StructBy AI Privacy Policy (Australia)

Effective date: 4 September 2026 Last updated: 9 October 2026

This Privacy Policy explains how Structbyai Pty Ltd (ABN 98 700 283 254, ACN 700 283 254), trading as StructBy AI (StructBy AI, we, us, our), collects, uses, discloses, stores, and protects personal information when you use the StructBy AI software-as-a-service platform at structbyai.com and related services (the Service).

We handle personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). This Policy forms part of our Terms of Service. This edition applies to users in Australia; users in other countries for which we publish a separate edition are covered by that edition.

---

1. What is personal information

"Personal information" has the meaning given in the Privacy Act: information or an opinion about an identified individual, or about an individual who is reasonably identifiable, whether the information is true or not and whether recorded in a material form or not.

---

2. What we collect

We may also collect technical information automatically, including browser type, language, time zone, referring URL, and pages visited, to operate, secure, and improve the Service.

We record which features you use and the steps you take in them (for example, that you ran a site check or exported a result), never the addresses, drawings or questions themselves, to understand how the product is used and to improve it. When you first arrive we note the campaign tag, the referring website and the type of page you landed on; this is kept in your browser for that visit and saved to your account if you sign up.

You may not deal with us anonymously or under a pseudonym, because the Service records who generated each document and who is responsible for it.

We do not knowingly collect personal information from anyone under the age of 18.

---

3. Why we collect it

We collect personal information to:

(a) provide and operate the Service; (b) authenticate your identity and protect your account; (c) bill for paid plans and process payments; (d) deliver AI-generated outputs you request; (e) maintain the audit trail that records who generated and approved each document, which supports professional accountability and our insurance arrangements; (f) provide customer support; (g) detect, prevent, and respond to fraud, abuse, and security incidents; (h) comply with our legal and regulatory obligations; and (i) communicate service updates, security notices, and (with consent or as permitted by the Spam Act 2003 (Cth)) marketing communications.

We do not sell your personal information, and we do not use your project content to train third-party AI models.

---

4. Collection — APP 3

We collect only information that is reasonably necessary for, or directly related to, one or more of our functions or activities. Sensitive information is not knowingly collected. If you voluntarily upload sensitive information or personal information about a third party as part of project content, you confirm you have the necessary consent or another lawful basis to do so.

---

5. How we store and protect it

5.1 The Service's application server and database are hosted on Railway in Singapore. The website is served by Vercel from the United States with a global content-delivery network. Access is restricted to personnel who require it for their role, under written confidentiality obligations.

5.2 Technical safeguards include:

• TLS for all data in transit;
• encryption at rest provided by our hosting providers;
• authentication through Clerk with server-side verification of every request;
• per-user rate limiting on AI features;
• a content security policy on the website; and
• citation verification against the knowledge base to flag references the AI may have fabricated.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

5.3 We retain personal information for as long as your account is active. If you choose to rate an AI-generated output, we keep the rating, any comment you add, the inputs you supplied for that output, the output itself, and the technical context recorded with it (the AI model and app version used, your country, region and plan tier at the time, and display settings such as units, screen width and language), so we can review and improve the quality of the product; these are deleted with your account. When you run a site assessment we save it — the address, the inputs you gave, the result and when it was run — so you can open it again. You can delete a saved assessment; it is then hidden from you and erased with your account. Your CodeLens questions, answers and threads are saved to your account; you can delete any thread at any time. Deleted threads are hidden immediately and removed with your account. Clauses 5.4 to 5.6 describe exactly what happens when you close it.

5.4 Closing your account. You can close your account from Settings. We do not act on it at once: the account is scheduled for erasure fourteen (14) days later and is blocked in the meantime, and you can cancel at any time in that window. We email you when the request is made.

5.5 What we erase. At the end of that period we erase your name, email address, company details, usage history, CodeLens questions, drawing analyses and saved site assessments, and we remove your user id from the records we keep, including the audit log. Your account row becomes a de-identified record that no longer names you.

5.6 What we keep, and why. Your documents, your projects, the version snapshots taken as each document changed, and their audit record are kept exactly as they were written for seven (7) years from erasure, under that de-identified account, and are then deleted. Nothing inspects or redacts the contents of a document or a project, so anything you entered into one — a person's name, a registration number, a site address, a client's details — is kept as part of it for that period. The reason is the reason in section 6: a document that has been generated, relied on, or issued is evidence of what was produced, including evidence that may protect you. Retained records are restricted to that purpose — they are not used to provide the Service to anyone and are not disclosed except as section 7 allows. If you need the content of a particular document erased rather than kept, email contact@structbyai.com and say so, and we will tell you what we can and cannot do and why.

