SECONDSITE SITESYNC Privacy Policy
Effective date: September 22, 2026
Last updated: September 22, 2026
1. Introduction
SITESYNC is a business tool that keeps construction issues in sync between Autodesk Forma ("Autodesk") and Revizto. It is provided by SECONDSITE, Inc. ("Second Site", "we", "us"), a Delaware C Corporation, 1100 NE Campus Parkway Suite 200, Seattle, WA, 98195, to organizations and their staff, not to consumers.
This Privacy Policy explains how we process personal information when you use the SITESYNC web application at https://sitesync.secondsite.ai and its API, connect your Autodesk or Revizto account, visit our website at https://secondsite.ai, receive emails from us, or contact us. It covers the information we handle as a business (controller): your account, sign-in sessions, integration connections, support communications, security logs and error reports.
Access to SITESYNC is arranged with the organization that subscribes to it (the "Customer"), usually your employer. The issue, comment and project-team content that SITESYNC reads from and writes to the Customer's Autodesk and Revizto projects ("Customer content") is processed on the Customer's behalf and instructions, with us acting as its service provider (processor). Customer content is governed by our agreement with the Customer, not by this policy, and we do not use it for our own purposes such as analytics, product improvement or model training. Questions about Customer content should go to the Customer.
This policy does not cover Autodesk, Revizto, Google or Microsoft, which process your data under their own privacy policies (see Section 11).
2. What data we collect, and how
We collect only the personal information needed to operate SITESYNC. Depending on how you use it, this includes:
Account data: name, work email address, role in SITESYNC (user or administrator), subscription end date and project limit. Accounts are created by us for the Customer's authorized users; there is no public sign-up.
Sign-in data: you sign in with a Google or Microsoft account or a one-time email link; we do not use passwords. From Google or Microsoft we receive your name, email address, profile picture URL, account identifier and sign-in tokens. For email links we store a single-use code that expires within 15 minutes (60 minutes for email-verification links). Each sign-in creates a session record with a session token, IP address, browser user-agent string and timestamps, and we record the date and method of your last sign-in.
Integration data: when you connect Autodesk (through Autodesk's sign-in page) or Revizto (by entering an access code and choosing your Revizto region), we store the access and refresh tokens the platform issues, your user ID and account email address on that platform, and the names and identifiers of the hub or license and projects you select. Autodesk's profile response may include other fields such as job title and phone number; we discard these immediately. Our background services refresh tokens before they expire; if a token cannot be refreshed, we email you to reconnect.
Project settings: project name, optional dates, automatic-sync setting, last sync time and status, and the status and tag mappings you configure.
Customer content (processed, not stored): during each sync (about every five minutes when automatic sync is on), SITESYNC reads issue and comment data from one platform and writes it to the other: titles, descriptions, statuses, tags, attributes, deadlines, locations, assignees, watchers, comment text and author names, and the project team rosters (names, email addresses and, where provided, company, department and location) used to match the same person on both platforms. This content is processed in memory only. We keep just the identifiers and timestamps each platform assigns to issues and comments, so that we can match them on later syncs, and we never download or store attachments or images. Most people in this content are not SITESYNC users; we do not store their details, use them for any other purpose or contact them.
Technical data: server logs of sync outcomes, token refreshes and access decisions (which may include your user ID and email address, but never tokens or project content); error reports, performance data and session replays collected by Sentry (which can include IP address, request headers and cookies, and user ID or email address where present in an error; replays cover about one in ten sessions and every session with an error, and mask all text and images by default); IP address and request metadata seen by Cloudflare and Amazon CloudFront while routing and protecting traffic; aggregate, cookieless page-view statistics from Cloudflare Web Analytics; short-lived rate-limiting counters; and your IP address and browser information, sent to Google when the Inter font loads from Google Fonts.
Support and request data: your correspondence with support@secondsite.ai, and a record of any privacy request and our response.
Customer contact data: name, work email address, job title and postal address of the Customer's contract, billing or administrative contacts, received when the Customer subscribes.
We collect this information directly from you, from the Customer (when it asks us to set up or manage your account), from Google and Microsoft when you sign in with them, from Autodesk and Revizto when you connect them and during syncs, and automatically from your browser and device and from the service providers that run SITESYNC. We do not buy personal information from data brokers or receive it from advertising partners.
We do not collect payment card details (billing is handled with the Customer outside SITESYNC), precise geolocation, government identifiers, biometric identifiers, health information or other sensitive categories, other than the account credentials described in Section 3. We do not use advertising or marketing trackers, pixels or SDKs.
