Privacy Policy

1. Who We Are

QALA is an AI-powered landscape plan validation service operated by Alastair Cameron (ABN 13 299 746 702), trading as QALA, based in Perth, Western Australia.

Contact: reports@qala.com.au

We are committed to protecting your privacy in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Information We Collect

2.1 Account Information

• Email address — used for account login, notifications, and communication
• Name — used for personalisation and correspondence
• Password — stored as a cryptographic hash (bcrypt), never in plain text

2.2 Payment Information

• All payments are processed by Stripe (stripe.com). We do not store your credit card number, CVV, or full card details on our servers.
• Stripe may store payment details in accordance with their own privacy policy.
• We store transaction records (amount, date, credit pack purchased) for our internal records.

2.3 Uploaded Plans

• When you upload a landscape plan PDF, we process it to perform the validation analysis.
• Uploaded plans are stored securely during processing and retained for up to 12 months so you can re-access your reports.
• Plans may contain third-party personal information such as project addresses, client names, and design details embedded in the PDF. By uploading, you warrant that you have authority to share this information with us for processing.
• You may request deletion of any uploaded plan at any time by emailing reports@qala.com.au.

2.4 Usage Data

• Validation history (dates, scores, plan filenames)
• Credit usage and purchase history
• Google Analytics and Google Ads conversion tracking data (see Section 9)

2.5 Consequences of Not Providing Information

Certain personal information is required for us to provide the Service. If you choose not to provide it:

• Without an email address, you cannot create an account or use the Service.
• Without uploading a plan, we cannot generate a validation report.
• Without payment details (via Stripe), you cannot purchase credits beyond any free allocation.

We will not collect more information than is reasonably necessary to provide the Service.

3. How We Use Your Information

We use collected information to:

• Provide the Service — process your uploads, generate validation reports, manage your credits
• Communicate with you — send validation completion emails, account notifications, and support responses
• Process payments — via Stripe, for credit purchases and subscriptions
• Improve the Service — analyse aggregated, anonymised usage patterns to improve accuracy and features
• Comply with law — meet our legal and regulatory obligations

4. What We Do NOT Do

5. Third-Party Services

We use the following third-party services to operate QALA:

Each third-party service operates under its own privacy policy. We encourage you to review them.

6. Cross-Border Data Disclosure (APP 8)

7. Direct Marketing (APP 7)

• We may send you transactional emails related to your account, including: welcome emails, validation reports, credit purchase confirmations, and account notifications. These are essential communications, not marketing.
• We will not send you unsolicited marketing or promotional emails unless you have opted in.
• If we introduce marketing communications in the future, every email will include a clear unsubscribe link. You may also opt out at any time by emailing reports@qala.com.au.
• We do not share your personal information with third parties for their direct marketing purposes.

8. Data Storage and Security

• Hosting: Our application is hosted on Railway (railway.app) with servers in secure data centres.
• Database: User data is stored in a PostgreSQL database with encrypted connections.
• Passwords: Hashed using bcrypt — we cannot see or recover your password.
• HTTPS: All data transmitted between your browser and our servers is encrypted via TLS/SSL.
• Access: Only the business operator (Alastair Cameron) has access to production systems.

9. Cookies and Tracking

We use the following cookies and tracking technologies:

• Authentication token: Stored in your browser's local storage to keep you logged in. Essential for the Service to function.
• Google Analytics (gtag.js): Collects anonymised data about page views, session duration, and general usage patterns. You can opt out via Google's opt-out browser add-on.
• Google Ads conversion tracking: Tracks when a user who clicked an ad completes a purchase. No personal information is shared — only conversion events.

10. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access your personal information that we hold
• Correct any inaccurate or outdated information
• Request deletion of your account and associated data
• Complain about how we handle your personal information

To exercise any of these rights, email us at reports@qala.com.au. We will respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

11. Data Retention

• Account data: Retained while your account is active. Deleted within 90 days of account closure upon request.
• Uploaded plans: Stored securely for up to 12 months to allow you to re-access reports. You may request earlier deletion at any time by emailing reports@qala.com.au.
• Validation reports: Retained while your account is active. Deleted within 90 days of account closure.
• Payment records: Retained for 7 years as required by Australian tax law (Tax Administration Act 1953).
• Anonymised/aggregated data: We may retain anonymised, de-identified data (e.g., aggregate validation statistics, error frequency data) indefinitely for the purpose of improving the Service. This data cannot be used to identify you.

12. Unsolicited Personal Information (APP 4)

If we receive personal information that we did not solicit (for example, personal information contained within uploaded plans that is not necessary for providing the Service), we will determine within a reasonable period whether we could have collected the information under the APPs. If not, we will destroy or de-identify it as soon as practicable, provided it is lawful and reasonable to do so.

13. Children's Privacy

QALA is a professional tool intended for use by landscape architecture professionals. We do not knowingly collect information from anyone under the age of 18. If we become aware that we have collected data from a minor, we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified to you by email at least 14 days before they take effect. All changes will be posted on this page with an updated "Last updated" date. We will not reduce your rights under this policy without your explicit consent.

15. Contact

For privacy-related inquiries or requests: