Skip to content
ASdrawn
Sign up

Legal

Privacy Policy

Version 2026-10-02 · Last updated 2 October 2026

ASdrawn is operated by Xponential Automation (ABN 65 645 338 608) (“we”, “us”), based in Victoria, Australia. This policy explains what we collect when you use ASdrawn, why we collect it, and the choices you have. We handle personal information in accordance with the Australian Privacy Act 1988 and the Australian Privacy Principles.

This policy and our Terms of Service go together. You accept them by ticking the box at checkout or when you join a team (existing members accept a new version the next time they open the app), and we keep a record of which version you accepted and when.

Your drawings

Engineering drawings are usually the most sensitive thing our customers own, so this section comes first.

  • We do not store your drawings. The drawing PDF stays on your device (in your browser’s storage), and analysis is coordinated from your browser. Running an analysis sends us the file name, the page count, any redaction areas you drew and a fingerprint (content hash) of the file, never the PDF itself. The one exception is a drawing you choose to attach to a support ticket (below).
  • Server processing is transient. During analysis, images of your drawing’s pages (full-page images, and cropped regions of them) are sent over an encrypted connection to our inference service and on to Google Cloud. Drawing page images are read by Google's Gemini Enterprise Agent Platform, and the text on them is recognised by Google Document AI. The images are processed in memory to produce results and are never written to our storage. Google does not use data sent through the service to train its models.
  • What we do store are the outputs of analysis: the extracted characteristics, dimensions, tolerances, review workbook data, and analysis telemetry. To show and re-check results without your drawing, we also store the drawing’s file name (often its part number), the text recognised on each page with its position (which includes title-block text such as names), and cached detection results. These describe what was found on the drawing; they are not the drawing itself.
  • Support access is opt-in. If you raise a support issue and explicitly authorise it, you may share a drawing with us for investigation. A drawing or screenshot you attach to a support ticket is deleted 7 days after the ticket is resolved, and is never kept more than 30 days after upload, whatever the ticket's status. The ticket’s text stays in your support history. Our own team’s test drawings are stored for engineering and debugging; customer drawings are not.
  • Other devices and teammates. The drawing file itself stays on your network (the AI reads images of its pages, as described above). When you open a drawing that isn't on the device in front of you, ASdrawn gets it from your organisation's own drawing server if you run one, or directly from another of your team's devices that has it, with ASdrawn open, on the same local network. That transfer is a direct, encrypted connection between the two devices with no relay or outside server; the file is checked against the run's fingerprint before it is used, and it never passes through ASdrawn or any third party. Only members who can open the run can receive it, and anyone can turn sharing off for their device in Settings.

Your manuals (Knowledge)

Unlike a drawing, a manual you add to Knowledge is stored, so that every answer can open the page it quotes.

  • What we store in your workspace: the manual PDF, images of its pages, the text and passages extracted from it, the search vectors made from those passages, and the questions asked and answers given. If you photograph a control screen, we store the alarm codes you confirm, not the photograph.
  • Where: in your account database, hosted in the United States (the same place as your analysis results). Manuals are read by Google’s Gemini Enterprise Agent Platform, and their text and layout by Google Document AI.
  • Staging: while a manual’s layout is parsed, a copy is staged with Google Cloud in the United States. We delete it when the parse finishes, and a lifecycle rule removes anything left behind, so a staged copy is kept for at most 7 days.
  • Deleting: deleting a manual removes the PDF, its page images, text and search vectors. The questions and answers stay in your workspace’s history; email us to have them deleted.
  • Your rights to the manual: by uploading a manual you confirm you have the right to do so, for example under your licence from the machine builder (Terms, clause 2).

What not to upload

Do not upload controlled technical data. That covers:

  • anything subject to the US International Traffic in Arms Regulations (ITAR)
  • anything controlled under the US Export Administration Regulations (EAR) other than EAR99
  • anything on Australia's Defence and Strategic Goods List (DSGL)
  • Controlled Unclassified Information (CUI)
  • drawings whose distribution statement limits them to government or defence recipients

ASdrawn is not built or certified for controlled data. It has no FedRAMP authorisation or CMMC certification, it is not registered under ITAR, and its staff are not limited to US persons. The app asks you to confirm this on every upload path: drawings, manuals, control-screen photos and support attachments. If you are not sure whether a file is controlled, do not upload it. We cannot accept controlled files under any arrangement.