3. How we use data
We use personal information to:
Provide the Service: create your account, sign you in, connect to Autodesk and Revizto, run the synchronizations the Customer has configured, keep tokens valid, enforce subscription limits, and send the service emails (sign-in links, verification links, reconnection notices) needed to operate SITESYNC.
Secure and maintain the Service: prevent abuse, rate-limit sign-in, diagnose errors, monitor performance, and understand usage in aggregate.
Support you: respond to support enquiries and privacy requests.
Comply with law and protect our rights: meet legal obligations, resolve disputes and enforce our agreements.
The only sensitive personal information we process is account credentials (sign-in and integration tokens). We use them only to authenticate you, operate the integrations you connect and keep the Service secure.
We do not use personal information for advertising, marketing or profiling, and we do not use automated decision-making technology to make decisions with legal or similarly significant effects on you. We do not collect, use, sell or share personal information or Customer content to train large language models or other artificial intelligence or machine learning models, and we do not engage service providers to do so on our behalf. If this changes, we will update this policy first and obtain any consent that applicable law requires.
4. Sharing of personal information
We do not sell personal information or share it for cross-context behavioral or targeted advertising. We disclose it only to:
Service providers (sub-processors): Amazon Web Services (application hosting, content delivery, email delivery and logs), Neon (database), Sentry (error and performance monitoring, including session replay), Cloudflare (DNS, network security and cookieless analytics), and Google and Microsoft (sign-in; Google also delivers the Inter web font). They process personal information only on our instructions and for the purposes in this policy.
Autodesk and Revizto: SITESYNC exchanges data with the accounts you connect, as you direct. They are independent controllers of the data they hold, and disclosures you direct in this way are not sales or sharing.
The Customer: information about your account, such as your email address, sign-in activity and connection status, shared with the Customer's authorized contacts to administer its subscription.
Legal recipients: where required by law, subpoena or court order, or where we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, to investigate fraud, or to respond to a government request.
Business transferees: in a merger, acquisition, financing, reorganization or sale of assets, subject to this policy; we will notify you before your information becomes subject to a different privacy policy.
Professional advisers: lawyers, accountants, insurers and auditors where necessary for them to advise us.
5. Cookies and similar technologies
SITESYNC uses only strictly necessary cookies and browser storage: a secure session cookie that keeps you signed in, short-lived cookies and local storage that protect the Google, Microsoft and Autodesk sign-in and connection flows against tampering, a cookie that remembers your last sign-in method, and local and session storage that cache your profile so the app loads faster and prevent reload loops during updates. We do not use advertising cookies or cross-site tracking. Our only analytics tool, Cloudflare Web Analytics, uses no cookies or browser storage and produces aggregate statistics that do not identify you. You can block or delete cookies in your browser settings, but SITESYNC will not work without the session cookie.
Because we do not sell or share personal information, use it for targeted advertising or track you across other websites, there is no opt-out for a "Do Not Track" or Global Privacy Control signal to express, and SITESYNC does not currently change its behavior in response to them; if our practices change, we will honor opt-out preference signals as required by law and update this policy. We do not permit third parties to collect information about your online activities over time and across different websites through SITESYNC; the providers named in Section 2 receive technical information such as your IP address only to deliver their services to us.
6. Where data is stored
SITESYNC is hosted on Amazon Web Services and Neon in the United States (US East, Northern Virginia). Some sub-processors process data elsewhere: Cloudflare operates a global network, Google and Microsoft process sign-ins in the United States and other countries, and Sentry's data region is the United States. If you use SITESYNC from outside the United States, your information will be transferred to, stored and processed in the United States, where privacy laws may differ from your country's. Your Autodesk and Revizto data stays hosted by those platforms in the regions they, or you, have chosen; the Revizto region you select determines which Revizto data center SITESYNC communicates with.
7. Retention
We keep personal information only as long as needed for the purposes in this policy, based on how long it is needed to operate SITESYNC and support you, our legal and contractual obligations, and the risk of keeping it longer than necessary. In practice:
account data, project settings and issue identifiers are kept while your account and projects exist, integration tokens until you disconnect, and all of these are deleted 30 days after the account is closed or a verified deletion request is received; accounts deactivated by the Customer are kept for the term of its subscription so that access can be restored;
session records, sign-in codes and rate-limiting counters are kept until they expire, plus 30 days for sessions and 24 hours for codes and counters;
server logs are kept for 14 days (30 days for token-refresh services), and error reports, performance data and session replays for 90 days;
database backups are kept for 7 days and then overwritten;
support correspondence is kept for 2 years after the matter is closed, and records of privacy requests for 24 months; and
Customer content is not stored at all; it is processed in memory only for the duration of each sync.
