Legal
Privacy Policy
What Drawspan collects, why it is used, where it may be processed and the choices available to you.
1. Scope and who is responsible
This Privacy Policy explains how CODEDCONSTRUCTS PTY LTD (ABN 33 699 879 377), operating as Drawspan, handles personal information through the Drawspan website, account portals, APIs, SDK and licensing service.
Drawspan supports software vendors and their organisation customers. Vendors decide who receives their software and may give Drawspan information to create entitlements. Each vendor remains responsible for its software, customer relationship and privacy obligations. This policy covers Drawspan's handling of information; it does not replace the vendor's privacy policy.
2. Information we collect
- Account and identity information
- Name, email address, workspace or organisation name, avatar colour, role, account status, sign-in and last-use timestamps, and identifiers for vendor or organisation access.
- Microsoft Entra and OIDC information
- When Microsoft sign-in is enabled, the identity provider's issuer and subject identifiers and the name and email claims returned during sign-in. Drawspan separately verifies and links access; Microsoft authentication alone does not grant a vendor or organisation role.
- Organisation, membership and invitation information
- Organisation names and type, domains and verification state, member names and emails, roles, invitation details, vendor-customer links, delegated access, and dates associated with those records.
- Vendor, product and subscription records
- Vendor workspace details, team members, product names and settings, branding, reusable plans, customer subscriptions, terms, trials, seats, assignments, capacity and status. Vendor product licence terms are distinct from Drawspan's Terms of Service.
- Machine, activation and lease information
- A keyed hash of a client-generated machine fingerprint rather than the raw fingerprint components; a client-supplied machine and host-application label; SDK and host versions; product and member identifiers; activation state; signed lease tokens; issue, expiry, renewal and revocation state; and first, last and most recent client-contact timestamps.
- Billing and connected-payment information
- Drawspan plan, billing status, provider references and period end. Where a vendor connects Stripe or Lemon Squeezy, Drawspan may receive event type, customer email, product or price reference, payment or subscription reference, quantity, period and event outcome. Drawspan does not receive or store full payment-card numbers in these flows.
- Transactional email information
- Recipient address, subject, text body, creation and delivery-acceptance times, attempt count, retry time and the most recent delivery error. This supports invitations, sign-in links, notices, retries and delivery troubleshooting.
- Audit, security and operational information
- Who performed an account or licensing action, the organisation and subject involved, time, action and relevant detail; session, credential and API-key issue, last-use and revocation records; IP-derived rate-limit activity; request and error information; and service-health or background-job logs.
- Information you send us
- Support, privacy and complaint messages and any information you choose to include.
This information comes from you, your organisation administrator, a software vendor, the Drawspan SDK, your identity provider or a connected payment platform. Drawspan also records the account, licensing and operational events created when the Service is used.
3. Why we use information
We use the information above to:
- create and secure accounts, authenticate people and keep vendor and organisation access separate;
- manage organisations, invitations, roles, vendor-customer relationships and delegated access;
- record subscriptions, terms, seats and assignments and issue, renew, validate or revoke licence leases;
- apply activation, offline, trial, capacity and billing rules and show when Drawspan last heard from a machine;
- process Drawspan plan billing and translate vendor-directed payment events into entitlements;
- send transactional messages and retry or diagnose delivery failures;
- prevent abuse, enforce rate limits, investigate security events, maintain audit history and operate the Service;
- respond to support, access, correction, deletion and complaint requests; and
- comply with law, resolve disputes and protect the rights and safety of users, Drawspan and others.
We do not sell personal information or use it for third-party behavioural advertising.
6. Retention, account closure and deletion
Drawspan does not apply one retention period to every record. We keep information while an account or customer relationship is active, then for as long as we need it to provide the Service, preserve licensing and transaction history, secure accounts, resolve disputes, enforce agreements, meet accounting obligations or comply with law.
Short-lived sign-in links and authentication flows expire quickly, and sessions expire or can be revoked. Disabled identities, historical subscription terms, audit records, payment-event outcomes, activations and lease history may be retained after access ends so earlier actions and entitlements remain understandable. Vendor product terms are append-only for the period they govern and are not silently rewritten.
You may request account closure or deletion. We assess each request against the rights of the relevant vendor or organisation, security and fraud needs, contractual records and legal retention obligations. We delete or de-identify information when it is no longer needed and no obligation or legitimate reason requires us to keep it. After production backups exist, deleted information may remain in them for a limited period.
7. Security practices
Current controls include role-scoped access, separate vendor and organisation sessions, short-lived sign-in flows, hashed session and credential tokens, keyed hashes of machine fingerprints, signed time-limited leases, rate limits, audit records and transactional email queuing.
We will describe production hosting, transport security, secrets management, backups, monitoring and provider controls after they are deployed and verified. No online service is completely secure, and we cannot guarantee that loss, misuse or unauthorised access will never occur.
If you believe Drawspan or your account has a security problem, contact braden@codedconstructs.com.
8. Access, correction, deletion and complaints
You may ask us to:
- explain whether we hold personal information about you;
- provide access to or correct that information;
- close an account or delete information where appropriate; or
- review a privacy concern or complaint.
Email braden@codedconstructs.com. Please provide enough information to identify the relevant account and request. We may need to verify your identity and authority before acting. Some requests may need to be handled with the vendor or organisation that controls the relevant customer relationship.
We will respond within a reasonable time and explain if we cannot fulfil all or part of a request. You can use these request routes whether or not a particular privacy law applies. Codedconstructs and Drawspan have not been assessed or certified against the Australian Privacy Principles, GDPR, SOC 2, ISO 27001 or another framework.
9. Changes to this policy
We update this policy when Drawspan's information handling or providers change. Each version has its own number and effective date. Where practical, we will explain material changes in advance. Changes apply from the stated date, and we will not silently use existing information in a materially less private way.
10. Contact
For privacy requests or complaints:
CODEDCONSTRUCTS PTY LTD
ABN 33 699 879 377
braden@codedconstructs.com