Inerture - Privacy Policy (closed alpha)

Closed alpha. This policy is in force for the closed alpha. It has not been legally reviewed.

Last updated: 2026-10-30 Version: 0.4

1. About this policy

1.1 This Privacy Policy explains how Inerture, a partnership (ABN 35 110 646 360) (we, our, us), collects, uses, discloses, and protects personal information in connection with the Inerture website at inerture.com, the App Portal and hosted Products at inerture.app, the Inerture mobile apps, and the Products listed in the EULA Schedule 1 (together, the Service).

1.2 Inerture is committed to handling personal information in accordance with the Australian Privacy Principles (APPs) set out in the Privacy Act 1988 (Cth). Although Inerture may currently fall under the small-business exemption in the Privacy Act, Inerture holds itself to APP-compliant practice as a policy choice - recognising the phased removal of the exemption and the trust expectations of professional users.

1.3 If you are located in the European Union or the United Kingdom, Inerture acts as a data controller for the personal information it determines the purposes and means of processing, and may act as a processor for User Content.

1.4 This policy operates alongside the Cookie Policy, the Terms of Service, and the EULA.

2. What personal information we collect

We collect personal information directly from you, automatically through your use of the Service, and in limited circumstances from third parties.

2.1 Information you provide

• Account details: your name, email address, and any professional identifiers you choose to provide (for example, your engineering registration number, firm, or role).
• Support and correspondence: the contents of messages you send us, including screenshots, attachments, and model files submitted with a support request.
• Waitlist submissions: email address and any other details you volunteer when joining the waitlist.

2.2 User Content

• Project data: structural models, sections, load cases, load combinations, custom materials, uploaded figures and PDFs, workflow YAMLs, and generated reports - collectively, User Content - submitted to or created within the Service.

User Content is the User's information, owned by the User. Inerture holds it under the licence described in clause 7.3 of the EULA. User Content may contain personal information about individuals other than the User (for example, project names, client names, addresses, or signatories on reports). The User is responsible for ensuring that the User has the right to submit that information to the Service.

2.3 Information we collect automatically

• Technical data: IP address, browser type, device type, operating system, screen resolution, referrer URL, preferred language, time zone.
• Usage data: Products accessed, features invoked, session length, navigation patterns, feature interactions, search terms within the Service.
• Diagnostic and error data: error logs, crash reports, performance metrics, stack traces.
• Session recordings: during pre-release (alpha/beta) programmes, recordings of your in-Product sessions (the interface as displayed to you, your interactions, and your edits, including model and document changes) are captured to Inerture's own self-hosted infrastructure for debugging and product improvement. Typed form values may be captured inside the engineering Products; password and login fields are always masked. Recordings are deleted after 12 months by periodic deletion processes, are not shared outside Inerture, and are never sold.
• Identifiers: session cookies, authentication tokens, and analytics identifiers (see the Cookie Policy).
• Signed-in session record: your browser name and major version, operating system family, device type (desktop, mobile or tablet), and IP address, recorded when you sign in. We do not keep the raw browser user agent in this record.
• Acceptance records: your account identifier, the accepted terms version, the acceptance timestamp, your IP address, and your browser's user agent.

2.4 Information from third parties

Inerture does not currently enrich the information you provide with data from brokers or social platforms. If that changes, this policy will be updated.

2.5 Mobile apps

The Inerture mobile apps keep your work on your device. They contain no advertising, no tracking, and no third-party analytics.

• On the device: what you create with an app - including anything from device features you allow it to use, such as the camera or your location - stays on your device unless you export or share it, and is not sent to Inerture.
• What you send us: problem reports and emails you choose to send from an app (for example app logs, the app version and device model, and any scans, designs or photos you attach).
• Beta testing: where you test an app through Apple's TestFlight, Apple shares with Inerture the crash logs, usage information, and feedback it collects, and your name and email address if you were invited by email.
• Apple services: some features use services provided by Apple, such as maps, which are covered by Apple's privacy policy.

3. How we use personal information

We use personal information to:

• provide, operate, and secure the Service;
• authenticate users and manage accounts;
• show you where you are signed in, let you sign a device out, enforce the two-session limit, and help keep your account secure;
• respond to support requests and communicate about the Service;
• contact waitlist subscribers about access to the alpha programme;
• deliver administrative messages (service-status updates, security notifications, policy changes);
• send marketing communications only where you have separately opted in (you can opt out at any time);
• monitor, debug, and improve the Service (including aggregated usage analytics);
• comply with Applicable Law, respond to lawful requests from regulators or law enforcement, and enforce our Terms; and
• protect the rights, property, and safety of Inerture, our users, and the public.

