Privacy policy

This policy explains how Corella Creations (ABN 66 361 275 501) ("we", "us") handles personal information when you use proto-tracker.com and the Proto Tracker application (together, the "Service"). The short version: we collect what we need to run the Service, we protect it, and we don't sell or share it.

Two kinds of data

• Account data: information about you as a user, such as your name, email address, and billing details. We are the controller of this data.
• Customer content: the designs, prototypes, notes, and history your organisation records in Proto Tracker. Your organisation controls this data and we process it only to provide the Service to you, as a processor, under our data processing agreement.

What we collect

• Account details: email address, optional name, and a password hash (never the password itself).
• Organisation and membership: the organisations you belong to and your role in each.
• Customer content: whatever you and your colleagues enter, together with a history of changes recording who made each change and when.
• Billing: for paid plans, your billing contact, address, and tax ID are held by Stripe. We receive the subscription status, plan, and currency. We never receive or store card numbers.
• Security logs: IP address, browser user agent, and request metadata, kept by our hosting provider for security and troubleshooting.
• Communications: emails you send us.

We do not use advertising, cross-site tracking, or third-party analytics in the application or on this website.

How we use it

• To provide the Service: sign-in, organisations, invitations, and storing and displaying your data (contract).
• To send transactional emails such as verification, password reset, invitations, and important service notices (contract, legitimate interests).
• To bill paid plans (contract, legal obligation).
• To keep the Service secure and prevent abuse, including rate limiting (legitimate interests).
• To comply with the law.

We will never sell your data, use customer content for advertising, or use customer content to train machine-learning models.

Who we share it with

We share data only with the service providers (sub-processors) needed to run Proto Tracker:

• Amazon Web Services: hosting, database, encryption keys, content delivery, and email delivery.
• Stripe: payment processing and subscription billing (billing details only).

When you choose a password, we check it against passwords exposed in known data breaches using Have I Been Pwned's free Pwned Passwords service. We send only the first five characters of a one-way hash of the password, which can't reveal the password or identify you, and the request comes from our servers, not your browser. Nothing else about you is sent.

The current list of service providers is on our security page. We may also disclose information where required by law, or to protect the rights and safety of our users, and in connection with a merger or acquisition, in which case this policy would continue to apply.

Where it's stored and how it's protected

Customer content and account data are stored in Amazon Web Services' Sydney, Australia region, encrypted at rest (AES-256, AWS KMS) and in transit (TLS 1.2+). Stripe may process billing data in the United States and other countries. Where data is transferred internationally we rely on the provider's contractual safeguards, including standard contractual clauses where applicable. See our security page for details.

How long we keep it

• Account data is kept while your account exists. If you delete your account we delete it immediately from the live database.
• Customer content is kept until your organisation deletes it or deletes the organisation.
• Encrypted backups roll off within 35 days.
• Billing records are kept as long as tax law requires (generally 5–7 years).
• If you leave an organisation, the change history it holds continues to show your email address against the changes you made, because that history is the organisation's record. After deleting your account you can ask us to erase your details from those histories; we then replace them with an anonymous label, so the record still shows that one person made those changes, but not who.

Cookies and local storage

The application sets one strictly necessary cookie to keep you signed in. This website sets none. See our cookie policy.

Your rights

Depending on where you live (including under the Australian Privacy Principles, the EU/UK GDPR, and US state privacy laws), you can ask to access, correct, delete, or export your personal information, and object to or restrict some processing. You can do most of this yourself in the app: edit your name and email address, export your organisation's data, or delete your account. For anything else, email hello@proto-tracker.com. If your request concerns customer content held by an organisation you belong to, we may refer you to that organisation's administrators.

If you're unhappy with how we've handled your information, you can complain to us or to your local data protection authority (in Australia, the Office of the Australian Information Commissioner).

Data breaches

If a breach affects your personal information, we will notify you and the relevant regulators as required by law, including under the Australian Notifiable Data Breaches scheme and the GDPR.

Children

Proto Tracker is a business tool and isn't directed at children under 16. We don't knowingly collect their information.

Changes

We'll post changes here and update the date above. For material changes we'll email account holders at least 30 days in advance.

Contact

Corella Creations: hello@proto-tracker.com