04Privacy notice
Kairoi Co. OÜ is the controller for the processing described here. This notice covers daylighting.kairoico.com and the Daylighting service behind it.
Last updated: 28 September 2026
Your model never leaves your computer. It is read where it sits, and only what is extracted from it is sent to us. We hold no name, address or contact detail for any person a report assesses, because the service has no field for one and never asks. What we hold about you is an email address to sign in with, an invoice record, and the ledger that proves what you issued — fingerprints and dates, never content.
We would rather print the list than describe it. For each job we receive what is extracted from your model — the building's geometry, with every record that identifies a person removed — and the few details that identify the job: its name, the site address, and which side you act for. That is all of it.
We do not round a site position. The sun path is the calculation, so a coarsened coordinate is a worse answer wearing the costume of a privacy measure. A planning application is in any case a public document and the address is already on the council's register. What is confidential is the scheme — the geometry — and the geometry is the part we protect.
We never receive your IFC, your scene file or your drawings. The extraction runs on your machine; only the measurements travel.
This is the part of the design we would most like you to check for yourself. The model is read where it already sits — on your own hardware, by software running there — and what crosses to us is the short list in §1: a footprint, some heights, and a window position for each opening assessed. Your file is never uploaded, so it is never stored by us, never queued, never backed up, and never deleted by us either, because we never had it.
The practical consequence is worth spelling out: a model under an NDA, a scheme not yet public, or a client who forbids cloud upload are all compatible with using this service, because the confidential object never moves.
On our side, the engine that receives those measurements is stateless: every run starts empty and ends empty, and nothing from one run survives into the next. We do not ask you to trust that we delete your data — by design, there is nowhere for it to stay.
IFC files routinely carry personal data without their author noticing: IfcPerson, IfcOrganization and IfcOwnerHistory commonly hold the name, employer and email address of whoever last saved the file, and a model that has passed through several consultants can carry several of them.
Because the file is never uploaded, none of it reaches us. The extraction takes geometry — footprints, heights, window positions and orientations — and those fields are not geometry, so they are not in what travels. This is not a promise to discard something we received; it is an explanation of why we never received it.
A daylight assessment concerns the amenity of neighbouring homes, and that makes the neighbours the most sensitive people in this whole business. So it matters that the report addresses a window on a facade — identified by position and orientation — and never an occupant.
We hold no names, no addresses, no correspondence and no photographs of any neighbour, objector, applicant or client of yours. Not held briefly; not held at all. Where a report uses a photograph of a facade, the photograph is read to take the window measurements and is not stored (see §10). If a neighbour made a subject access request to us, the honest and complete answer would be that we have nothing about them to give, and that answer would take one line.
Contact, fee, deadline, case number and your own notes are typed into the application on your machine and stay there. The only job details that travel are the ones in §1 that identify the job; nothing else about your client can reach us.
That is the list. There is no profile, no behavioural record, no telephone number and no password reminder, and we neither buy personal data nor sell it.
Like any service on the open internet, ours records that a request happened. For each call a line is written holding the time, the network address it came from, which endpoint was called, the status, and how long it took. It does not contain your model, your measurements, or anything read out of them.
We use those lines to run the service: to apply rate limits, to size capacity, and to investigate faults and abuse. The lawful basis is our legitimate interest in operating and defending the service. They are not sold, rented or shared for advertising.
Your reports, revisions, overrides, delivery record and library live on your own computer. The application contacts us only when you run a job, and what it sends then is the list in §1 — nothing else. The answer comes back the same way, and the report is put together on your computer from it. We hold nothing, so we can recover nothing — if a report or the file that made it is lost, it is gone, and not from a backup we could restore. Keeping your files and backing them up is your responsibility (see terms §9).
To place your scheme among its neighbours, the engine fetches public data for the site's location: survey heights, mapped building outlines, and street-level photographs of the facades around it. We ask those sources for a location and nothing more — they never receive your model, your measurements, your client or anything about you. Photographs are read to take the window measurements, credited to the provider that published them, and are not stored.
Everything that travels between your computer and our engine goes over standard HTTPS, and on top of that it is split into three encrypted pieces, each travelling its own way. One piece, or any two together, means nothing; the three make sense only where they are meant to meet. A break in one layer is not a break in the other.
Every report, revision, verification and delivery is recorded as an entry on a ledger, each entry sealed to the one before it, so that nothing can be rewritten and you can prove what you issued, when, and from which inputs. An entry holds what happened, when, which edition of the report it is and which edition it replaces, and a fingerprint — a hash — of the file that made it. A fingerprint cannot be turned back into the document. The ledger holds no report content, no model, and no name of a client or neighbour.
This site sets one cookie, and only for sign-in: it keeps you signed in, and it is used for nothing else. There is no tracking pixel, no advertising network and no profiling of any kind.
The typefaces on these pages (IBM Plex, under the SIL Open Font License) are served from our own server. Reading these pages makes no request to anyone other than us.
Data is shared only with the providers that run the service, each acting on our instructions alone under a data processing agreement: our hosting provider; a content delivery and security network that sits in front of the service and sees the network address of requests passing through it. We do not sell data. We disclose it where the law requires — to a tax authority or a court, for example.
Everything we hold — the job details, your sign-in address, your invoices, the ledger and the request log — is held inside the European Economic Area. We make no transfer to a third country.
| What | How long |
|---|---|
| Your model file | Never received, so never held |
| A job: what is extracted from your model, and the details that identify it | Until you delete the job — deleting needs you signed in |
| Reports and their revisions | Not held by us at all — they are on your computer |
| Photographs of facades | Read for the measurements, not stored |
| Ledger entries | Kept so your record stays provable: fingerprints, dates and editions only, never content |
| Sign-in email address | For as long as you hold an account |
| Request log | As long as needed to run and defend the service |
| Enquiries that do not become work | 12 months |
| Accounting records, including invoices | 7 years, as Estonian law requires |
We protect what we hold with encryption in transit, access control, and by collecting as little as the job needs in the first place.
Estonian accounting law requires source documents to be kept for seven years from the end of the financial year, and an invoice is a source document. If you ask us to erase everything we will erase everything except that record, and we will tell you plainly that this is what we did and why. It is a legal obligation rather than a preference of ours, and it is the only exception on this page.
Under the GDPR you may ask for access to personal data we hold about you and for its correction or erasure, object to processing based on legitimate interest, ask us to restrict processing, and ask for a copy in a portable form. In practice we hold very little: your sign-in address, your invoices, your ledger entries, and some log lines.
To exercise your rights: privacy@kairoico.com. We answer within one month. You may also complain to a supervisory authority — in Estonia, where we are established, the Data Protection Inspectorate (Andmekaitse Inspektsioon); in the United Kingdom, the Information Commissioner's Office.
No, and this is usually the question your own legal team asks first. We receive no personal data from you: not your client's, not your contacts', not the neighbours'. There is therefore nothing for us to process on your behalf and no data processing agreement to negotiate. You remain the controller of your own project records, which never leave your machine.
If this notice changes, the date at the top changes with it. When a new capability begins holding something we do not hold today, this page is updated before it goes live, not after.
Kairoi Co. OÜ — Registry code 17410529 — Sakala tn 7-2, Kesklinna linnaosa, Tallinn, Harju maakond, 10141, Estonia
General: enterprise@kairoico.com · Privacy: privacy@kairoico.com
This page states what we do in plain language. It is not legal advice.