Privacy Policy

1. Account and subscription information

CRAFT uses your account email to support sign-in, account recovery, billing support and subscription fulfilment. Payment details are handled by Paddle; PRS does not store full card numbers. CRAFT stores subscription and access records needed to operate the service, investigate support requests, prevent abuse and meet legal, tax, security and dispute obligations.

In practice, this includes:

• your verified email address and identity-provider account identifier;
• subscription and entitlement status, Paddle customer and subscription references, billing period and transaction status;
• records of checkout attempts and promotion eligibility;
• support correspondence and information you choose to provide in a request;
• inputs you submit to hosted CRAFT risk-identification or cost-analysis services when you choose to use those features.

2. Your project data

CRAFT projects may be stored locally in your browser or exported by you as .prs files. PRS cannot remotely delete browser-local projects or files you have exported to your own devices or storage locations.

PRS does not maintain a central copy of your projects and cannot access or recover them for you. When you deliberately use a hosted AI-assisted or calculation feature, the inputs required for that request are transmitted to the relevant CRAFT service for processing.

3. Why we use information

PRS uses information to authenticate users, create and manage subscriptions, decide whether CRAFT access is allowed, process support and refund requests, secure and operate the service, diagnose failures, reconcile billing state, prevent abuse and meet legal obligations.

4. Operational logs

PRS and its service providers may process operational logs needed to operate, secure and troubleshoot CRAFT. These may include IP addresses, timestamps, browser/device information, request paths, error categories and pseudonymous account or session references.

5. Service providers and locations

CRAFT is hosted primarily in Microsoft Azure Australia East, but PRS uses Microsoft identity services and Paddle payment services that may process data in other countries.

This means that while CRAFT's own application and data services run in Australia, some personal information is necessarily processed outside Australia:

• Microsoft Entra External ID provides customer sign-in and account security. Authentication data may be processed in Microsoft locations outside Australia.
• Paddle is the merchant of record and processes checkout, payments, tax determination, invoicing and the billing portal. Payment and billing data is processed in Paddle's locations, which are outside Australia.

These providers process information under their own terms, privacy commitments and safeguards. PRS shares only what is required for authentication, billing and fulfilment.

6. Website visitors and enquiries

This website is built and hosted on Webflow. Visiting the site involves Webflow's hosting and content delivery infrastructure, which processes standard technical request information needed to serve pages and protect the site from abuse.

If you submit an enquiry through a form on this site, PRS receives the information you provide — such as your name, email address, organisation and message — so we can respond. Forms are protected by an anti-abuse check to prevent automated submissions.

Website enquiries are stored in Webflow and a copy is emailed to PRS. Webflow records technical information, including the sender's IP address, to operate and protect the form. PRS normally retains enquiries for up to 24 months after the last substantive contact, then deletes them from active Webflow submission storage and the PRS mailbox unless longer retention is reasonably required for legal obligations, security, fraud prevention or a dispute. Limited copies may remain temporarily in provider backups or security records until normal retention cycles expire.

We use Cloudflare Web Analytics to understand visits to our public marketing website and how its pages perform. Reports include page views, referring websites, country, device and browser information, and page-loading performance. Cloudflare states that this service does not use cookies or local storage for analytics and does not fingerprint individual visitors. We do not send enquiry form contents or CRAFT project data to this analytics service.

When you send an enquiry, we may also record the campaign labels attached to the contact-page link and any answer you give to “How did you hear about CRAFT?”. We use this information to understand which activities lead to enquiries. It is stored with the enquiry and follows the enquiry retention period described above. Providing this information does not subscribe you to marketing messages.

Please do not include confidential project information, passwords or payment details in a website enquiry form.

PRS does not use this website for advertising, and does not sell or share personal information for advertising purposes.

7. Data breaches

PRS will assess suspected eligible data breaches and notify affected customers and regulators where required by applicable law.

8. Backup and recovery

Backup snapshots may contain account and subscription records. They are access-controlled and retained only for approved recovery, security and legal purposes. Deletion and de-identification requests are assessed against active systems and backup-retention obligations.

Backup snapshots are retained for no longer than 35 days.

Where a backup is restored, PRS re-applies deletion and de-identification actions completed after the snapshot was taken, so that personal data you asked PRS to delete is not silently reinstated by a restore.

Backup snapshots cover PRS-controlled account and subscription records only. They do not contain your CRAFT projects, because those are stored on your own device.

9. Retention and security

PRS retains account, entitlement, transaction evidence and support records only for as long as reasonably required to provide the service, meet tax and legal obligations, resolve disputes and protect against fraud. Some financial and dispute-related records must be retained for extended periods under Australian law even after an account is closed; where that applies, PRS de-identifies personal fields where it lawfully can.

PRS applies access controls, managed identities, encryption in transit, restricted secrets and security logging. No internet service can be guaranteed completely secure.

10. Cookies and sign-in

CRAFT and its identity and billing providers use cookies or equivalent browser storage required for secure sign-in, session continuity, checkout and fraud prevention. Browser-local CRAFT project storage is functional application storage that keeps your work on your own device; it is not advertising tracking.

11. Access, correction and deletion

You may request access to or correction of your personal information by contacting contact@projectrisksolutions.com.au. Account deletion requests are support-assisted because billing, identity, audit, security and retention obligations must be checked before records are deleted or de-identified.

PRS will verify your identity and control of the account before acting on a request, and will respond within the period required by applicable law. Cancelling a subscription does not automatically delete your customer identity, and deleting your identity does not remove projects or .prs files held on your own devices.

12. Contact

Send privacy requests or complaints to contact@projectrisksolutions.com.au. PRS will investigate and aims to respond within 30 days. If PRS does not respond within 30 days, or you are dissatisfied with the response, you may lodge a complaint with the Office of the Australian Information Commissioner. Individuals in the UK or EEA may also complain to the ICO or the applicable data-protection supervisory authority.

Effective date: 1 August 2026.
Supplied by Project Risk Solutions, ABN 23 724 681 106.