banner was available, that stored choice is still honoured. We will update this description if we re-enable the banner.

While the banner is switched off there is no in-page toggle for analytics. You can still limit it through your browser's cookie, storage, or tracking-protection settings, and an explicit Reject choice you made earlier is honoured. Sign-in, cart, and checkout continue to work regardless.

Application error monitoring (Sentry) is separate from PostHog analytics. It may set its own diagnostic cookies or storage as part of keeping the Service reliable and secure; it is not gated by the analytics consent toggle.

Blocking all cookies may prevent sign-in and other essential features from working correctly.

We use personal information to:

• Create and maintain your account
• Provide the marketplace, cart, checkout, invoices, licenses, and downloads
• Verify manual payments and prevent duplicate or fraudulent claims
• Send transactional messages (for example, welcome, order confirmation, payment approved/rejected, license and subscription notices, expiry reminders)
• Respond to authenticated support messages sent through our contact form
• Operate security controls, rate limits, audit logs for administrative actions, and error monitoring
• Improve the Service through analytics
• Send product announcement emails only when that non-transactional channel is enabled by operators (it is disabled by default in our system)

We also process information as needed to enforce our Terms of Service, protect the Service and other users, keep records of commercial transactions, and comply with applicable legal obligations when they apply to us.

This Policy does not claim that any specific statute (for example GDPR, CCPA, or Egyptian data protection law) fully applies or that AssetorKit is certified under it. Where those laws apply to you or to us, we will handle requests in good faith through the contact channels below.

We use specialized providers to operate AssetorKit. They process data only as needed to provide their services to us. Current categories include:

• Clerk — authentication, sessions, and account credential management
• PostgreSQL database hosting — durable application data (production uses managed PostgreSQL on Azure; local development may use Docker PostgreSQL)
• Microsoft Azure — API application hosting and related infrastructure
• Vercel — hosting the AssetorKit website (and our internal admin website)
• Cloudflare R2 — private storage for plugin package files
• SMTP email delivery — transactional (and, if enabled, announcement) email
• PostHog — product analytics and optional session replay (browser-side, running without a consent step while the cookie banner is switched off; server-side purchase events are also sent for completed transactions)
• Sentry — error and performance monitoring
• Hangfire (running with our API) — background jobs such as email delivery and expiry reminders

These providers may process data in regions outside your own country (including the European Union for PostHog’s EU cloud, and other regions used by Clerk, Azure, Vercel, Cloudflare, or SMTP infrastructure).

We do not sell personal information.

Account, invoice, license, subscription, feedback, notification, and related records are stored in our PostgreSQL database.

Plugin packages are stored in private Cloudflare R2 buckets and accessed through short-lived authorized URLs.

Payment proof images are stored as private uploads on the API host’s file storage (not in the public plugin package bucket).

Browser-side guest cart and analytics identifiers may be stored locally on your device as described above.

We retain personal information for as long as needed to provide the Service, maintain commercial and license records, resolve disputes, enforce agreements, and meet operational or legal record-keeping needs.

There is currently no fully automated self-service erasure or timed purge of all personal data across every system. Some temporary artifacts (for example, expired upload sessions reconciled against object storage) are cleaned by scheduled jobs, but that is not a complete personal-data deletion program.

If you ask us to delete your account data, we will review what can be removed or anonymized without breaking records we must keep (for example, completed purchase history needed for accounting or fraud prevention).

We implement technical and organizational measures appropriate to our Service, including authenticated API access, access-control checks for downloads and invoices, encryption of certain sensitive payment reference fields, private object storage for packages, scrubbing controls in analytics and error reporting, and restricted access for administrative tools.

No method of transmission or storage is completely secure. We do not claim absolute security or PCI certification for AssetorKit. You are responsible for protecting access to your Clerk account and devices.

Because we use cloud providers, your information may be processed in countries other than where you live. Those countries may have different data protection rules. We rely on our providers’ published safeguards and our contractual arrangements with them where applicable.

When you pay via InstaPay or Vodafone Cash, you interact directly with those payment services. Their handling of your financial account is governed by their own terms and privacy policies. AssetorKit receives only the proof and metadata you submit for verification.

Clerk’s hosted authentication components and dashboards are governed by Clerk’s policies.

Depending on where you live, you may have rights to access, correct, delete, or restrict certain processing of your personal information, or to object to certain processing.

What the AssetorKit application supports today:

• Correction of profile name and related account details through account settings / Clerk controls — available
• Access to your licenses, invoices, and account information through the signed-in product UI — available
• Automated full data export package — not currently implemented as a self-service feature
• Automated account deletion / full erasure across all systems — not currently implemented as a self-service feature
• Analytics cookie preference — the banner and its Cookie settings control are switched off, so there is no in-page toggle right now; an explicit earlier refusal is still honoured
• Marketing-style plugin announcements — off by default; transactional emails related to your purchases and licenses may still be sent because they are part of providing the Service

To request access, correction, deletion, or other assistance regarding personal data, contact support@assetorkit.com or use the in-app contact form while signed in. We may need to verify your identity before acting on a request.

Self-service account deletion is not currently built into AssetorKit. If you want your account closed or personal data deleted, contact us. We will explain what we can delete, what we may retain (for example, invoice records), and any practical limits imposed by backups or service providers.

Disconnecting a social login method is not the same as deleting your AssetorKit account.

We send transactional emails related to your account and purchases (examples: welcome, order confirmation, payment status, license creation, subscription and trial notices, expiry reminders, and plugin update notices for plugins you use).

Operators may enable occasional product announcement emails. That channel is separate from transactional mail and is disabled by default in our notification settings.

There is no separate marketing unsubscribe center beyond contacting us and the notification controls operators maintain. Transactional messages required to provide the Service may continue even if announcement mail is disabled.

AssetorKit is directed to professionals and is not intended for children. We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us and we will take appropriate steps.

We may update this Policy as the Service changes. We will revise the “Last updated” date at the top of this page. Material changes may also be communicated through the Service or by email when appropriate. Continued use after an update means you acknowledge the revised Policy.

AssetorKit is a digital product and online service. For questions about this Privacy Policy or personal data requests, contact us at:

Email: support@assetorkit.com

Signed-in contact form: assetorkit.com/contact

We do not currently publish a registered legal entity name or physical business address on this website.