We do not:

• sell personal information;
• sell User Content; or
• share personal information or User Content with third-party advertisers for their own marketing.

Inerture's broader rights to use User Content (including for service operation, product improvement, analytics, and AI/ML model training) are set out in clause 7.5 of the EULA. The User and Inerture may agree in writing to narrow or vary those rights (for example in an enterprise agreement).

4. When we share personal information

We share personal information only in these circumstances:

4.1 With service providers (subprocessors)

We use the following services as at 2026-10-20. Self-hosted services run on Inerture-operated hardware and do not introduce a third-party processor. External providers process the information necessary to deliver their services; overseas handling is described in section 5.

The AI provider used depends on the app and feature. Section 10 explains the data sent. Payments and an external helpdesk are not used in the closed alpha. We will update this table when providers change.

4.2 With users' colleagues and collaborators

Where a user chooses to share a project, report, or workflow with another user, the shared content (including any personal information in it) is made available to the recipient under the recipient's own account.

4.3 For legal reasons

We may disclose personal information where required to comply with a subpoena, court order, lawful request by a regulator or law-enforcement body, or where necessary to enforce our agreements or protect our rights, property, or safety.

4.4 In a business transfer

In the event of a merger, acquisition, restructure, or sale of substantially all of our assets, personal information may be transferred to a successor entity. The successor will be required to comply with this policy (or a policy providing equivalent protections) in respect of personal information acquired.

5. Where we store personal information

5.1 Inerture's primary processing environment is located in Australia. Account data and User Content are hosted on Australian infrastructure.

5.2 AI assistant requests may be processed in the United States, the European Union (France), and Malaysia (Johor), as listed in section 4.1. Anthropic may also run inference in other countries, and Cloudflare operates globally, so the listed countries are not exhaustive for those providers. Before disclosing personal information overseas, Inerture takes reasonable steps under APP 8.1 to ensure the recipient handles it consistently with the APPs, including appropriate contractual safeguards. For EU/UK personal information, an applicable transfer mechanism is required.

5.3 Where personal information is processed outside Australia, the recipient's location is identified in the table in section 4.1.

6. How we keep personal information secure

6.1 Inerture applies technical and organisational measures to protect personal information, including:

• transport-level encryption (HTTPS/TLS 1.2+) for all connections;
• encryption at rest for databases and object storage;
• role-based access controls and the principle of least privilege for internal systems;
• secrets management using a dedicated secret store (not committed to source control);
• independent review of significant changes to authentication, authorisation, and data-handling code;
• logging and monitoring for anomalous access patterns; and
• periodic review of infrastructure and dependencies.

6.2 No system is perfectly secure. If we become aware of an eligible data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.

6.3 You are responsible for the security of your credentials, for timely logout on shared devices, and for reporting any suspected compromise to contact@inerture.com.

7. How long we keep personal information

7.1 We retain personal information only as long as reasonably required for:

• the purposes for which it was collected;
• the duration of the account or subscription;
• the period required to comply with Applicable Law (for example, tax records under applicable tax legislation); and
• any period reasonably required to respond to or resolve disputes.

7.2 User Content is retained while your account is active, and for at least 90 days after termination of your account to allow export, unless you request earlier deletion. After the export period User Content is deleted or de-identified.

7.3 Session replays, traces, AI assistant chat transcripts, and feedback including screenshots are deleted after 12 months by scheduled deletion processes. Deletion is periodic, not guaranteed on the exact day the retention period ends. Generic operational logs and metrics are retained for up to 30 days; system logs may have shorter retention.

7.4 PostgreSQL point-in-time backups are retained for 7 days. Data deleted from the live database may remain in those backups for that period before backup expiry.

7.5 Acceptance records, including your IP address, are kept while your account is active (including while suspended) and deleted when your access to that channel is removed.

7.6 Signed-in session records are deleted 30 days after the session's 30-day maximum ends. This is separate from the acceptance records described in clause 7.5.

