Privacy Policy

1. What we collect

Information you give us

• Account details: your email address and password. Passwords are stored only as a secure hash by our authentication provider; we never see them.
• Profile details you choose to add, such as your name and company.
• Sign in with Google: your name and email address from your Google account.
• Two-factor authentication settings, if you turn it on.
• Your work in PVDCal: the inputs you enter, the projects you save and the results produced.
• Messages you send through the contact form: your name, email address, company, topic and message.

Billing

Payments are handled by Paddle, our Merchant of Record. We never receive your full card number or security code, and we cannot charge your card ourselves. Paddle tells us your subscription's status, plan and renewal date, together with Paddle's own customer and subscription reference numbers, and we store these to give you access. After a checkout, Paddle also tells us the card's brand, last four digits and expiry month. We keep only a one-way scrambled version of those three details — it cannot be turned back into your card — and use it for one purpose: to make sure each card starts one free trial. Paddle collects and uses your payment and billing details under its own privacy policy.

Collected automatically

• Sign-in session: which session is your active one, so that PVDCal works on one device at a time.
• Security data: your IP address, used to limit repeated attempts (for example sign-in guesses), and your account id, used to limit how often the PVD Design Tool is downloaded. These counters expire within a day. Email addresses used for this are stored only in a one-way scrambled (hashed) form.
• Licence checks: the PVD Design Tool sent to your browser carries a code derived from your account. While you use it, it confirms your subscription with our server and sends that code, so we can detect copies of the software passed on to others.
• Calculation tokens and report serials: before each calculation the tool asks our server for permission, and when you export a report it asks for a serial number, which is printed on the report so a reader can check it is genuine. We record which account asked, when, and for which edition (paid or demo). Your project, soil data, inputs and results are never sent to us: the calculation runs entirely in your browser, and a report's contents stay on your computer.
• Security log: failed sign-ins, refused tokens, replaced sessions and similar events, with your account id and a scrambled (hashed) form of the IP address, kept for 90 days to detect attacks on accounts. Never the contents of a project or a report.
• Server logs: the pages and services requested, with the time, IP address and browser type, kept for a short period to run and secure the service.

2. Cookies

PVDCal uses only the cookies needed to keep you signed in securely. They cannot be read by page scripts. We do not use advertising or analytics cookies. To see which pages are read, we use Vercel Web Analytics, which counts page views without cookies and without storing anything on your device; it records the page, the referring site, the country and the browser and device type, and keeps no profile of you. When you open Paddle's checkout, Paddle may set its own cookies to process your payment.

3. How we use your information

• to create and secure your account, and sign you in;
• to provide PVDCal (your projects stay on your own device as files you save);
• to manage your trial, subscription and access;
• to send service emails, such as email confirmation and password reset;
• to answer your messages and give support;
• to prevent abuse, fraud and security incidents; and
• to meet our legal obligations.

We only send marketing emails if you have agreed to receive them, and you can opt out at any time. We do not sell your personal information.

4. Who we share it with

We use trusted service providers who process information for us under contract, only to run PVDCal:

• Supabase: database and sign-in, hosted in Sydney, Australia.
• Vercel: website hosting. PVDCal's servers run in Sydney; requests pass through Vercel's global network.
• Upstash: the short-lived security counters described above, hosted in Sydney.
• Resend: sending account and contact-form emails, processed through Tokyo, Japan.
• Paddle: checkout, payments, tax and receipts, as Merchant of Record (United Kingdom).
• Google: only if you choose to sign in with Google.

Some of these providers are based in, or process information in, countries outside Australia, including the United States, the United Kingdom and Japan. We choose providers with strong security and contractual privacy protections. We may also disclose information where the law requires it.

5. How long we keep it

• Account and project data: while your account is open.
• When you ask us to delete your account, we delete its personal information within 30 days, except billing and tax records that we or Paddle must keep by law.
• Contact-form messages: as long as needed to deal with your enquiry.
• Security counters: up to a day. Security log: 90 days. Server logs: a short period.
• Report serials: for as long as the reports they verify may be relied upon.

6. How we protect it

All connections to PVDCal are encrypted. Database rules stop any user from reading another user's data, passwords are hashed, and you can add two-factor authentication. Calculation code and secret keys stay on our servers. No system is perfectly secure, but we work to protect your information and will notify you and the regulator of an eligible data breach as the law requires.

7. Your choices and rights

• You can view and update your profile on the Account page.
• You can ask for a copy of your personal information, ask us to correct it, or ask us to delete your account.
• If the GDPR applies to you, you can also object to or restrict certain processing and ask for your data in a portable format.

Send requests through the contact form, choosing "Privacy request". We may need to confirm your identity, and we aim to reply within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in the EU or UK, to your local data protection authority.

8. Children

PVDCal is for professionals and is not intended for anyone under 18.

9. Changes to this policy

We will post any update here with a new date, and tell you about significant changes by email or in PVDCal.

10. Contact

Questions about privacy, or a request about your own data: use our contact form, or write to support@geotechlogic.com. The data controller is GeotechLogic, Victoria, Australia.