InfraSynex Inspect Privacy Policy

Effective: August 3, 2026

Last updated: August 3, 2026

InfraSynex Inspect is a field inspection and reporting service operated by InfraSynex Pty Ltd ("InfraSynex", "we", "us", or "our"). This Privacy Policy explains how we collect, hold, use, disclose, secure, retain, and delete personal information when you use the InfraSynex Inspect mobile or web application, related cloud services, account and subscription services, public share links, or support channels.

Who controls workspace information

For an individually managed account, InfraSynex generally determines how account and service information is handled.

If an employer, contractor, government body, client, or other organisation provides or manages your access, that organisation may control the workspace, reports, projects, collaborators, and retention instructions. InfraSynex may process that information on the organisation's behalf. Requests about organisation-controlled records may need to be directed to the organisation, although you may still contact us for assistance.

Report owners and organisation administrators are responsible for ensuring that they are authorised to collect and upload personal information about other people, including information visible in photos, notes, signatures, attachments, or inspection locations.

Scope

This Policy applies to:

  • the InfraSynex Inspect mobile and web applications;
  • authentication, account, profile, subscription, and organisation management;
  • local report storage, cloud synchronisation, collaboration, report generation, exports, and share links;
  • support, security, account-deletion, and service communications.

Separate privacy notices from an app store, identity provider, billing provider, device platform, customer organisation, or linked third-party site also apply to that provider's handling of information.

Information we collect and hold

The information depends on the features you use.

Account, identity, and organisation information

  • Name, email address, phone number where phone authentication or multi-factor authentication is used, Firebase authentication identifier, and sign-in provider information.
  • Company name and identifier, work address, licence or registration details, profile image or logo, role, verification state, subscription entitlement, organisation membership, and seat assignment.
  • Authentication, password-reset, account-recovery, app-integrity, and recent reauthentication events needed to secure sensitive actions.

We do not receive your password from Apple, Google, or another federated sign-in provider. Payment card details entered into an app store or Stripe checkout are handled by that payment provider; we receive limited customer, transaction, invoice, product, status, and entitlement records.

Inspection, report, and project information

  • Client, project, structure, property, and site names and addresses.
  • Inspection dates, report identifiers, workflow selections, components, condition ratings, defects, hazards, observations, notes, recommendations, declarations, reviewer decisions, and generated report content.
  • Photos and their metadata, marked-up images, sketches, key maps, attachments, signatures, proof-of-presence evidence, audio notes, and exported documents.
  • Collaboration invitations, ownership and role records, shared access, edit and review events, synchronisation state, locks, conflicts, and audit history.

Inspection content may include personal information about clients, occupants, workers, inspectors, reviewers, or other people. Avoid capturing unrelated people, private documents, or sensitive details where they are not needed for the inspection.

Location and mapping information

With foreground location permission, the app may process GPS coordinates, accuracy, timestamp, and location context to show a site on a map or add optional GPS evidence to a report photo. Addresses or coordinates used for maps, place search, geocoding, weather, or static-map output may be sent to the relevant mapping service.

InfraSynex Inspect does not implement continuous background location tracking.

Audio information

When you deliberately record a voice note, the app processes the recording and may store or synchronise it as report evidence.

Device, local, and service information

  • Device and operating-system type, app version, network state, configuration, session and app-integrity identifiers, subscription SDK identifier, and background-job state.
  • Local reports, media, cached exports, preferences, encryption-backed tokens, and synchronisation queues needed for offline operation.
  • Privacy-filtered operational and security events used to diagnose failures, prevent abuse, reconcile synchronisation, process deletion, and protect the service.

We do not use inspection content for targeted advertising. At the date of this Policy, the app does not include a third-party advertising or general-purpose analytics SDK. On-device defect model processing does not by itself send a photo to a third-party artificial-intelligence service; a photo is transmitted only when you use a separate cloud, sharing, or support function that requires it.

Support and communications

We collect messages, attachments, contact details, account-deletion requests, and correspondence you send to support, billing, or privacy contacts.

How information is collected

We collect information:

  • directly from you when you create an account, enter details, create or import inspection content, grant a collaborator access, make a purchase, or contact us;
  • from your device when you choose a feature such as camera capture, photo selection, foreground location, audio recording, file import, or background synchronisation;
  • from a workspace owner or organisation administrator that provisions or manages your account;
  • from authentication, app-store, subscription, billing, mapping, app-integrity, and email-delivery providers; and
  • automatically from service operations, including synchronisation, export, security, and deletion events.

