Privacy policy

This policy explains how Corella Creations ("we", "us") handles personal information when you use proto-tracker.com and the Proto Tracker application (together, the "Service"). The short version: we collect what we need to run the Service, we protect it, and we don't sell or share it.

Two kinds of data

• Account data: information about you as a user, such as your name, email address and billing details. We are the controller of this data.
• Customer content: the designs, prototypes, notes and history your organisation records in Proto Tracker. Your organisation controls this data and we process it only to provide the Service to you, as a processor, under our data processing agreement.

What we collect

• Account details: email address, optional name, and a password hash (never the password itself).
• Organisation and membership: the organisations you belong to and your role in each.
• Customer content: whatever you and your colleagues enter, together with a history of changes recording who made each change and when.
• Billing: for paid plans, your billing contact, address and tax ID are held by Stripe. We receive the subscription status, plan and currency. We never receive or store card numbers.
• Security logs: IP address, browser user agent and request metadata, kept by our hosting provider for security and troubleshooting.
• Communications: emails you send us.

We do not use advertising, cross-site tracking or third-party analytics in the application or on this website.

How we use it

• To provide the Service: sign-in, organisations, invitations, and storing and displaying your data (contract).
• To send transactional emails such as verification, password reset, invitations and important service notices (contract, legitimate interests).
• To bill paid plans (contract, legal obligation).
• To keep the Service secure and prevent abuse, including rate limiting (legitimate interests).
• To comply with the law.

We will never sell your data, use customer content for advertising, or use customer content to train machine-learning models.

Who we share it with

We share data only with the service providers (sub-processors) needed to run Proto Tracker:

• Amazon Web Services: hosting, database, encryption keys, content delivery and email delivery.
• Stripe: payment processing and subscription billing (billing details only).

The current list is on our security page. We may also disclose information where required by law, or to protect the rights and safety of our users, and in connection with a merger or acquisition, in which case this policy would continue to apply.

Where it's stored and how it's protected

Customer content and account data are stored in Amazon Web Services' Sydney, Australia region, encrypted at rest (AES-256, AWS KMS) and in transit (TLS 1.2+). Stripe may process billing data in the United States and other countries. Where data is transferred internationally we rely on the provider's contractual safeguards, including standard contractual clauses where applicable. See our security page for details.

How long we keep it

• Account data is kept while your account exists. If you delete your account we delete it immediately from the live database.
• Customer content is kept until your organisation deletes it or deletes the organisation.
• Encrypted backups roll off within 35 days.
• Billing records are kept as long as tax law requires (generally 5–7 years).
• If you leave an organisation, the change history it holds continues to show your email address against the changes you made, because that history is the organisation's record. After deleting your account you can ask us to erase your details from those histories; we then replace them with an anonymous label, so the record still shows that one person made those changes, but not who.

Cookies and local storage

The application sets one strictly necessary cookie to keep you signed in. This website sets none. See our cookie policy.

Your rights

Depending on where you live (including under the Australian Privacy Principles, the EU/UK GDPR and US state privacy laws), you can ask to access, correct, delete or export your personal information, and object to or restrict some processing. You can do most of this yourself in the app: edit your name and email address, export your organisation's data, or delete your account. For anything else, email hello@proto-tracker.com. If your request concerns customer content held by an organisation you belong to, we may refer you to that organisation's administrators.

If you're unhappy with how we've handled your information, you can complain to us or to your local data protection authority (in Australia, the Office of the Australian Information Commissioner).

Data breaches

If a breach affects your personal information, we will notify you and the relevant regulators as required by law, including under the Australian Notifiable Data Breaches scheme and the GDPR.

Children

Proto Tracker is a business tool and isn't directed at children under 16. We don't knowingly collect their information.

Changes

We'll post changes here and update the date above. For material changes we'll email account holders at least 30 days in advance.

Contact

Corella Creations: hello@proto-tracker.com