Where your data is processed

Your data is stored in the United States and processed in Australia and the United States; under the default Global AI setting, Google may process a request in any of its regions. Your account, your analysis results and your manuals are what we store. We record where each analysis run was processed. By using ASdrawn you consent to your information being processed and stored outside Australia; we choose providers with strong security practices and contractual safeguards.

Information we collect

  • Account information — your name, email address, and organisation, managed through our sign-in provider.
  • Billing information — subscriptions and payments are processed by our payment provider. We never see or store your full card details; we keep records of your plan, invoices, and credit usage.
  • Analysis and usage data — analysis results, processing status and telemetry, feature usage, and the metadata needed to bill accurately and investigate failures.
  • Records of what you agreed to — each confirmation you give that an upload is not controlled data, and which version of the terms and this policy you accepted and when.
  • Technical logs — standard request logs (IP address, user agent, timestamps, error details) used for security and reliability. Logs never contain your drawing content.
  • Site and app analytics — this website and the public pages of the app (such as sign-in) use our host’s cookieless analytics and performance metrics, which record aggregated page-view and performance metrics (page visited, referrer, coarse device and browser information). They do not identify you or follow you across sites, and they are switched off on the app’s signed-in pages (dashboard, editor, settings, billing, and support).
  • Campaign attribution — if you arrive at this website through a link that carries campaign tags or an ad platform’s click identifier (for example one of our advertisements), this browser keeps those tags (source, medium, campaign name, term and content, and the click identifier from Google, Meta or LinkedIn) and the page you landed on, in the browser’s own storage rather than a cookie. They are used for up to 30 days and cleared on your first visit after that. If you then go to checkout, they are recorded with your checkout session and subscription at our payment provider so we can tell which campaign brought you. We do not send anything back to the ad platforms.

How we use it

  • To provide the service: run analyses, keep inspection records and produce FAIR and FAI workbooks, answer questions from your manuals, and sync your work.
  • To operate billing, prevent abuse, and secure accounts.
  • To diagnose failures and improve reliability.
  • To keep a record of what you agreed to.
  • To contact you about your account or material changes to the service.

We do not sell personal information, and we do not use your drawings, manuals, or analysis results to train AI models.

Who receives it

We share personal information only with the service providers that run ASdrawn for us, each bound by its own data protection terms: application hosting and our database, sign-in, payment processing, DNS and network security for this website, and Google Cloud, which reads drawings and manuals as described above. The full list of our service providers is available on request from support@asdrawn.com.

Retention and deletion

  • Analysis results and their records are kept until you delete them. Deleting an analysis moves it to the trash. It is permanently deleted 30 days later, or straight away if you choose Delete permanently; permanent deletion runs as a background job and removes the analysis and its results from our live systems. The page text and cached detection results for a drawing are deleted with the last analysis of that drawing in your workspace; cached detection results also expire after 90 days unused.
  • Drawings stored in your browser are under your control and can be cleared from the dashboard or your browser settings at any time.
  • Manuals are kept until you delete them (see “Your manuals” above).
  • A drawing or screenshot you attach to a support ticket is deleted 7 days after the ticket is resolved, and is never kept more than 30 days after upload, whatever the ticket's status.
  • Account and billing records are kept as long as your account is active, plus any period required by tax and accounting law.
  • Records of your upload confirmations and of the terms and policy versions you accepted are kept after the analyses and account they relate to are deleted, as evidence of what was agreed.
  • We keep encrypted backups of our database for disaster recovery for up to 40 days. Deleted data stays in backups until they expire; backups are used only to restore the service, never to recover data you have deleted.

Cookies

The app uses essential cookies only — session and authentication. Site and app analytics are cookieless (see above). We do not run advertising trackers; campaign attribution (see above) uses this browser’s own storage, not a cookie.

Security

All traffic is encrypted in transit (TLS). Access to production systems is restricted and credentialed, secrets are managed outside source code, and administrative access to customer data is limited to what support requires. If a data breach affects you, we will notify you without undue delay, and under the Notifiable Data Breaches scheme where it applies.

Your rights

You may request access to, correction of, or deletion of your personal information by emailing support@asdrawn.com. If you believe we have mishandled your information, contact us first; you may also complain to the Office of the Australian Information Commissioner (OAIC).

Changes

If this policy changes materially, we will publish a new version and update the version line above. Questions? support@asdrawn.com.