Privacy Policy

ASdrawn is operated by Xponential Automation(“we”, “us”), based in Victoria, Australia. This policy explains what we collect when you use ASdrawn, why we collect it, and the choices you have. We handle personal information in accordance with the Australian Privacy Act 1988 and the Australian Privacy Principles.

Your drawings

Engineering drawings are usually the most sensitive thing our customers own, so this section comes first.

• We do not store your drawings. When you upload a drawing, the file is kept locally on your device (in your browser’s storage) and analysis is coordinated from your browser session. Parts of the drawing are sent to our processing services during analysis — see the next point — but are never written to our storage.
• Server processing is transient. During analysis, regions of your drawing are sent to our inference service and our cloud AI provider to be analysed. These services process the image data in memory to produce results and do not write your drawing to durable storage. Our AI provider does not use data submitted through the service to train its models.
• What we do store are the outputs of analysis: the extracted characteristics, dimensions, tolerances, review workbook data, and analysis telemetry. These describe what was found on the drawing; they are not the drawing itself.
• Support access is opt-in. If you raise a support issue and explicitly authorise it, you may share a drawing with us for investigation. Drawings shared this way are retained only for the life of the support ticket. Our own team’s test drawings are stored for engineering and debugging; customer drawings are not.

Where your data is processed

Each component of the service runs in a specific place. Here is the complete picture, component by component:

• Your drawing file— stays in your browser’s storage on your device. Our servers receive only a SHA-256 content hash and metadata, never the file itself.
• Drawing regions in transit — during analysis, regions of the drawing travel from your browser to our inference service, hosted on cloud infrastructure in Australia (Sydney region). They are held transiently in memory, never written to storage, and every hop is encrypted (HTTPS/TLS).
• AI inference — runs on our cloud AI provider at the endpoint your workspace owner selects in settings. The default is Global, which lets the provider route requests to any of its regions; selecting a specific region or jurisdiction pins inference there.
• Text recognition (OCR)— runs on our cloud AI provider and follows your workspace’s endpoint choice: Australian regions are processed in Sydney, European regions in the EU multi-region, and all other choices (including Global) in the US multi-region.
• Extracted results — the dimensions, notes, and requirement text produced by analysis (not images of your drawing) are stored in your account database, hosted in the United States. Result storage is not currently region-selectable.
• App hosting, sign-in, and billing — the application itself is served by Vercel from the United States and a global CDN; authentication (WorkOS) and payment processing (Stripe) are also US-based. None of these receive your drawing content.

Each analysis run records the actual AI inference and OCR locations used, so the processing location of every run is auditable.

Information we collect

• Account information — your name, email address, and organisation, managed through our authentication provider (WorkOS).
• Billing information — subscriptions and payments are processed by Stripe. We never see or store your full card details; we keep records of your plan, invoices, and credit usage.
• Analysis and usage data — analysis results, processing status and telemetry, feature usage, and the metadata needed to bill accurately and investigate failures.
• Technical logs — standard request logs (IP address, user agent, timestamps, error details) used for security and reliability. Logs never contain your drawing content.
• Site analytics — this website uses Vercel Web Analytics, which is cookieless and records aggregated page-view metrics (page visited, referrer, coarse device/browser info). It does not identify you or follow you across sites.

How we use it

• To provide the service: run analyses, produce FAIR workbooks, sync your work.
• To operate billing, prevent abuse, and secure accounts.
• To diagnose failures and improve reliability.
• To contact you about your account or material changes to the service.

We do not sell personal information, and we do not use your drawings or analysis results to train AI models.

Who processes data on our behalf

We rely on a small set of subprocessors, each bound by their own data protection terms:

• Vercel — application hosting and cookieless site analytics.
• Convex — application database (account, analysis, and billing records).
• Cloud AI provider— AI inference and text recognition (OCR), and the cloud infrastructure our inference service runs on. Signed-in customers can see the specific vendor and the full component-by-component detail in the app, under About & infrastructure. See “Where your data is processed” above for locations.
• WorkOS — authentication and sign-in.
• Stripe — payment processing.
• Cloudflare — DNS and network security for this website.

Some of these providers store data outside Australia (primarily in the United States). By using ASdrawn you consent to that transfer; we choose providers with strong security practices and contractual safeguards.

Retention and deletion

• Analysis results and their records are kept until you delete them. Permanently deleting an analysis removes its data from our systems.
• Drawings stored in your browser are under your control and can be cleared from the dashboard or your browser settings at any time.
• Account and billing records are kept as long as your account is active, plus any period required by tax and accounting law.
• We keep encrypted backups of our database for disaster recovery for up to 30 days. Deleted data disappears from live systems immediately and from backups as they expire; backups are used only to restore the service, never to recover data you have deleted.

Cookies

The app uses essential cookies only — session and authentication. Site analytics on this website is cookieless (see above). We do not run advertising trackers.

Security

All traffic is encrypted in transit (TLS). Access to production systems is restricted and credentialed, secrets are managed outside source code, and administrative access to customer data is limited to what support requires.

Your rights

You may request access to, correction of, or deletion of your personal information by emailing admin@xponentialautomation.com. If you believe we have mishandled your information, contact us first; you may also complain to the Office of the Australian Information Commissioner (OAIC).

Changes

If this policy changes materially, we will note it here and update the date above. Questions? admin@xponentialautomation.com.