Privacy Policy

ASdrawn is operated by Xponential Automation (“we”, “us”), based in Victoria, Australia. This policy explains what we collect when you use ASdrawn, why we collect it, and the choices you have. We handle personal information in accordance with the Australian Privacy Act 1988 and the Australian Privacy Principles.

Your drawings

Engineering drawings are usually the most sensitive thing our customers own, so this section comes first.

• We do not store your drawings. When you upload a drawing, the file is kept locally on your device (in your browser’s storage) and analysis is coordinated from your browser session. Rendered images of the drawing’s pages are sent to our processing services during analysis — see the next point — but are never written to our storage.
• Server processing is transient. During analysis, images of your drawing’s pages (each full page for layout detection, then cropped regions for detail) are sent to our inference service and our cloud AI provider to be analysed. These services process the image data in memory to produce results and do not write your drawing to durable storage. Our AI provider does not use data submitted through the service to train its models.
• What we do store are the outputs of analysis: the extracted characteristics, dimensions, tolerances, review workbook data, and analysis telemetry. These describe what was found on the drawing; they are not the drawing itself.
• Support access is opt-in. If you raise a support issue and explicitly authorise it, you may share a drawing with us for investigation. Drawings shared this way are retained only for the life of the support ticket. Our own team’s test drawings are stored for engineering and debugging; customer drawings are not.

Where your data is processed

Each component of the service runs in a specific place. Here is the complete picture, component by component:

• Your drawing file — stays in your browser’s storage on your device. Our servers receive only a SHA-256 content hash and metadata, never the PDF file itself.
• Page images in transit — during analysis, rendered images of the drawing’s pages (full pages first, then cropped regions) travel from your browser to our inference service, hosted on cloud infrastructure in Australia (Sydney region). They are held transiently in memory, never written to storage, and every hop is encrypted (HTTPS/TLS).
• AI inference — runs on our cloud AI provider at the endpoint your workspace owner selects in settings. The default is Global, which lets the provider route requests to any of its regions. Choosing United States keeps storage and processing in the US under the provider’s published data-residency commitment for our current model. Choosing Australia (Sydney) sends requests to the provider’s Sydney endpoint, which serves our current model today but is not covered by a residency commitment for it; if the provider stops serving the model there, runs fail rather than moving elsewhere. We attempt to record the model and location actually used for each run.
• Text recognition (OCR) — runs on our cloud AI provider and follows your workspace’s endpoint choice: Australia (Sydney) is processed in Sydney, and Global and United States are processed in the US multi-region.
• Extracted results — the dimensions, notes, and requirement text produced by analysis (not images of your drawing) are stored in your account database, hosted in the United States. Result storage is not currently region-selectable.
• App hosting, sign-in, and billing — the application itself is served by Vercel from the United States and a global CDN; authentication (WorkOS) and payment processing (Stripe) are also US-based. None of these receive your drawing content.

We attempt to record the actual AI inference and OCR locations used for each analysis run. These records support processing-location audits but may be incomplete if telemetry cannot be saved.

Information we collect

• Account information — your name, email address, and organisation, managed through our authentication provider (WorkOS).
• Billing information — subscriptions and payments are processed by Stripe. We never see or store your full card details; we keep records of your plan, invoices, and credit usage.
• Analysis and usage data — analysis results, processing status and telemetry, feature usage, and the metadata needed to bill accurately and investigate failures.
• Technical logs — standard request logs (IP address, user agent, timestamps, error details) used for security and reliability. Logs never contain your drawing content.
• Site analytics — this website uses Vercel Web Analytics, which is cookieless and records aggregated page-view metrics (page visited, referrer, coarse device/browser info). It does not identify you or follow you across sites.

How we use it

• To provide the service: run analyses, produce FAIR workbooks, sync your work.
• To operate billing, prevent abuse, and secure accounts.
• To diagnose failures and improve reliability.
• To contact you about your account or material changes to the service.

We do not sell personal information, and we do not use your drawings or analysis results to train AI models.

Who processes data on our behalf

We rely on a small set of subprocessors, each bound by their own data protection terms:

• Vercel — application hosting and cookieless site analytics.
• Convex — application database (account, analysis, and billing records).
• Cloud AI provider — AI inference and text recognition (OCR), and the cloud infrastructure our inference service runs on. Signed-in customers can see the specific vendor and the full component-by-component detail in the app, under About & infrastructure. See “Where your data is processed” above for locations.
• WorkOS — authentication and sign-in.
• Stripe — payment processing.
• Cloudflare — DNS and network security for this website.

Some of these providers store data outside Australia (primarily in the United States). By using ASdrawn you consent to that transfer; we choose providers with strong security practices and contractual safeguards.

Retention and deletion

• Analysis results and their records are kept until you delete them. Permanently deleting an analysis removes its data from our systems.
• Drawings stored in your browser are under your control and can be cleared from the dashboard or your browser settings at any time.
• Account and billing records are kept as long as your account is active, plus any period required by tax and accounting law.
• We keep encrypted backups of our database for disaster recovery for up to 30 days. Deleted data disappears from live systems immediately and from backups as they expire; backups are used only to restore the service, never to recover data you have deleted.

Cookies

The app uses essential cookies only — session and authentication. Site analytics on this website is cookieless (see above). We do not run advertising trackers.

Security

All traffic is encrypted in transit (TLS). Access to production systems is restricted and credentialed, secrets are managed outside source code, and administrative access to customer data is limited to what support requires.

Your rights

You may request access to, correction of, or deletion of your personal information by emailing admin@xponentialautomation.com. If you believe we have mishandled your information, contact us first; you may also complain to the Office of the Australian Information Commissioner (OAIC).

Changes

If this policy changes materially, we will note it here and update the date above. Questions? admin@xponentialautomation.com.