8. Your rights

Under the APPs and this policy, you may:

• Access personal information we hold about you (APP 12).
• Correct personal information if it is inaccurate, out of date, incomplete, irrelevant, or misleading (APP 13).
• Delete personal information, subject to any legal obligation we have to retain it.
• Withdraw consent to marketing at any time via the unsubscribe link in any marketing message or by emailing contact@inerture.com.
• Export User Content in a standard format (each Product provides export of User Content to its unified schema; for account data and telemetry, contact contact@inerture.com).
• Complain to Inerture about how we have handled your personal information. We will respond within 30 days. If you are dissatisfied with our response, you may complain to the OAIC (see www.oaic.gov.au).

To make a request, email contact@inerture.com with sufficient detail for us to identify your account and the information in issue. We may need to verify your identity before acting on a request.

Residents of the European Union or the United Kingdom may have additional rights under GDPR / UK GDPR, including a right to data portability and a right to object to certain processing. Contact contact@inerture.com.

9. Cookies and tracking technologies

Details of the cookies and similar identifiers used on the Service are in the Cookie Policy.

Summary:

• Essential cookies (authentication, CSRF, load balancing) are used and cannot be disabled without disrupting the Service.
• Preference cookies record UI choices such as theme and language.
• Umami provides cookieless, aggregate analytics on Inerture-operated infrastructure in Australia. HyperDX provides self-hosted telemetry and session recording; see the Cookie Policy for identifiers and controls.
• Inerture does not currently use third-party marketing or advertising cookies.

10. Artificial intelligence features

10.1 The Service includes or may include AI-assisted features (for example, natural-language model generation, automated report-narrative drafting, workflow-building assistance).

10.2 Under clause 7.5 of the EULA, Inerture may use User Content to train, fine-tune, evaluate, test, and improve AI or machine-learning models used to provide, improve, or develop the Products. Where a feature is backed by a third-party model provider, that provider is identified in the table in section 4.1 and is engaged under confidentiality obligations consistent with this policy.

10.3 Inerture does not sell User Content, does not disclose User Content to third-party advertisers for their marketing, and does not publish User Content in a form that identifies the User except with consent or as required by law (see EULA clause 7.5(d)).

10.4 Aggregated, anonymised, or de-identified data derived from User Content may be used by Inerture for any lawful purpose, including industry benchmarks and product communications, in accordance with EULA clause 7.5(c).

10.5 Enterprise customers and other Users may negotiate in writing to narrow the AI-training scope in clause 7.5 (for example via a data-processing agreement). Where such a narrower agreement is in place, it prevails over this policy to the extent of any inconsistency.

AI assistant data handling

10.6 When you use the assistant, we process your prompts, conversation history, feedback, and the model or file excerpts the assistant reads. Tools may return project members' names and email addresses, which can form part of the conversation sent for inference. This information is used to answer requests, read models and files, propose or perform requested actions, and diagnose and improve the assistant.

10.7 Depending on the app and feature, inference uses Anthropic (Claude), OpenAI, Mistral AI (Ministral models) via OpenRouter as routing intermediary, GLM models (Z.ai/Zhipu) served by BytePlus ModelArk, or locally hosted open-weight models on Inerture-operated hardware. Their processing locations are listed in section 4.1. Locally hosted inference stays in Australia without a third-party model processor.

10.8 You can choose not to use the assistant; ordinary non-AI features do not require sending a prompt. Only share information you are authorised to disclose, including information tools can read from your project. To discuss a narrower AI-training licence, contact contact@inerture.com before submitting sensitive content (clause 10.5). Not using the assistant is not an opt-out from the separate User Content licence in EULA clause 7.5.

10.9 AI chat transcripts and assistant feedback, including screenshots, are deleted after 12 months by scheduled processes under clause 7.3. This policy does not promise that external providers never train on data; provider-specific data-use and retention terms must be considered alongside the licence in the EULA.

11. Children

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and you believe your child has provided us with personal information, contact contact@inerture.com and we will delete it.

12. Changes to this policy

12.1 We may update this policy from time to time. The "last updated" date at the top indicates the most recent version. Material changes take effect 30 days after notice (by email to registered users or by a prominent notice on the Service).

12.2 If you do not agree with a material change, your sole remedy is to close your account before the change takes effect.

13. Contact

If you have questions about this policy or about how we handle personal information:

Privacy Contact contact@inerture.com

Operator Inerture, a partnership (ABN 35 110 646 360)

Regulator Office of the Australian Information Commissioner www.oaic.gov.au | 1300 363 992