Data processing addendum

Last updated: 25 October 2026

This describes how StructBy AI handles personal information for a customer when an order points at it, and the privacy policy for your country remains the notice to individuals.

Provider: Structbyai Pty Ltd (ABN 98 700 283 254, ACN 700 283 254), trading as StructBy AI, of New South Wales, Australia. We have no establishment in India.

Customer: the engineering firm or the person that holds the StructBy AI account.

1. Roles

Australia. For the drawings, project records and other material the customer uploads or generates in the service, the customer is the APP entity that decides why that material is handled, and StructBy AI processes it to provide the service. For the account itself (sign-in, billing, security logs) StructBy AI decides the handling and is the APP entity. The Australian Privacy Principles under the Privacy Act 1988 (Cth) apply to StructBy AI for the personal information it holds.

India. For personal data in the customer's projects, the customer is the data fiduciary under the Digital Personal Data Protection Act 2023 and StructBy AI is the data processor, handling that data on the customer's instructions. For the account itself, StructBy AI is the data fiduciary. We have no establishment in India. Whether a transfer of personal data out of India is permitted is to be confirmed before launch.

2. Instructions

The customer's instruction is to host the account, store what the customer uploads, run the feature the customer asks for, and send the messages the product sends. We do not sell personal information. We do not use customer drawings to train a model. The AI data-use statement at /legal/ai-data-use is the detail of that sentence.

3. What is processed

Account name, email and country. Projects, documents, questions and files the customer submits. A coordinate the customer asks us to screen. The text, and where a feature reads a page, the page image, sent to the model provider named on the subprocessor list. Payment data, on Stripe's side, if the customer takes a paid plan. Email address, sent through Resend. An error report, sent only when error reporting is switched on.

4. Subprocessors and region

Subprocessors are listed at /legal/subprocessors. Where a provider's region is still open, that row says to be confirmed before launch.

5. Security

The controls that exist today are on the security page at /legal/security. They are not a certification.

6. Retention, deletion and export

A deleted file is removed 30 days after it is deleted. A deleted project is removed 30 days after it is deleted, and only once its files are gone. That date is recorded when the project is deleted. Lowering the setting later does not move it. Documents filed on the project stay with it and are removed with it. They are not copied onto a personal list. A project with a signed check is kept for at least 7 years, and the removal job leaves it in place and records why. A workspace project another current member still uses is not deleted when one person closes their account.

Closing an account waits 14 days, then personal data is erased. Documents, projects that are not still in use by someone else, version snapshots and the audit record are kept, de-identified, for 7 years, and are then deleted. Product events are deleted after 13 months.

From Settings the customer can ask for a copy of their own projects, documents and their versions, design values, files, questions, StructCheck runs, site assessments and their own audit entries. The download link lasts 10 minutes. Page images are not included. This is not every record the service holds. A workspace owner or admin can ask for that workspace's projects, documents and files separately.

7. Individuals

A request to access or correct personal information, or an Indian data principal's request, can be sent to contact@structbyai.com. Where the customer is the decision-maker for the material, we will pass the request to the customer. Complaints about Australian personal information can go to the OAIC. Complaints about Indian personal data can go to the Data Protection Board of India.

8. Breaches

If we become aware of unauthorised access to, or loss of, personal information we hold for the customer, we will tell the customer. We follow the Notifiable Data Breaches scheme and the Digital Personal Data Protection Act 2023 where they require a notice. How soon we acknowledge a report, and any shorter notice time, are to be confirmed before launch.

9. Audit

The customer may ask, once in a contract year, for the description on the security page and for a conversation about the controls behind it. We do not have a SOC 2 report to hand over.

10. Ending

When the account is closed, section 6 applies. Deleting the account is how the customer gives that instruction. The download in section 6 is how the customer takes a copy first. It is not every record the service holds.