Privacy policy

CivilCraft software platform · Policy version: 27 October 2026

Who operates the service

CivilCraft QLD Pty Ltd operates the CivilCraft software platform. Contact nick@civilcraft.au about this policy, access or correction of personal information, deletion requests or privacy complaints.

Information accessed and stored

The platform handles account and organisation membership details, project documents and images, folder and source paths, document metadata, classification proposals, approved corrections, review history and security audit records. Documents may contain personal information supplied by your organisation. Only upload or connect information you are authorised to use.

Google Drive data

The optional read-only Drive importer accesses file and folder identifiers, names, metadata, paths and document contents to list and import the project material you select. Copies and source references are stored in the Data Hub. Encrypted authorisation tokens support the approved background connection. Read-only import access does not change or delete the source files in Google Drive.

Where an organisation separately authorises encrypted recovery retention, a different Drive connection can create and access recovery files in the selected backup location. This permission is separate from the original read-only importer. Recovery packages can include project data and documents.

How information is used

Information is used to provide document storage, import, search, classification, filing review, organisation access control, audit history and approved recovery operations. Approved corrections support filing assistance within the organisation. Access to one organisation does not grant access to another organisation's private project information.

AI processing and service providers

For authorised AI processing, relevant document text, selected PDF pages or images, and filing context may be transferred to OpenAI for classification assistance. This can include information originally imported from Google Drive. Processing is subject to the platform's existing approval and spending controls. Vercel supplies application hosting; Supabase supplies database, authentication and file storage services; Google supplies connected Drive services. These providers process information needed to operate the relevant functions, and processing or storage may occur outside Australia.

Google user data is not sold or used for advertising. Google user data must not be used to develop or train general-purpose AI models. CivilCraft's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Access, security and retention

Organisation and project permissions restrict access to private material. Authorisation tokens are encrypted, and audit records support investigation of access and changes. No security measure eliminates every risk.

Imported documents, filing history and approved recovery copies remain stored until removed through an authorised process. Retention also depends on your organisation's recordkeeping needs, applicable obligations and backup arrangements; disconnecting Google does not automatically delete imported copies.

Your choices and requests

You can revoke the Google connection through your Google Account's third-party connections settings. Revocation prevents future use of that grant; it does not remove data already imported. To request access, correction, removal of imported information or deletion of stored connection credentials, email the contact above and identify the organisation and records concerned. We will verify your authority and explain any retention constraint before acting. Do not email passwords, tokens or encryption keys.

Changes and concerns

Privacy concerns can be raised using the contact above. Changes to data practices will be reflected in this policy. A new use of Google data that requires additional consent will be disclosed before that use begins.