---

6. The audit log

For every AI-generated document we record an append-only audit log entry that includes:

• the AI model id and version;
• the parameters you supplied;
• the knowledge-base excerpts retrieved;
• the verified and unverified citation lists;
• the user id of the generator; and
• the user id and timestamp of any status transition (including approval as final).

The audit log is retained for at least seven (7) years from the date of the document, or longer where required by law, professional regulation, or an insurance contract, and survives deletion of the document itself. It may be disclosed to a court, tribunal, regulator, professional body, or insurer where lawfully required.

This retention is consistent with the professional indemnity, building-record, and limitation periods that commonly apply to engineering work in Australian jurisdictions, although the exact period varies by state and project type.

---

7. Disclosure to third parties — APP 6 and APP 8

We disclose personal information to the following service providers, each under terms that restrict their use of the information to providing services to us. This table is our current list of sub-processors; we update it before a new provider begins processing personal information.

Address search does not use an outside provider: the address text you type is matched against our own copy of the Geocoded National Address File (G-NAF), held on our application server listed above.

The site map: map tiles loaded by your browser

The SiteIQ site map is drawn from map tiles served by OpenFreeMap (tiles.openfreemap.org), a free public map-tile service rather than a provider we contract with, so the undertaking above does not apply to it; what it does with a request is governed by its own published policy. Your browser requests the tiles directly, so OpenFreeMap receives your IP address and the tiles requested, which show the area around the site you are viewing. We do not send it your name, your email address or your account or project identifier.

Government and open-data services we query with a site's coordinates

Some assessments send the latitude and longitude of the site you are assessing to an outside service, and one of them also sends the state you selected. These are public data services rather than providers we contract with, so the undertaking above does not apply to them; what each one does with a request is governed by its own published policy.

We send only what the lookup needs. We do not send your name, your email address, your account or project identifier, or anything else about you. The request is made by our server rather than by your browser, so your IP address is not disclosed to these services — they see our server's address. Be aware that for a residential project the coordinates you look up may be someone's home.

Requests to Esri's ArcGIS Online may be processed outside Australia.

A SiteIQ site assessment reads its wind region from a copy of Geoscience Australia's published map held on our own server, which is not an outside request. It queries the climate zone map, and the bushfire and flood planning map services for the state you selected, as listed above. Where the site's coordinates fall within the rough area we hold for another state or territory as well, it may query that state's or territory's bushfire map listed above too, to check the answer from the map for the state you selected.

We may also disclose personal information where required or authorised by law, including to a court, tribunal, regulator, professional body, or insurer as described in section 6.

Where we disclose personal information to a recipient outside Australia, we take reasonable steps before the disclosure to ensure the recipient handles the information in a way that is consistent with the APPs, including by contractual terms. The countries in which those recipients are located are listed in the table above.

---

8. Marketing and direct contact — Spam Act 2003 (Cth)

We will only send you commercial electronic messages with your consent (express, or inferred from an existing customer relationship) and always with a functional unsubscribe facility. You can unsubscribe at any time using that facility or by emailing contact@structbyai.com.

Transactional notices (security, billing, service updates) are not commercial electronic messages and will continue regardless of marketing preferences.

---

9. Cookies and similar technologies

We use strictly-necessary cookies and browser storage to authenticate your session and remember your preferences and in-progress work. Site analytics provided by our hosting provider are aggregated and do not use cross-site tracking cookies. You can block or delete cookies in your browser; doing so may impair the Service.

---

10. Your rights

Under the Privacy Act and the APPs you may:

• access the personal information we hold about you (APP 12). We will respond within 30 days. Identity verification is required;
• correct information that is inaccurate, out of date, incomplete, irrelevant, or misleading (APP 13);
• withdraw consent to specific handling where consent is the basis (for example, marketing); and
• complain to us and, if you are not satisfied with our response, to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

You may also close your account at any time, after which clauses 5.4 to 5.6 apply.

To exercise any of these rights, email contact@structbyai.com. We will acknowledge your request and respond within 30 days. We may charge a reasonable cost-recovery fee for an unusually large or repeated access request, as APP 12 permits.

---

11. Notifiable data breaches

If we become aware of an eligible data breach (a breach likely to result in serious harm to one or more individuals) we will notify the affected individuals and the OAIC as required by Part IIIC of the Privacy Act.

You can report a suspected security incident to contact@structbyai.com. Please do so promptly if you suspect your account has been compromised.

---

12. Children

The Service is not directed to, and we do not knowingly collect personal information from, anyone under 18. If you believe we have inadvertently collected information about a child, contact us and we will delete it.

---

13. Changes to this Policy

We may update this Policy from time to time. The current version is always at structbyai.com/privacy. Material changes will be notified by email or in-product notification at least 30 days before they take effect.

---

14. Contact