Privacy Policy.

Who this covers

This policy explains how Aphelion Engineering Pty Ltd handles personal information collected through Ampacities (ampacities.com). It covers visitors, account holders, and the people whose details account holders store in their practice (for example, their clients' contacts). We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

The information we hold

• Account details — your name, email address, and (optionally) a mobile number used for sign-in codes. Passwords are stored only as salted cryptographic hashes; we cannot read them.
• Practice records you enter — clients, projects, calculations and their inputs, proposals, quotes, invoices, timesheets. These belong to your practice and are visible only within it.
• Security records — session records including IP address and browser identifier, sign-in events, and an audit trail of sensitive actions. Kept to protect your account.
• Billing records — no payment is taken during Beta 1, so we do not ask for payment details. Your account records its workspace tier. We will update this policy and name a payment processor before any sale.
• Correspondence — emails you send us.

Page-view counting — we count page views on our own infrastructure. A view records the page's path, the country it was viewed from, a coarse device class, the referring site's domain, and campaign source, medium and name when those tags are present. We also record whether a session cookie is present — a yes-or-no signal, not an account identity.

Product analytics — on public pages (not inside the signed-in platform) we use PostHog, hosted in the EU, to learn which pages and calculators help people and where they get stuck: pages viewed, buttons and links clicked, steps such as running a calculator, printing or signing up, page-load speed, and the country, browser and device type. It runs without cookies or browser storage; visits are grouped by a value derived from your IP address and browser that changes every day and cannot be traced back to you. Web addresses are cleaned of every query value except campaign tags before they are sent, and the values you type into calculators or forms are never collected. Session recordings happen only if you allow them on the notice shown on your first visit: then we record how pages are used (pointer movement, clicks, scrolling and page layout) so we can see where they confuse people. Everything you type is hidden, signed-in work areas are blocked from recordings, and members who are signed in are never recorded. You can change your answer at any time with Privacy choices in the footer or below in § 13.

Platform usage — inside the signed-in platform there is no analytics script. Instead our server tells PostHog when a step of the work happens: signing in, creating an account, saving, issuing or revising a calculation (and which calculator), creating a project, client, diagram, proposal, quote or invoice, moving a proposal or invoice to its next status, logging time, and inviting a member. If AI drafting is offered, using it will also be counted. Each event carries a one-way coded identifier for your account and for your practice, which cannot be turned back into who you are. It never carries names, email addresses, document numbers, clients, amounts, or calculation inputs and results. We use it to see which features practices rely on and where new practices get stuck.

Visits carrying the Global Privacy Control signal are not counted or analysed at all. We collect no advertising identifiers and nothing from data brokers. Cookies and browser storage are listed in full in § 13.

What it is used for

• Providing the Service — storing and displaying your practice's work, producing reports.
• Securing accounts — verifying sign-ins, one-time codes, alerting on suspicious activity.
• Account management. No payment is taken during Beta 1.
• Transactional email you'd expect: verification, password reset, invitations, documents you choose to send.
• Support, and meeting our legal obligations (for example, tax record-keeping).

We do not sell personal information, and we do not use your practice data for advertising or profiling.

What AI sees — and never sees

Optional AI drafting is deferred. If it is offered and your practice uses it, the relevant proposal text and context will be sent to Anthropic (our AI provider) to draft prose only. Under our API arrangement this content is not used to train their models. AI never receives your billing details, and it never produces engineering figures or prices. Practices can disable AI features entirely, and the switch is respected server-side.

Our processors

We use a small set of infrastructure providers, each receiving only what its job requires:

Cloudflare

Hosting, database, backups, page-view counting and sign-in security. The application and its data run on Cloudflare's platform; nightly backups are encrypted before storage. The Turnstile check on the sign-in and sign-up pages receives your IP address and browser signals to tell people from bots.

Backblaze

Encrypted backup mirror, EU Central. Backblaze B2 receives a second copy of our nightly database backup from a different provider, to help us recover if our Cloudflare account is lost. If mirroring fails on a given night, that night's backup is held on Cloudflare only. Database backups are encrypted before they reach Backblaze, and Backblaze does not hold the key.

PostHog

Product analytics, EU-hosted. Receives the cleaned page and event data and the coded platform-usage events described in § 02, through our own domain or directly from our server. It stores no cookies on your device and does not keep your IP address.

Resend

Email delivery. Receives the address and content of each transactional email we send you.

Twilio

SMS delivery. Receives your mobile number and the one-time code, only if you use SMS sign-in.

Anthropic

AI drafting, deferred. Will receive proposal text for prose drafting, only if AI drafting is offered and your practice uses it (§ 04).

No payment is taken during Beta 1. We will name a payment processor in this policy before any sale.

Beyond these, we disclose personal information only if the law requires it, or with your consent.

Overseas handling

Our providers operate global infrastructure, so your information may be stored or processed outside Australia — principally in the United States and on Cloudflare's worldwide edge network. Encrypted backup copies are mirrored to Backblaze B2 in the European Union (EU Central), and PostHog product analytics is hosted in the EU. We choose providers with strong, audited security practices, but by using the Service you acknowledge this overseas handling.

How it is protected

• Encryption in transit everywhere; passwords, session tokens and one-time codes stored only as hashes.
• One active session per account; sessions expire automatically.
• Strict practice isolation — every query is scoped to your practice.
• Nightly backups, encrypted before they are written. Copies on Cloudflare R2 and on the Backblaze B2 mirror are kept for 90 days and then deleted automatically.
• An audit trail of sensitive actions.

If a data breach occurs that is likely to result in serious harm, we will notify affected users and the OAIC as required by the Notifiable Data Breaches scheme.