Why we process information

We process information where reasonably necessary to:

  • create, authenticate, secure, and administer accounts and organisations;
  • provide offline inspection capture, cloud backup and synchronisation, collaboration, review, report generation, export, restore, and sharing;
  • provide maps, optional GPS evidence, voice notes, and other features you deliberately invoke;
  • verify purchases, provide subscription entitlements, administer organisation seats, and maintain transaction records;
  • respond to support, privacy, correction, and deletion requests;
  • monitor service integrity, investigate security incidents, prevent fraud and abuse, and enforce access controls;
  • comply with applicable law, accounting duties, court or regulatory requests, and our agreements; and
  • improve reliability and usability using appropriately minimised operational information.

Where another law requires a particular legal basis, we may rely on performance of a contract, a legitimate interest, consent, or compliance with law as applicable. A device permission lets the operating system provide the selected capability; it is not consent to unrelated collection, marketing, or disclosure. You can withdraw a device permission in system settings, but this does not affect processing already lawfully completed.

Device permissions and user choices

The app requests protected device access only from the related user action:

  • Camera when you choose to take an inspection photo.
  • Photo library when you choose an existing image or save inspection photos to your gallery.
  • Foreground location when you choose a map, current-location, or optional GPS-evidence workflow.
  • Microphone while you record an audio note.

Android uses system pickers for occasional photo and file selection instead of broad photo-library read access. The app does not request background or always-location access. You can deny or later revoke a permission; unrelated inspection functions should remain available, although the selected feature may not work.

Local storage, cloud storage, and exports

Reports and attachments may exist locally, in the cloud, or in both locations. Local copies support offline capture and may remain until you remove them, clear app storage, or uninstall the app. Reinstalling or deleting a cloud account does not delete exports, photos saved to your gallery, files shared with others, or copies retained on another device.

Cloud-enabled information may include profiles, organisations, reports, photos, attachments, signatures, audio, synchronisation and review records, generated exports, entitlements, and audit records. Some plans or workflows may remain local-only until you choose or become eligible to synchronise them.

When you create a share link or send an export, anyone who receives the link or file may copy or redistribute it. Review recipients and content before sharing, and revoke access where the product offers that control.

Service providers and disclosures

We do not sell personal information. We disclose the minimum information needed for the following recipients and purposes:

  • Google Cloud and Firebase: authentication, app integrity, database, file storage, Cloud Functions, Cloud Run export processing, task queues, hosting, security, and operational logs. This may include account identifiers and cloud-enabled inspection content.
  • Google Maps Platform: maps, place/address search, geocoding, location context, weather-related location requests, and static map images. Queries may include an address, coordinates, IP address, and device/service metadata.
  • RevenueCat: app user identifier, app/store information, purchases, subscription status, product, entitlement, and renewal information used to administer mobile subscriptions.
  • Apple App Store and Google Play: app distribution, purchases, refunds, subscription management, device/platform services, and store compliance. The store handles payment credentials under its own notice.
  • Stripe: individual web billing and organisation billing, checkout, customer portal, quotes, invoices, subscriptions, refunds, and fraud prevention. Stripe handles payment credentials; we receive limited billing and status records.
  • Authentication and device-platform providers: federated sign-in, phone verification, multi-factor authentication, app integrity, photo selection, and other operating-system services you select.
  • Email delivery provider: delivery of verification, account, invitation, billing, support, and security messages. The provider receives recipient details and message content.
  • Workspace owners, organisation administrators, and authorised collaborators: access to reports, profile/workspace details, activity, and files their role permits.
  • People you choose to share with: reports, exports, attachments, links, and associated personal information you deliberately distribute.
  • Professional advisers, regulators, courts, law enforcement, and transaction counterparties: legal advice, insurance, audit, compliance, lawful requests, protection of rights and safety, or a business transaction subject to appropriate safeguards.

Each service provider may also process technical information such as IP address, device information, cookies, fraud signals, and service logs under its own privacy notice. We require providers to handle information for contracted purposes and assess access and security controls appropriate to the service.

Overseas processing and disclosure

InfraSynex is based in Australia. At the date of this Policy, the primary Firestore database is located in Australia, and the report export worker uses an Australian region. Firebase file storage and most Firebase Functions use United States regions. RevenueCat, Stripe, Apple, Google, and email or support providers may process information in the United States and in other countries where they or their subprocessors operate. A collaborator, client, or organisation you select may also access shared information from another country.

The likely countries for overseas processing include the United States and countries in which a selected customer organisation, collaborator, app store, identity provider, or contracted subprocessor operates. Provider locations can change. Before publication and during provider reviews, InfraSynex maintains a processor register recording the contracted provider, service, data categories, and available location commitments.

