Privacy Policy

1. Account and subscription information

CRAFT uses your account email to support sign-in, account recovery, billing support and subscription fulfilment. Payment details are handled by Paddle; PRS does not store full card numbers. CRAFT stores subscription and access records needed to operate the service, investigate support requests, prevent abuse and meet legal, tax, security and dispute obligations.

In practice, this includes:

• your verified email address and identity-provider account identifier;
• subscription and entitlement status, Paddle customer and subscription references, billing period and transaction status;
• records of checkout attempts and promotion eligibility;
• support correspondence and information you choose to provide in a request;
• inputs you submit to hosted CRAFT risk-identification or cost-analysis services when you choose to use those features.

2. Your project data

CRAFT projects may be stored locally in your browser or exported by you as .prs files. PRS cannot remotely delete browser-local projects or files you have exported to your own devices or storage locations.

PRS does not maintain a central copy of your projects and cannot access or recover them for you. When you deliberately use a hosted AI-assisted or calculation feature, the inputs required for that request are transmitted to the relevant CRAFT service for processing.

3. Why we use information

PRS uses information to authenticate users, create and manage subscriptions, decide whether CRAFT access is allowed, process support and refund requests, secure and operate the service, diagnose failures, reconcile billing state, prevent abuse and meet legal obligations.

4. Operational logs

PRS and its service providers may process operational logs needed to operate, secure and troubleshoot CRAFT. These may include IP addresses, timestamps, browser/device information, request paths, error categories and pseudonymous account or session references.

5. Service providers and locations

CRAFT is hosted primarily in Microsoft Azure Australia East, but PRS uses Microsoft identity services and Paddle payment services that may process data in other countries.

This means that while CRAFT's own application and data services run in Australia, some personal information is necessarily processed outside Australia:

• Microsoft Entra External ID provides customer sign-in and account security. Authentication data may be processed in Microsoft locations outside Australia.
• Paddle is the merchant of record and processes checkout, payments, tax determination, invoicing and the billing portal. Payment and billing data is processed in Paddle's locations, which are outside Australia.

These providers process information under their own terms, privacy commitments and safeguards. PRS shares only what is required for authentication, billing and fulfilment.

6. Website visitors and enquiries

This website is built and hosted on Webflow. Visiting the site involves Webflow's hosting and content delivery infrastructure, which processes standard technical request information needed to serve pages and protect the site from abuse.

If you submit an enquiry through a form on this site, PRS receives the information you provide — such as your name, email address, organisation and message — so we can respond. Forms are protected by an anti-abuse check to prevent automated submissions.

Enquiries submitted through this site are stored in Webflow, the platform that hosts this website, and a copy is emailed to PRS. Webflow records the sender's IP address alongside the submission. PRS keeps website enquiries only for as long as they are reasonably needed to respond and to follow up, and deletes them from both Webflow and the PRS mailbox once they are no longer needed.

Please do not include confidential project information, passwords or payment details in a website enquiry form.

PRS does not use this website for advertising, and does not sell or share personal information for advertising purposes.

7. Data breaches

PRS will assess suspected eligible data breaches and notify affected customers and regulators where required by applicable law.

8. Backup and recovery

Backup snapshots may contain account and subscription records. They are access-controlled and retained only for approved recovery, security and legal purposes. Deletion and de-identification requests are assessed against active systems and backup-retention obligations.

Backup snapshots are retained for no longer than 35 days.

Where a backup is restored, PRS re-applies deletion and de-identification actions completed after the snapshot was taken, so that personal data you asked PRS to delete is not silently reinstated by a restore.

Backup snapshots cover PRS-controlled account and subscription records only. They do not contain your CRAFT projects, because those are stored on your own device.

9. Retention and security

PRS retains account, entitlement, transaction evidence and support records only for as long as reasonably required to provide the service, meet tax and legal obligations, resolve disputes and protect against fraud. Some financial and dispute-related records must be retained for extended periods under Australian law even after an account is closed; where that applies, PRS de-identifies personal fields where it lawfully can.

PRS applies access controls, managed identities, encryption in transit, restricted secrets and security logging. No internet service can be guaranteed completely secure.

10. Cookies and sign-in

CRAFT and its identity and billing providers use cookies or equivalent browser storage required for secure sign-in, session continuity, checkout and fraud prevention. Browser-local CRAFT project storage is functional application storage that keeps your work on your own device; it is not advertising tracking.

11. Access, correction and deletion

You may request access to or correction of your personal information by contacting contact@projectrisksolutions.com.au. Account deletion requests are support-assisted because billing, identity, audit, security and retention obligations must be checked before records are deleted or de-identified.

PRS will verify your identity and control of the account before acting on a request, and will respond within the period required by applicable law. Cancelling a subscription does not automatically delete your customer identity, and deleting your identity does not remove projects or .prs files held on your own devices.

12. Contact

Send privacy questions, requests or complaints to contact@projectrisksolutions.com.au. PRS will investigate privacy concerns and respond within a reasonable period. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.

Effective date: 1 August 2026.
Supplied by Project Risk Solutions, ABN 23 724 681 106.