How long we keep it

We keep your information while your account exists. After an account is closed we delete or de-identify personal information within a reasonable period, except what we must keep — for example, tax and billing records (kept as required by Australian law) and minimal audit entries. Encrypted backup copies on Cloudflare R2 and Backblaze B2 are kept for 90 days and then deleted automatically.

Access, correction, export, deletion

Most account details can also be corrected directly in your settings.

If you are in the EU or the UK, you have the same rights under the GDPR and the UK GDPR, including the right to object to analytics. You can also complain to your local data protection authority.

When you store others' details

When a practice stores its clients' contact details in Ampacities, the practice is responsible for collecting that information lawfully. We process it only to provide the Service to the practice. If someone contacts us directly about information a practice holds, we will refer the request to that practice unless the law requires otherwise.

If something is wrong

Write to studio@ampacities.com — complaints are read first, and we aim to respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

When this policy changes

We may update this policy as the Service evolves; the effective date above always reflects the current edition. For material changes we will give notice by email or a prominent notice in the Service.

What is stored on your device

The site sets one cookie, and only when you sign in. It also keeps items in your browser's own storage: preferences you choose, drafts of work in progress and records of requests whose outcome needs checking. These records can include the form entries and identifiers needed to repeat your request; choosing Check again sends the stored request data to our server. Nothing here is used for advertising, and our analytics (§ 02) stores nothing on your device unless you allow session recordings.

__amp_session

Keeps you signed in. Cookie, first-party, HttpOnly and Secure. Set: when you sign in. Kept: 12 hours at most; ends sooner after inactivity. Essential.

amp-theme

Remembers day or night theme. Browser storage. Set: when you switch theme. Kept: until you clear it. Your preference.

amp-consent

Remembers your answer about session recordings. Browser storage. Set: when you answer the notice shown on your first visit. Kept: until you clear it or change your choice. Essential.

ph_*

PostHog's recording session, only if you allowed recordings. Tab storage. Set: only after you choose Allow on that notice. Kept: until the tab closes; removed if you change your mind. Your choice.

amp-authed

Shows the signed-in menu without a flicker. Tab storage. Set: on page load. Kept: until the tab closes. Essential.

amp-work-*

Keeps calculator inputs while you sign in to save or print. Tab storage. Set: when you choose save or print while signed out. Kept: until the tab closes. Essential.

practice-ops:p2-pending

Keeps account and practice identifiers, request data and form entries to check unconfirmed template or project-copy requests. Tab storage. Set: before submitting a template or project-copy request. Kept: tab session (browser restoration may retain it); cleared on resolution, sign-out or detected access changes. Essential.

practice-ops:p3-pending

Keeps account, practice and deliverable identifiers and the requested state or date change to check an unconfirmed Kanban or calendar request. Tab storage. Set: before submitting a Kanban or calendar change. Kept: tab session (browser restoration may retain it); cleared on resolution, sign-out or detected access changes. Essential.

practice-ops:p4-pending

Keeps account, practice and project identifiers and custom-field definitions or values to check an unconfirmed request. Tab storage. Set: before submitting a custom-field change. Kept: tab session (browser restoration may retain it); cleared on resolution, sign-out or detected access changes. Essential.

practice-ops:p5-pending

Keeps account, practice and project identifiers and schedule, calendar, dependency, milestone or baseline request data to check an unconfirmed request. Tab storage. Set: before submitting a project scheduling change. Kept: tab session (browser restoration may retain it); cleared on resolution, sign-out or detected access changes. Essential.

po-glass

Remembers whether transparency is reduced in practice operations. Browser storage. Set: when you change Reduce transparency. Kept: until you clear it or change the setting. Your preference.

amp-plc-program-v1

Your draft ladder program in PLC Testing. Browser storage. Set: when you edit a program. Kept: until you clear it. Your preference.

pc.imported.devices

Protection devices you imported or saved. Browser storage. Set: when you import or save a device. Kept: until you clear it. Your preference.

pc.digitized.devices

Devices queued for the coordination chart. Browser storage. Set: when you add a device to the chart. Kept: until you clear it. Your preference.

pc.recent

Recently used protection devices. Browser storage. Set: when you use a device. Kept: until you clear it. Your preference.

pc.demoBannerDismissed

Hides the demo notice you dismissed. Browser storage. Set: when you dismiss it. Kept: until you clear it. Your preference.

amp-reg-cols

Column layout of your calculation register. Browser storage. Set: when you change columns. Kept: until you clear it. Your preference.

sld:autosave:v1:*

Draft autosave in the diagram editor. Browser storage. Set: while you edit a diagram. Kept: pruned automatically; at most eight drafts. Your preference.

sld:autosave:v1

Older single-draft autosave, removed when found. Browser storage. Set: no longer written. Kept: removed on next save. Your preference.

sld:autosave:tab

Tells drafts in different tabs apart. Tab storage. Set: when the diagram editor opens. Kept: until the tab closes. Essential.

Diagram editor

Editor preferences and symbol work in progress. Browser storage: sld:toolChest:v1 sld:drawingSettings:v1 sld:snapSettings:v1 sld:favorites:v1 sld:sectionCollapsed:v1 sld:paletteWidth:v1 sld:rightPanel:manualTab sld:recentCommands:v1 sld:reviewerName:v1 sld:editor-patches:v1 sld:v3-studio:v1. Set: when you change a preference or edit a symbol. Kept: until you clear it. Your preference.

When you are signed in, diagram editor items include your account number in their name, so two people sharing a computer keep separate drafts. The Cloudflare Turnstile security check on the sign-in and sign-up pages does not set tracking cookies. You can delete any of these items in your browser's settings at any time, and change your answer about session recordings here: Clearing them can sign you out, reset preferences and remove local drafts or unconfirmed-request records. It does not undo requests already submitted to the server.