Privacy policy
How [LEGAL ENTITY NAME] (ABN [ABN]) collects, holds, uses and discloses personal information through Cauchy, under the Australian Privacy Principles in the Privacy Act 1988 (Cth).
1. What we collect
| What | Details |
|---|---|
| Your account | Your e-mail address and the organisation you belong to. We set up the account when your organisation asks us to invite you. Your password is held by our sign-in provider; the portal sends it straight to them, and it never reaches our servers. |
| Survey files you upload | The files, the lines you choose from them, the coordinate system you pick, and any area of interest you draw or upload. |
| Job records | For each job: the survey and line names, when it was submitted and by which account, the line's length, its state, our review before release, and the results. |
| Records of use | A record of actions on jobs (such as submit, release and delete), naming the account by an internal identifier, not by e-mail address, and the organisation and job. [REVIEWER: confirm whether the production hosting keeps network addresses in its logs] |
| Release e-mails | If your organisation turns them on, we use your e-mail address to tell you that results are ready. The e-mail names the survey and line, and carries no results. |
| Requests for access | If you ask for access through our request page: your name, organisation, work e-mail, country, how you plan to use the service and your message. Your network address is kept only in a scrambled form, to limit repeated requests. |
| Your browser | Your sign-in is kept in your browser tab's session storage and is removed when you close the tab or sign out. The width you choose for the portal's side panel is kept in your browser. We use no advertising or analytics cookies. |
We collect this information from you and from your organisation (when it asks us to invite you).
2. Why we collect it
- To give you access, run the jobs your organisation submits, review and release the results, and support you.
- To bill your organisation and keep the financial records the law requires.
- To keep the service secure, keep each organisation's data apart, and find and fix faults.
We do not sell personal information and do not use it for advertising. [LAWYER: direct marketing, if any, and opt-out]
3. Where it is held
- The service runs in one region: Sydney, Australia. The database, sign-in accounts, uploaded files, job files and our backups are held there.
4. How long we keep it
| What | How long |
|---|---|
| Uploaded files | Deleted two hours after the last change to the upload. |
| A selection of lines being checked | Deleted two hours after it was last used. |
| A job's input line, results and record | Deleted 7 days after the results are released to you. A job that could not be processed is deleted 7 days after it stopped. A job still waiting, being processed or being reviewed is kept until it is released or deleted. |
| Your area of interest | One per account, kept until you replace or clear it, or your organisation's account closes. |
| Backups | Job records and job files are copied to backups in the same region. A backup copy is kept for at most about four weeks. When a job is deleted on request, its files leave the backups within about an hour; its record leaves them when the last backup holding it expires. |
| Your account | Kept while your organisation uses the service. When your organisation's account closes, your sign-in is disabled; ask us if you want it deleted as well. |
| Records of use | Kept to protect the service and your organisation; they cannot be changed once written. [LAWYER: period] |
| Requests for access | Until we delete them. [LAWYER: period] |
5. Who processes it for us
| Provider | What for | What it receives |
|---|---|---|
| Supabase | Sign-in and our database (Sydney) | Your account and e-mail address; the job and line-selection records in the database |
| [HOSTING PROVIDER] | Running the service and storing files (Sydney) | Everything the service holds, as described above |
| [E-MAIL PROVIDER] | Sending release e-mails, if your organisation turns them on | Your e-mail address and the e-mail's text |
| cdnjs (Cloudflare) and OpenStreetMap | The portal's map: your browser loads the map software and background map from them | Your network address and the map area shown; none of your survey data |
6. Overseas disclosure
Your survey data and job records are held in Sydney. Some of the providers above are based outside Australia and may access or hold information overseas:
- Supabase is based in the United States; its staff may access our project to support it. [LAWYER: confirm from Supabase's data processing agreement]
- The map providers' servers may be outside Australia.
7. Access, correction and deletion
- To see the personal information we hold about you, to correct it, or to have it deleted, write to [SUPPORT ADDRESS]. We will check that the request comes from you or your organisation, and reply within 30 days.
- You can see your e-mail address, your organisation and its usage on the Account page, and send yourself a password reset link from there. To change your e-mail address, write to us.
- Your organisation can have any job deleted at any time, before or after release, by asking us. Deletion removes the job's files and record from the live service and cannot be undone.
- When your organisation's account closes, we delete its jobs and disable its sign-ins, and its uploaded files are deleted within two hours. Its name and records of use are kept.
8. Security
- Every request for data needs a signed-in account, and is limited to that account's organisation. Asking for another organisation's upload or job gets the same answer as asking for one that does not exist.
- Where the law requires a data breach to be notified, we will tell you and the Office of the Australian Information Commissioner. [LAWYER: confirm]
9. Questions and complaints
Write to [SUPPORT ADDRESS]. We will reply within 30 days. If you are not satisfied with our reply, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
10. Changes to this policy
We will publish any change on this page with its date, and tell your organisation by e-mail before a change that affects how we use its information.