Privacy policy

1. What we collect

We collect the following kinds of personal information:

• Contact and application details you give us on this website, for example when you request a free trial or email us: your name, work email, company, role and your answers to the request questions.
• Account information: your name, email address, organisation and sign-in details when you create an account or are invited to one.
• Project content: the contracts, documents, mail, drafts and other material you upload, or that Astruct reads from the mailboxes and folders you connect (Your Content). Your Content may contain personal information about you and other people, such as the names and contact details of people you correspond with.
• Connected-account data: where you or your administrator connect a Microsoft 365 account, or a Google or Procore account we set up on request, the mail and files Astruct is permitted to read from it.
• Usage and billing data: your plan, usage and billing details (including the card you add if you start a paid company account), handled by our payment processor. We do not store full card numbers.
• Technical data: device and browser type, IP address, log data and cookie identifiers.

2. How we use it

We use personal information to:

• provide and operate Astruct, including reading your connected sources, detecting issues, linking evidence, computing deadlines and preparing drafts for your review;
• respond to trial requests and enquiries, and set up and support your account;
• measure usage, administer plans and process payments;
• keep Astruct secure and detect misuse; and
• meet our legal obligations.

We do not sell personal information. Your Content is never used to train models, by us or by our AI provider.

3. Where it is stored

Your account, Your Content and trial requests are stored in Australia, in Sydney. Data is encrypted in transit and at rest. AI processing and parts of the hosting take place in the United States (sections 4 and 5).

4. AI processing

To read mail and documents, check issues and prepare drafts, Astruct sends the relevant parts of Your Content to OpenAI’s API. OpenAI processes these requests in the United States under its business API terms, and does not use data sent through its business API to train its models.

5. Service providers and overseas disclosure

We use these service providers: Supabase (database and file storage, Sydney), Vercel (hosting, partly in the United States), OpenAI (model processing, United States), Stripe (billing), Microsoft, Google and Procore (only for the accounts you connect), and Meta (website advertising measurement, see section 7). Each handles data under its own terms.

Some providers may process data outside Australia. Where we disclose personal information overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles. We may also disclose personal information to professional advisers, to a purchaser of our business, or where required or authorised by law.

6. Mailboxes and connected accounts

Astruct only reads the mailboxes and folders that you, or your organisation’s administrator, connect. Your administrator decides whose mailbox each person in your organisation may search and use with Astruct. Astruct prepares drafts for review and never sends them on your behalf.

Astruct’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google or Microsoft user data for advertising.

You can disconnect an account at any time in Settings. Your Microsoft 365 or Google administrator can also revoke Astruct’s access.

7. Cookies and measurement

We use essential cookies to operate the website and keep you signed in to the app. On this website we use the Meta Pixel to measure visits and trial requests from our advertising. It records page views and, when you request a trial, the fact that you did. It does not receive your answers. If you arrive from an ad, we keep the ad parameters in the link (such as utm_campaign) in your browser for up to 30 days and store them with your trial request, so we know which ad brought you. You can block or clear cookies and site data in your browser.

8. Retention

We keep personal information for as long as we need it to provide Astruct and for legitimate business and legal purposes. Your Content is kept until you delete it or your organisation’s account is closed, subject to short backup cycles. You can ask us to delete a trial request at any time.

9. Access, correction and complaints

You may ask for access to, or correction of, the personal information we hold about you, or ask us to delete it. Email info@astruct.io. We may need to verify your identity.

If you have a privacy concern, contact us and we will investigate and respond. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. If we become aware of an eligible data breach, we will respond under the Notifiable Data Breaches scheme.

10. Changes and contact

We may update this policy. The current version is always on this page with its date. For privacy questions or requests, email info@astruct.io. See also our terms and security page.