Signplanr Privacy Policy

1.1 Account information

When you create an account, we collect your name, email address, and password. Passwords are cryptographically hashed and never stored in plain text. If you sign in through your organisation's single sign-on provider, we receive your name and email address from that provider.

1.2 Organisation data

Information you provide about your organisation, including organisation name, logo, billing contact details, tax identifiers (such as ABN), and member details.

1.3 Billing and payment information

If you subscribe to a paid plan, payment information (such as credit or debit card details) is collected and processed directly by our payment processor, Stripe. We do not store your full card number, CVV, or other sensitive payment credentials on our servers. We receive from Stripe a limited set of billing details, including card type, last four digits, expiry date, billing address, and transaction history, for the purpose of displaying billing information and managing your subscription.

For paid plans with storage overage billing enabled, we periodically calculate your organisation's storage usage and report aggregated overage quantities (in gigabytes) to Stripe for metered billing purposes. No file contents or filenames are shared with Stripe — only the total overage amount.

1.4 Event, sign, survey, and job data

Event details, sign types, sign placements, custom field values, status updates, assignment information, comments, announcements, survey questions and answers, annotated survey photos, job records, and the notification recipients you choose for an event.

1.5 Photos and files

Installation photos uploaded by contractors, map images, PDF site plans, artwork files, and reference documents uploaded by organisers. Photos are uploaded as captured by the device. Photo files may contain embedded metadata (EXIF) such as capture time, device model and — if location tagging is enabled on the camera — the GPS coordinates where the photo was taken. We do not currently remove this metadata, and it is retained with the photo and included when photos are exported.

1.6 Map and location data

Site plan images and PDF files you upload, as well as geographic coordinates (latitude and longitude) for sign placements on geo-maps.

Device location: when you choose to locate yourself on a geo-map, record a survey location, or create a geo-map, the app asks your browser for your device's current position and uses it to centre the map or place a pin. Survey locations are stored with the survey. We do not track your location in the background.

1.7 Device and usage data

When you use the Service, we may automatically collect:

• Device type and operating system
• Browser type and version
• IP address (used for security and rate limiting; anonymised before use in analytics)
• Pages visited, features used, and user interactions

We use PostHog for product analytics to understand how features are used and to improve the Service. PostHog collects usage events (such as page views and feature interactions), and for authenticated users, we associate analytics data with your account role and subscription plan tier to understand usage patterns across different user segments. PostHog may record anonymised session replays (with all text inputs automatically masked) to help us identify usability issues. PostHog does not serve advertisements and is configured to use browser local storage rather than cookies.

We also use Vercel Analytics and Vercel Speed Insights to measure website performance (such as page load times and Core Web Vitals). These tools collect anonymous, aggregated performance metrics and do not track individual users across sessions.

Advertising measurement. Our website and application load a Google Ads tag that sets advertising cookies and reports page views and a sign-up conversion event to Google so we can measure the effectiveness of our advertising. No sign, photo, or organisation data is sent to Google. You can block these cookies in your browser without affecting the Service.

1.8 Transactional email data

When we send you emails (such as account verification, password resets, invitations, or billing notifications), our email delivery provider processes your email address and message content for the purpose of delivering those emails.

1.9 Information from third parties

If you are invited to the platform by another user (via an organisation invitation, event invitation, or access code), we receive your email address from the inviting user for the sole purpose of facilitating the invitation.

1.10 Security and sign-in data

To keep accounts secure, we also hold:

• Trusted devices: if you choose to trust a device after two-factor authentication, we store a hashed token, a device and browser label, and the IP address at the time the device was trusted. Trusted devices expire after 30 days.
• Two-factor authentication: your authenticator secret is held by our authentication provider, and your backup codes are stored hashed.
• Single sign-on connections: for organisations using SSO, the organisation's email domain(s) and identity-provider metadata.
• Failed sign-in counters: short-lived, IP-based counters used for rate limiting and lockout.
• Email suppression records: addresses that have bounced or lodged a complaint, so we stop sending to them.

1.11 Customer users

An organisation may invite its own clients to the Service as customer users. If you are a customer user, we collect your name and email address, and the photos, comments, sign requests, approvals, and rejections you submit. This activity becomes part of the inviting organisation's records and is visible to that organisation. Customer users see only the signs they have been linked to, and customer users on the same event can see each other's names.

3.1 Infrastructure

All structured data (accounts, events, signs, surveys, status history) is stored in a PostgreSQL database managed by Supabase in its Sydney, Australia region (AWS ap-southeast-2). Data is encrypted at rest (AES-256) and in transit (TLS 1.2+).

Photos, maps, and uploaded files are stored in Supabase Storage in the same region, with access controls ensuring only authorised users can view or download files belonging to their organisation.