Where the Australian Privacy Principles apply to an overseas disclosure, we take reasonable steps appropriate to the circumstances to require suitable handling and safeguards. Information may also be subject to lawful access under the laws of a country where it is processed.

Retention and deletion

We do not intend to keep personal information indefinitely. The current service retention schedule is:

  • Active accounts, profiles, organisations, and cloud reports: retained while the account/workspace is active and the information is needed to provide the service, unless the authorised owner deletes it or a contract or law requires a different period.
  • Reports moved to cloud deletion: recoverable for 30 days, then scheduled for hard deletion with associated cloud files.
  • Generated cloud exports and export share records: scheduled to expire after 7 days. Recipients may retain copies already downloaded or shared.
  • Completed account-deletion request metadata: retained for up to 90 days after completion to evidence and troubleshoot the deletion lifecycle, then purged.
  • Routine application logs: the current default Cloud Logging bucket expires entries after 30 days. Production logs are privacy filtered and are not the authoritative report record.
  • Required cloud audit logs: the provider-managed required audit bucket is locked at 400 days. Application content must not be intentionally placed in those audit fields.
  • Backup or disaster-recovery remnants: where present, isolated residual copies may take up to 90 days to age out of routine recovery cycles and are not restored for ordinary use after an accepted deletion, unless retention is legally required.
  • Billing, tax, fraud, dispute, and legal records: retained for the period required by applicable law or reasonably needed to establish or defend legal rights. Payment providers may retain their own records under their policies.
  • Support and privacy correspondence: retained while needed to resolve the request, maintain necessary business records, or meet legal and security obligations, then deleted or de-identified.
  • Local app data, device gallery files, and downloaded exports: controlled by the device user and retained until removed from the device, gallery, backup, recipient system, or file location.

Organisation-controlled information may be retained or deleted under the customer agreement and the organisation's lawful instructions. A legal hold, security investigation, accounting obligation, or unresolved dispute may delay deletion of the minimum necessary record. When information is no longer needed, we take reasonable steps to delete, de-identify, or put it beyond use as appropriate.

Account and report deletion

Report owners can place supported cloud reports into a 30-day recovery period before hard deletion. Account deletion can be initiated in the app or through the verified support process described at InfraSynex Inspect Account Deletion.

An accepted in-app account-deletion request first disables further account access, then runs a retryable server-owned cleanup of solely owned cloud data. An organisation's only administrator must transfer administration or close the organisation first. Organisation-controlled records, financial records, security evidence, files held by collaborators, local files, and previously distributed exports may remain as described above. Deleting an account does not automatically cancel Apple, Google Play, Stripe, or organisation billing.

Security and data incidents

We use administrative, technical, and organisational safeguards designed for the nature of the information, including authentication, role-based access, Firebase security rules, app-integrity controls, restricted storage paths, encrypted transport, privacy-filtered production logging, and deletion workflows. Access to production systems is limited according to operational need and is subject to review.

No transmission or storage system is completely secure. If a suspected data incident occurs, we investigate, contain, preserve only necessary evidence, and assess notification obligations, including the Australian Notifiable Data Breaches scheme where applicable.

Access, correction, deletion, and choices

Subject to applicable law and the account structure, you may:

  • view or update profile details in the app;
  • request access to personal information we hold about you;
  • request correction of information that is inaccurate, out of date, incomplete, irrelevant, or misleading;
  • request deletion of an individually controlled account or information;
  • manage device permissions and subscription settings; and
  • complain about how personal information has been handled.

Contact support@infrasynex.com with the subject Privacy Request. Describe the request and the account or workspace involved. We may need to verify your identity and authority before providing access, correction, or deletion. We will not ask you to send your password.

If another organisation controls the requested workspace record, we may refer the request to that organisation. We may refuse or limit a request where the law permits or requires it and will explain the reason and available complaint options where required.

Privacy complaints

Send a privacy complaint to support@infrasynex.com with the subject Privacy Complaint and enough detail for us to investigate. We aim to acknowledge it promptly and provide an outcome within 30 days. If we need more time, we will explain why and give an updated timeframe.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner, subject to its jurisdiction and process. You may also have the right to contact another local privacy or data-protection authority.

Children

InfraSynex Inspect is a professional and business service and is not directed to children. It is not intended for independent use by anyone under 16. Do not upload personal information about a child unless it is necessary and lawful for the inspection and appropriate safeguards and authority are in place.

Changes to this Policy

We may update this Policy when product features, providers, laws, or handling practices change. We will publish the revised version and effective date here. For a material change, we will provide additional notice where reasonably practicable or legally required. The current policy version is dated August 3, 2026.

Contact us

InfraSynex Pty Ltd