Privacy Policy

1. Information we collect

Account and authentication

When you sign in, our identity provider may process information such as your email address, name (if provided), and a unique user identifier. We use this to authenticate you and associate your activity with your account.

Team and project data

We store the content you and your collaborators create in the Service, including team and project metadata, tasks (titles, descriptions, points, assignments, status, due dates), comments, documents, meeting notes, activity and audit-style events, and similar workspace data needed to provide features you use.

Technical and usage data

We may collect logs and diagnostic information (for example, IP address, device or browser type, request timestamps, and error reports) to secure the Service, troubleshoot issues, and understand aggregate usage patterns.

2. How we use information

We collect personal information by fair and lawful means, and usually directly from you (or from someone who invites you or administers your account on your behalf). We use and disclose it only where reasonably necessary for our functions and activities in operating the Service, unless a permitted exception under the Privacy Act applies.

• Provide, maintain, and improve the Service.
• Authenticate users and enforce access controls within teams and projects.
• Communicate with you about the Service, security, or policy updates.
• Detect, prevent, and respond to fraud, abuse, or technical issues.
• Comply with legal obligations and enforce our terms.

3. How we share information

We do not sell your personal information. We share information only as described below:

• With your team: Content you add to a team or project is visible to members according to product permissions.
• Service providers: We use trusted vendors (for example, cloud hosting, authentication, and email delivery) who may process personal information on our behalf. Where those providers are overseas, we take steps that are reasonable in the circumstances to ensure overseas recipients do not breach the APPs in relation to that information (APP 8.1), subject to the exceptions in the Privacy Act.
• Legal: We may disclose information if required by Australian law, court order, or a regulator with lawful authority, or to protect the rights, safety, and security of users, the public, or us.
• Business transfers: In connection with a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to confidentiality commitments.

4. Retention

We retain information for as long as your account is active and as needed to provide the Service. We may retain certain records after you delete data or close an account where required for legal, security, or legitimate business purposes (for example, backups for a limited period), after which we delete or anonymize the information where feasible.

5. Security and data breaches

We implement reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, or alteration. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

If we become aware of an eligible data breach under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, we will assess the breach and, where required, notify the Office of the Australian Information Commissioner (OAIC) and affected individuals in accordance with Australian law.

6. Overseas disclosure and storage

We are based in Australia, but some of our service providers may process or store information in other countries (for example, the United States or the European Economic Area). Those locations may have different privacy laws. Where we disclose personal information to an overseas recipient, we take steps that are reasonable in the circumstances to ensure the overseas recipient complies with the APPs, except where the Privacy Act permits us to disclose without such steps (for example, where you consent after we clearly inform you, or where a lawful exception applies).

7. Access, correction, and complaints

Subject to the Privacy Act, you may request access to the personal information we hold about you and request corrections if you believe it is inaccurate, out of date, incomplete, irrelevant, or misleading. Contact us using the email below and we will respond within a reasonable period. If you are not satisfied with our response, you may complain to the OAIC. The OAIC's website is https://www.oaic.gov.au/.

8. Children

The Service is not directed to children under 15 without appropriate parental, guardian, or institutional consent. We do not knowingly collect personal information from children in a way that would require such consent without obtaining it. If you believe we have collected personal information from a child in error, contact us and we will take reasonable steps to delete it.

9. Cookies and similar technologies

We and our authentication partners may use cookies or similar technologies that are essential for sign-in and session security. We do not use third-party advertising cookies on the Service as described in this policy.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date. Where changes are material, we will provide additional notice as appropriate.

11. Contact

KS Engineering Studios (Australia) — privacy questions and data requests: info.ks.engineeringstudios@gmail.com