We may keep information longer where the law requires it, to resolve disputes or to enforce our agreements.
8. Security
We protect personal information with administrative, technical and organizational measures appropriate to its sensitivity, including: TLS encryption of all data in transit, including with Autodesk, Revizto, Google and Microsoft; encryption at rest by our hosting providers; storage of application secrets in a managed secrets store rather than in code; passwordless sign-in with rate limiting and short-lived codes; role-based access controls and restriction of production access to authorized personnel; protection of infrastructure and databases against accidental deletion; and automated error and job monitoring. No system is completely secure, and we cannot guarantee absolute security. If we learn of a security incident affecting your personal information, we will notify you and, where relevant, the Customer as required by applicable law. If you believe your account has been compromised, contact us at security@secondsite.ai / support@secondsite.ai.
9. Your rights and choices
Depending on where you live, US state privacy laws may give you the right to know and access the personal information we hold about you and receive a copy of it; correct it; delete it; export it in a portable format; opt out of its sale, sharing, use for targeted advertising or profiling (we do none of these); limit the use of sensitive personal information (which we already use only for permitted purposes); appeal our decisions; and not be discriminated against for exercising these rights.
To exercise your rights, email privacy@secondsite.ai from the email address on your account, and tell us which right you wish to exercise. We will verify your identity, usually by confirming that you control that email address, and respond within 45 days or any shorter period the law requires; where reasonably necessary we may extend once by a further 45 days and will tell you why. An authorized agent may make a request for you if they provide proof of authorization; we may also verify your identity directly. If we decline a request, we will explain why, and you may appeal by replying to our decision; we will respond within 45 days and, if we deny the appeal, tell you how to contact your state Attorney General or the California Privacy Protection Agency.
If your account was arranged by a Customer, we may refer your request to the Customer or ask it to confirm the request, because the Customer controls the subscription. Requests about Customer content should be made to the Customer, Autodesk or Revizto, since we do not store it; if such a request reaches us, we will forward it to the Customer.
You can also disconnect Autodesk or Revizto by contacting support@secondsite.ai (we will remove the stored tokens) or by revoking SITESYNC's access in your Autodesk or Revizto settings; delete a SITESYNC project, which removes its settings and identifiers but nothing on Autodesk or Revizto; and manage cookies as described in Section 5. Service emails cannot be switched off while your account is active. We do not send marketing email.
10. Additional disclosures for US states
The following disclosures are made under the California Consumer Privacy Act ("CCPA") and similar state laws, to the extent they apply to SECONDSITE. In the preceding twelve months we have collected these categories of personal information: identifiers (name, email address, profile picture URL, user IDs, IP address); professional or employment-related information (company name, your role in SITESYNC); commercial information (subscription end date, project limit); internet or other electronic network activity (session records, server logs, error reports, session replays, aggregate page-view statistics); and sensitive personal information (account credentials). We do not draw inferences and do not collect precise geolocation, biometric, health, education or protected-classification information. The sources are those in Section 2, the purposes are those in Section 3, and each category is disclosed for a business purpose only to the service providers in Section 4.
We have not sold or shared personal information in the preceding twelve months and do not do so now; we have no actual knowledge of selling or sharing the personal information of consumers under 16; and we use sensitive personal information only for purposes the CCPA permits. For these reasons we do not provide "Do Not Sell or Share My Personal Information" or "Limit the Use of My Sensitive Personal Information" links. Section 5 describes how we treat opt-out preference signals, and Section 7 our retention periods.
Nevada residents may direct website operators not to sell their covered information. We do not sell covered information as defined by Nevada law, but you may submit a request to privacy@secondsite.ai and we will record it and honor it should our practices ever change.
11. Third-party services you connect
SITESYNC works by connecting to services you already use. Your use of them is governed by their own terms and privacy policies: Autodesk (https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement), Revizto (https://revizto.com/legal/privacy-policy), Google (https://policies.google.com/privacy) and Microsoft (https://privacy.microsoft.com/privacystatement).
12. Children
SITESYNC is not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
13. Changes to this policy
We may update this policy from time to time, and we review it at least annually and whenever our features, service providers or data practices change. If we make material changes, we will notify you by email or by a notice in SITESYNC before they take effect, and obtain your consent where the law requires it. The "Last updated" date at the top shows when the policy was last revised.
14. Contact us
Privacy enquiries and requests: privacy@secondsite.ai
General support: support@secondsite.ai
Post: SECONDSITE, Inc., 1100 NE Campus Parkway Suite 200, Seattle, WA 98195
If you have a disability and need this policy in an alternative format, contact us at privacy@secondsite.ai.