Privacy Policy / privacy-2026-07-27 / Effective 27 July 2026
Privacy Policy
This policy explains what APPVLR handles, why it is handled, where it can be stored, and the choices you have.
1. Who is responsible
APPVLR is operated by [operator name to be published]. ABN: not yet registered. In this policy, “APPVLR”, “we”, and “us” refer to that operator.
Privacy contact: [privacy contact to be published]. Governing location: Victoria, Australia.
2. The short version
- Your uploaded drawings, files, crops, comments, and review decisions remain yours.
- We do not sell personal information or content.
- We do not use personal information or content for advertising or profiling.
- We do not use your content to train or evaluate AI models.
- We process only what is needed to provide the feature you choose, keep the service secure, and meet the law.
3. Information we handle
- Account and profile data
- Your name, email address, password verifier, sign-in provider identifier, role, plan, profile settings, avatar, and session records. We use this to create and protect your account and provide account features.
- Normal review files
- The normal review flow automatically processes drawings and related crops to compare them and produce findings. These files are not added to a server-side review library.
- Team job attachments
- If you choose a team job, its purchase orders, drawings, and related attachments are stored for that team so members can work on the job.
- Local browser state
- Review progress, marks, comments, preferences, and recent local work can remain in your browser until you clear that site data or use an available clear control.
- Approval receipts
- A receipt stores the approving account ID, a drawing fingerprint, the applicable receipt and consent versions, and a timestamp. The drawing fingerprint is not a copy of the drawing.
- Feedback you submit
- Explicit feedback and any attachment you choose to include may be accessible to the operator so we can investigate and respond. Do not attach anything that is not needed to explain the issue.
- Anonymous service counts
- We can keep anonymous aggregate daily counts, such as total reviews or exports. These counts are not tied to a user, email, IP address, device identifier, or drawing. We do not collect content-level or device-level telemetry for analytics.
- Payments and sign-in
- Google receives sign-in information only when you use Google sign-in. Stripe receives billing and payment information only when you use a paid feature. APPVLR does not receive your full card number.
4. How review processing works
Normal review files are sent for automatic comparison and may be processed by operator-controlled OCR and AI services. The purpose is to return the review you asked for. We do not routinely view normal review files.
This is not a promise of cryptographic blindness. The operator controls the service infrastructure and may need technical access to investigate a security incident, restore the service, comply with law, or provide support you request. Any access must be limited to the task and handled confidentially.
5. What we use information for
We use information only to:
- provide drawing comparison, review, approval, team, feedback, save, and account features;
- authenticate users, prevent abuse, investigate errors, and secure the service;
- process payments you request and keep required financial records;
- communicate service, account, security, and material legal updates; and
- comply with legal duties and respond to valid legal requests.
We do not use drawings, crops, comments, approval decisions, team files, or feedback attachments to train or evaluate current or future AI models.
6. Storage and deletion
Normal review flow
Normal review files are automatically processed for the requested review and are not kept as a server-side review library. Generated work kept only in your browser remains there until you clear the browser's APPVLR site data.
Team jobs
Optional team job attachments remain team-scoped while the job is active. After release or rejection, those files become eligible for deletion after 90 days and are removed by the next retention sweep. If the team deletes the job or attachment through an available delete action, that stored copy is removed immediately.
Accounts, receipts, feedback, and financial records
Account and profile data remains while the account is active. Approval receipts are kept as minimal audit records. Feedback is kept while it is needed to investigate, respond, secure the service, or establish what happened. Payment and transaction records may be kept for tax, accounting, fraud prevention, and other legal duties. You can request account deletion using the privacy contact below. We may retain the minimum record required by law or needed to resolve a dispute.
7. Who information can be shared with
Information can be disclosed only to:
- people in a team workspace when you choose to place content in that workspace;
- operator-controlled hosting, OCR, and AI systems used to provide the requested review;
- Google when you choose Google sign-in;
- Stripe when you choose a paid feature;
- professional advisers under confidentiality where reasonably needed; and
- courts, regulators, or law enforcement where disclosure is legally required.
Google and Stripe may process information outside Australia through their global infrastructure. Their own privacy terms apply to their services. We take reasonable steps required by applicable privacy law before allowing an overseas recipient to handle personal information.
8. Saving to your own cloud folder
APPVLR uses the browser's native save and share features. On a supported device, you can choose a folder exposed by your device, including a synced Google Drive or OneDrive folder. On mobile, you can share the PDF to an installed cloud app. The file moves from your browser to the destination you choose, and APPVLR does not receive a second cloud copy through that save action.
Your cloud provider's terms and privacy policy apply after you save or share the file there. APPVLR does not control that provider or its retention settings.
9. Security and data incidents
We use access controls, account authentication, team boundaries, private service connections, and data minimisation to reduce risk. No online service can promise perfect security. If we suspect an eligible data breach, we will assess it and notify affected people and regulators where applicable law requires.
10. Your choices and rights
You may ask for access to or correction of personal information we hold about you. You may also ask us to delete your account data, explain a privacy decision, or investigate a complaint. Contact [privacy contact to be published]. We may need to verify your identity before acting on a request.
We will respond within a reasonable time. If we cannot fulfil a request, we will explain why, subject to the law. You may also complain to the Office of the Australian Information Commissioner if you are not satisfied with our response.
11. Changes to this policy
We may update this policy when the service or law changes. We will publish the new version and effective date. If a change materially affects how we use information, we will provide reasonable notice and ask for a new acknowledgement where appropriate.