Privacy Policy
How Thessova, the developer of Fluah, handles your personal information.
Last updated 6 November 2026 · Effective 6 November 2026
About this policy
Thessova builds and licenses software for Autodesk Revit, and develops and publishes Fluah, a PDF application for Windows. This policy explains what personal information we collect when you visit thessova.com, fluah.com or docs.fluah.com, request a quote, or purchase and use a licence: how we use it, who we share it with, and the control you have over it.
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where you are located in the European Economic Area or the United Kingdom, the section on EEA and UK users also applies to you.
1. Who we are
Thessova is the business responsible for the personal information described in this policy. Thessova is a registered business name of Brendan James Foreman (ABN 22 882 557 564), a sole trader. In this policy, "we", "us" and "our" mean Thessova.
Fluah is software developed and published by Thessova. This policy covers Fluah (the app, its installer and updates, your account on fluah.com, and Collaborate) and the fluah.com and docs.fluah.com websites, in the same way as it covers thessova.com and our Revit software. Fluah's End User Licence Agreement refers you to this policy.
- Email, for Thessova and Fluah: [email protected]
2. What personal information we collect
We only collect information that we reasonably need to sell, deliver and support our software. That includes:
| Category | Examples |
|---|---|
| Identity and contact | Name, company or practice name, job title, email address, phone number, billing and postal address |
| Licence and account | Licence keys issued to you, product and version, seat count, subscription start and renewal dates, account username |
| Transaction | Purchase history, invoices, tax details, currency and amount. We do not collect or store your full card number; card details are entered directly with our payment processor |
| Support | Emails and support tickets you send us, and any log files, screenshots, Revit or PDF files you choose to attach |
| Technical | IP address, browser type, device and operating system, pages viewed and referring URL, collected automatically when you use our website |
| Fluah licence and update checks | A hashed machine identifier (a one-way hash of the computer's name and its Windows machine ID), the Fluah version, IP address, and when each computer was first and last seen on your account; when you accept Fluah's licence agreement, the computer's name and the agreement version |
| Fluah diagnostic logs and crash reports | What Fluah did and the commands you used, including the names and folder paths of files it opened, saved or previewed; crash reports, which are a copy of part of the program's memory and can contain fragments of documents that were open; and, only if you turn on Send slow pages, a copy of each slow page as a one-page PDF. Before a log is sent, Fluah removes your Windows user name and full name, your profile folder's name, email addresses, text you typed, clipboard contents and passwords or other secrets |
| Fluah saved settings | The Fluah settings you choose to save to your account (never settings that belong to one computer, such as trusted certificates, signing defaults and signature appearances) |
| Fluah Collaborate | Only if you turn Collaborate on: the PDFs, pictures and markups of the projects you work in (encrypted on your computer before upload), project members and their roles, and the email addresses of people you invite. Your name and email address are shown to the other members of your projects and to people in your company |
We do not collect sensitive information (as defined in the Privacy Act), such as health, biometric or racial information. Please do not send it to us.
If you don't provide it
Some information is required to issue and support a licence. If you choose not to provide it, we may be unable to sell you a licence, activate your software, or resolve a support request.
3. How we collect it
- Directly from you: when you fill in a form, request a quote, place an order, register a licence, or contact support.
- Automatically: through cookies and server logs when you use our website (see section 7).
- From our software: licence activation transmits the licence key and basic machine and product identifiers to verify entitlement. Fluah also checks your licence about every hour and checks for updates about every 30 minutes while it runs; it sends its diagnostic logs when it closes, about once an hour while it runs, and at its next start after a crash; and it sends settings you save to your account and, if you turn Collaborate on, the projects you share. Clause 5.3 of Fluah's End User Licence Agreement, which Fluah's installer shows you, lists everything Fluah sends.
- From your organisation: where an employer or administrator buys a licence and nominates you as a user.
- From other Fluah users: when someone invites you to a Collaborate project, they give us your email address so that we can send you the invitation.
Your choices in Fluah
You can stop Fluah's diagnostic logs and crash reports at any time by turning off Debug all (Settings, Debug); Fluah then sends neither. Send slow pages and Collaborate are off unless you turn them on. Sign-in and licence checks cannot be turned off, because the licence depends on them.
4. Why we use it
- To supply, activate, renew and enforce your software licence
- To process payments and issue invoices and receipts
- To provide technical support and respond to your enquiries
- To send service communications: release notes, security notices, expiry and renewal reminders
- To improve our products and website, and to detect and prevent fraud or licence misuse
- To find and fix defects and performance problems in our software, using diagnostic logs, crash reports and copies of slow pages
- To run Fluah Collaborate: storing and relaying the projects you share, and sending the invitations you ask us to send
- To meet our legal, tax and accounting obligations
5. Who we disclose it to
We do not sell, rent or trade your personal information, and we do not disclose it to third parties for their own marketing purposes. Ever.
