← Back to site

Privacy Policy

Effective date: 8 September 2026

This Policy explains how Propagio Pty Ltd ACN 701 978 930 (ABN 68 701 978 930) (“Propagio”, “we”) handles personal information when you use Propagio. We comply with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), and, where it applies, the EU/UK GDPR.

1. Information we collect

  • Account and organisation: name, email, role, organisation details.
  • Project content: renders, images, films, PDFs, comments, and files you upload, plus the email addresses of clients you invite.
  • Usage and technical: log data, device/browser, IP address, and activity within the Service.
  • Payment: processed by Paddle; we receive limited billing metadata (plan, status, country), not full card details.

2. How we use it

To provide and secure the Service, manage accounts and billing, send service and activity notifications, respond to support, detect and prevent unlawful content and abuse (uploads may be scanned, including with third-party tools), meet legal obligations, and improve the product. We do not sell your personal information.

3. Legal bases (GDPR)

Where the GDPR applies, we rely on: performance of a contract (providing the Service), legitimate interests (security, product improvement), consent (where required), and legal obligation.

4. Sharing and sub-processors

We share data with service providers who process it on our behalf under contract, including:

  • Paddle: your name, email address and card details. The card never reaches Propagio.
  • Amazon Web Services: logins, project data, every email we send including its address, subject and body, the nightly file backup, and the logs.
  • DigitalOcean: every file you upload, and the image service that makes thumbnails and previews.
  • Cloudflare: requests for thumbnails and previews.
  • Resend: the name and email address typed into the join form on this website.
  • Google Fonts: our pages load a typeface from Google, so Google receives your IP address.

We may also disclose information where required by law.

5. Where your data is stored

Every file you upload is stored on DigitalOcean Spaces in Sydney, Australia. Thumbnails and previews are made and served by an image service on DigitalOcean at img.propag.io, which answers through Cloudflare's network. Project data (projects, comments, approvals and user records) and logins are held with Amazon Web Services in Sydney. A nightly backup copy of your files is also kept in Australia, on Amazon S3 in Sydney. Some providers, such as Paddle, may process data overseas; where personal information is transferred internationally we take reasonable steps to ensure appropriate protection.

6. Cookies

We use essential cookies/local storage to keep you signed in and remember preferences. We keep non-essential tracking to a minimum and will seek consent where required.

7. How long we keep things

Project content. Renders, films, PDFs, comments and annotations follow the project. A project is live for six months. When that ends you can archive it, which keeps it readable for a further six months at no charge. At the end of that we give you eight days’ notice and then delete it permanently. Paying at any point starts a fresh six months. This is the same period stated in our Terms of Service.

Your account. We keep your name, email address and role for as long as your account is open. If you close your account, or your studio removes you, we delete or de-identify those details within ninety days, except where we are required to keep them for the reasons below.

Invitations that are never accepted. We delete the email address within ninety days of the invitation expiring.

Billing records. Payments are taken by Paddle, who are the seller of record and hold the payment details themselves. We keep our own record of what was bought and when for as long as Australian tax law requires, which is generally five years. These records are kept even after the related project has been deleted, and they contain no payment card details.

Backups. Deleting something removes it from the live service straight away. A copy can remain in our nightly backup after that. The backup keeps files rather than removing them, and where a file has been replaced the older version is dropped after ninety days. We are deciding how long backup copies should be held and will state a period here once it is settled. We do not restore deleted content from a backup at a customer's request.

Logs. Server logs are kept 90 days. The API access log, which records the IP address and browser, is kept 14 days. The AWS account activity log is kept 14 days, and 90 days in its storage bucket. The sign-in firewall log is kept 14 days.

Deleting an account. When an account is deleted we delete the login and the user record. The person's name becomes "Deleted user" in every project of their own company and of every company they visited. Every share link they made is revoked, and their notices and guest memberships are removed. A copy of files they uploaded stays in the backup, as described above.

Why we delete at all. Australian Privacy Principle 11.2 requires us to destroy or de-identify personal information once we no longer need it. Holding your work indefinitely would not meet that obligation, so the periods above are deliberate rather than a limitation of the Service.

8. Security

We use access controls, encryption in transit, private storage with signed URLs, and role-based permissions. No system is perfectly secure, but we work to protect your information.

If personal information is exposed we assess it within 7 days, and never later than 30, and report a notifiable breach to the Office of the Australian Information Commissioner (OAIC) and to the people affected.

9. Your rights

You may request access to or correction of your personal information, and (where applicable) deletion or restriction. To exercise these, or to complain, contact legal@propag.io. You may also complain to the Office of the Australian Information Commissioner (OAIC), or your local regulator under GDPR.

10. Children

The Service is for business use and is not directed at children.

11. Changes

We may update this Policy; material changes will be notified. The effective date is shown below.

12. Contact

Privacy enquiries: legal@propag.io. General support: help@propag.io, Monday to Friday, 7am to 7pm AWST (Perth). Propagio Pty Ltd ACN 701 978 930, ABN 68 701 978 930.