Privacy Policy

This Privacy Policy describes how Integraph Pty Ltd ("we", "us", "our") collects, uses, and protects your personal information when you use the Integraph platform and all its products, including Coriolis.

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, and organisation details. If you sign in via a third-party provider (Google, Microsoft), we receive basic profile information from that provider.

Usage Data

We collect information about how you use the Service, including pages visited, features used, and actions taken. This helps us improve the product and understand user needs.

Technical Data

We automatically collect technical information such as IP address, browser type, operating system, and device information, to operate and secure the Service and to diagnose faults. We do not use it for advertising, and we do not track you across other websites.

Diagnostic Data

When an error occurs in the application, our error-monitoring provider records the fault together with a short replay of the interface in the moments leading up to it, so that we can reproduce and fix it. Your browser masks all text and all form inputs, and excludes images and other media, before the recording is sent. Sessions in which no error occurs are not recorded. Request headers, cookies and request bodies are stripped from error reports.

Device and Licence-Compliance Data

Licences to use the Service are granted to a single named individual and must not be shared (Terms of Service, clause 5). To enforce that, and to protect accounts against unauthorised use, we may collect and associate with your account identifiers for the devices you use the Service from — including device and installation identifiers, hardware and network interface identifiers such as MAC addresses, browser and operating-system characteristics, IP address and approximate location — together with session, concurrency and usage patterns.

We use this information to determine whether an account or licence is being used by more than one individual, to apply any device or concurrent-session limits that form part of your subscription, and to investigate suspected unauthorised access. We do not use it to track your activity outside the Service, and we do not sell or disclose it for advertising.

Engineering Data

Cross-section geometries, material properties, analysis parameters, and design results that you create within the Service are stored to enable persistence and collaboration features.

2. How We Use Your Information

• To provide and maintain the Service
• To authenticate your identity and manage your account
• To process payments and manage subscriptions
• To send important service notifications
• To improve our products and develop new features
• To provide customer support
• To detect and prevent fraud or abuse
• To verify compliance with the named-user licence terms, detect account or licence sharing, and apply any device or concurrent-session limits
• To comply with legal obligations

3. Data Storage & Security

Your data is stored on Amazon Web Services (AWS) infrastructure in the ap-southeast-2 (Sydney) region. All data is encrypted at rest using AES-256 encryption and in transit using TLS 1.2 or later.

We implement industry-standard security measures including access controls, regular security audits, and monitoring for unauthorised access.

4. Third-Party Services

These are all of the third parties that process your data. We do not use analytics, advertising, marketing-automation or session-tracking services of any kind.

• Amazon Web Services (AWS) — Cloud infrastructure and hosting, in the ap-southeast-2 (Sydney) region
• AWS Cognito — Authentication and user management
• AWS Simple Email Service — Delivery of account, billing and service emails
• Stripe — Payment processing (PCI DSS Level 1). Stripe sets its own cookies, on our payment screens only, to detect fraud — see section 5
• Sentry — Error monitoring and diagnostics, hosted in Sentry's European Union region, so error and diagnostic data from EU users is not transferred outside the EEA
• Google Fonts — Typefaces for the application interface, served from Google's content delivery network, which receives your IP address when the application loads. The public website at www.integraph.com.au serves its fonts from our own servers and makes no such request
• Google or Microsoft — Only if you choose to sign in with one of them, and only for that sign-in

5. Cookies & Similar Technologies

We do not show a cookie consent banner, because we do not set anything that requires your consent. We use no analytics cookies, no advertising cookies and no cross-site tracking of any kind. Everything described below is either required to deliver the Service you have asked for, or a preference you set yourself — the two categories the ePrivacy rules exempt from consent. If this ever changes, we will ask you first.

Essential cookies

• __sa_session — keeps you signed in. Deleted when you sign out
• __sa_pkce — short-lived; secures the sign-in exchange against interception
• __sa_last_auth_method — remembers which sign-in method you used last, so the sign-in screen can offer it first
• __stripe_mid, __stripe_sid — set by Stripe for fraud prevention, on our payment screens only. They are not set if you never open a payment screen

Information stored in your browser

The application and the website also keep a small amount of information in your browser's local storage: your light or dark theme choice, which organisation you last worked in, whether sketch inference is switched on, which panels you have collapsed, notices you have dismissed, and a temporary copy of a legal acceptance in progress. This stays on your device, is not an identifier, and is not transmitted to us.

Your controls

Your browser's settings let you view, block and delete cookies and local storage for this site. Because the items above are the ones the Service needs to function, blocking them will prevent you from signing in or completing a payment. There is nothing optional to turn off, which is why there is no preference centre to offer you.

6. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law. Anonymised, aggregated data may be retained indefinitely for analytical purposes.

7. Your Rights

For EU Residents (GDPR)

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure of your data ("right to be forgotten")
• Restrict processing of your data
• Data portability
• Object to processing

For Australian Residents

Under the Australian Privacy Principles (APPs), you have the right to access and correct your personal information. You may also lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

For US Residents (CCPA)

California residents have the right to know what personal information is collected, request deletion, and opt out of the sale of personal information. We do not sell personal information.

8. Children's Privacy

The Service is not intended for use by children under 16. We do not knowingly collect personal information from children.

9. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses where required by GDPR.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification, and we will ask you to accept the new version. The version identifier at the top of this page identifies the revision you are reading; it is the value recorded against your acceptance.

11. Contact

For privacy-related enquiries or to exercise your rights, contact us at privacy@integraph.com.au.

Integraph Pty Ltd
Sydney, NSW, Australia