To run the business we use a small number of service providers who process personal information strictly on our instructions, under contract, and only for the purpose we engage them for:
- Payment processing and invoicing
- Website and application hosting: DigitalOcean, with our servers in Sydney, Australia
- Network and security services: Cloudflare, which carries traffic between you or our software and thessova.com, api.thessova.com, fluah.com and docs.fluah.com, and can see it in transit
- Backups of Fluah Collaborate data: Cloudflare R2, stored in the Oceania region
- Email delivery and customer support ticketing
- Accounting and tax compliance
Beyond those providers, we disclose personal information only where we are required or authorised by law (for example in response to a court order, a lawful request from a regulator or law enforcement, or to establish or defend a legal claim), or where you have asked us to.
If our business is sold or restructured, customer records may transfer to the acquiring entity. We will notify affected customers if that happens.
6. Overseas disclosure
Our servers are in Australia, but some of our service providers store or process data outside Australia, including in the United States and the European Union, and Cloudflare carries traffic through its data centres around the world. Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including through contractual data protection terms.
7. Cookies
Our websites set only cookies that are necessary for them to function: keeping you signed in, remembering a device you have already verified, and maintaining security. We do not use analytics cookies, advertising or retargeting pixels, or any third-party tracking. Each website lists every cookie it sets, with its purpose and lifetime, in its own Cookie Policy.
You can block or delete cookies through your browser settings. Blocking necessary cookies may stop parts of the site, including sign in, from working.
8. Direct marketing
If you are a customer or have asked to hear from us, we may email you about product updates, new releases and offers. Every marketing email includes an unsubscribe link, and you can opt out at any time by emailing [email protected]. Opting out of marketing does not stop essential service messages such as licence expiry notices, security advisories or invoices.
9. Security
We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These include encryption in transit (TLS), access controls limiting staff access to what their role requires, and use of reputable hosting and payment providers. Fluah removes personal details from its diagnostic logs before sending them (see section 2). Fluah Collaborate encrypts the PDFs, pictures and markups of a project on your computer, with a key for that project, before uploading them; our server keeps the project keys protected by a master key, so we could technically decrypt a project, and we do not do so unless the law requires us to. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.
10. How long we keep it
We keep personal information only as long as we need it for the purposes described above. Transaction and tax records are retained for at least seven years as required by Australian law. Licence records are retained for the life of the licence plus the period needed to handle renewals and support. Fluah diagnostic logs, crash reports and copies of slow pages are deleted within 90 days of receipt. Fluah Collaborate content is removed from our server as soon as it is deleted, and from our backups within 36 days. Marketing contact details are deleted once you unsubscribe. When information is no longer needed and we are not required to keep it, we destroy or de-identify it.
11. Accessing and correcting your information
You may request access to the personal information we hold about you, and ask us to correct anything inaccurate, out of date or incomplete. Email [email protected]. We will respond within 30 days. We may need to verify your identity first. If we refuse access or correction, we will explain why in writing.
12. EEA and UK users
If you are in the EEA or UK, we process your personal information on the following legal bases: performance of a contract (supplying and supporting your licence), legal obligation (tax and accounting records), and legitimate interests (securing our products, preventing licence misuse, finding and fixing defects with Fluah's diagnostic logs and crash reports, and improving our software). You can object to diagnostic logs at any time by turning off Debug all in Fluah. You have the right to access, rectify, erase, restrict and port your data, and to object to processing based on legitimate interests. To exercise any of these rights, email [email protected]. You also have the right to lodge a complaint with your local supervisory authority.
13. Children
Our software and websites are intended for professional use and are not directed at anyone under 16. We do not knowingly collect personal information from children. If you believe we have, contact us and we will delete it.
14. Complaints
If you believe we have mishandled your personal information, email [email protected] with the details. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:
- Web: oaic.gov.au/privacy/privacy-complaints
- Phone: 1300 363 992
- Email: [email protected]
15. Changes to this policy
We may update this policy as our products or legal obligations change. The current version is always published at thessova.com/legal/privacy and fluah.com/legal/privacy, with the "last updated" date at the top; the copy on fluah.com gives our @fluah.com addresses, which reach the same people. If a change materially affects how we handle your information, we will notify customers by email before it takes effect.
16. Contact us
Privacy questions, access requests and complaints, about Thessova or Fluah:
[email protected]