Application servers run in Vercel's Sydney region; Vercel's global edge network serves static assets and routes requests.

Our infrastructure providers maintain SOC 2 Type II compliance and implement industry-standard security practices.

3.2 Multi-tenant data isolation

Signplanr is a multi-tenant application. All organisations share the same infrastructure, but data is strictly isolated at the database level using row-level security (RLS) policies. Every database query is scoped to the authenticated user's organisation. There is no mechanism for one tenant to query, view, or modify another tenant's data through the application. Milo Enterprises personnel and automated system processes (for example scheduled maintenance jobs and billing webhooks) may access data across organisations where needed to operate, support, or secure the Service. Such access is limited to what the task requires and administrative actions are logged.

3.3 Cross-border data transfers

Your core application data is stored and processed in Australia. Some of the supporting services we rely on — Anthropic, Stripe, Resend, PostHog, Mapbox, Cloudflare, Upstash, and Google — operate in the United States or on global networks, and receive the limited data described in section 6. By using the Service you acknowledge that this information may be transferred to and processed outside Australia. We take reasonable steps to ensure that overseas recipients of personal information comply with the APPs, and our agreements with these providers include data protection obligations consistent with Australian privacy standards.

For users in the European Economic Area (EEA) or United Kingdom: transfers are made under Standard Contractual Clauses or other lawful transfer mechanisms as maintained by our infrastructure providers.

4.1 Active accounts

Your data is retained for as long as your account is active. Archived events and their associated data (signs, photos, maps) remain accessible to you until you choose to delete them.

4.2 Event deletion

When you delete an event, all associated signs, photos, maps, reference documents, and status history are permanently removed after a 30-day retention window. This action cannot be undone after the retention period.

4.3 Organisation deletion

When an organisation is deleted, all associated data (events, signs, photos, maps, sign types, member records) is retained for 30 days before permanent deletion. Audit log records are retained for as long as needed for security and accountability; personal identifiers in them are anonymised when the related account is deleted.

4.4 Account termination

Upon account termination (whether by you or by us), we retain your data for 30 days to allow for data export, after which it is permanently deleted. Audit log records are retained for as long as needed for security and accountability; personal identifiers in them are anonymised when the related account is deleted.

4.5 Invitation records

Contractor and organisation invitation records are retained for audit purposes even after an invitation expires or is revoked.

4.6 Billing records

Transaction and invoice records are retained for the period required by applicable Australian tax law (currently 5 years from the date of the transaction) and by our payment processor's data retention policies.

4.7 Offline device storage

If you download an event for offline use in the mobile app, event data, sign records, map images, artwork, and any photos, comments, status changes, or survey answers you capture while offline are stored in your browser's storage on your device until they sync. This data is removed when you sign out or use Clear offline data, and you are responsible for the security of the device.

4.8 Exports

Exports (CSV, PDF, and photo ZIP files) are generated on request and downloaded to your device. Once downloaded, they are outside our control, and you are responsible for storing and sharing them appropriately.

6.1 Stripe data processing

Stripe acts as a data sub-processor for payment-related personal information. When you subscribe to a paid plan, we share the following with Stripe: your organisation's billing contact name, billing address, tax identifier (e.g. ABN), and email address. Stripe processes payment card details directly — we never receive or store your full card number. Stripe's processing of your data is governed by the Stripe Privacy Policy. We maintain a data processing agreement with Stripe that includes obligations consistent with the Australian Privacy Principles.

6.2 Anthropic data processing (AI plan import)

Anthropic acts as a data sub-processor for our AI plan import feature (available on Business and Enterprise plans). When a member of your organisation runs a plan analysis, the uploaded plan or map image is sent to Anthropic's Claude AI service to detect the sign locations marked on the drawing. Only the map image is shared — no account details or other personal information accompany the request — and Anthropic processes it solely to perform the analysis and return the results to us. Images are sent to Anthropic only when a user explicitly requests an analysis; uploaded maps are never sent automatically. Under Anthropic's commercial terms, content submitted through the service is not used to train Anthropic's models. Anthropic's processing of this data is governed by the Anthropic Privacy Policy.

7.1 Data breaches

If we become aware of a data breach that is likely to result in serious harm to individuals, we will assess it promptly and, where required by the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), notify affected individuals and the Office of the Australian Information Commissioner. Organisation Owners will be told of any breach affecting their organisation's data.

8.1 Additional rights for EEA/UK residents

If you are located in the European Economic Area or United Kingdom, you may also have the right to:

• Request restriction of processing
• Object to processing
• Data portability (receive your data in a structured, machine-readable format)
• Withdraw consent at any time where processing is based on consent