Privacy Policy

Information we collect

Account information: name, email address, agency name, role and password hash. Billing information: plan, subscription status and the Stripe customer and account identifiers. We never receive or store full card numbers.

Project information: project names, origin addresses, encrypted origin credentials, published versions, review links, feedback notes, attachments, replies, approvals and receipts.

Technical information: IP address, user agent, timestamps, request and security events, and the email delivery events needed to confirm verification, reset and invitation messages.

How we use it

To provide and secure the service, authenticate users, apply plan limits, process subscription payments, deliver transactional email, produce approval records, respond to support requests and comply with legal obligations.

We do not sell personal information and we do not use client review content to train machine-learning models.

Reviewers

A client reviewer is invited by an agency. In that relationship the agency decides what is collected and why; we process the information on the agency's instructions. Reviewers should contact the agency that invited them in the first instance.

Providers we rely on

We use specialist providers to run the service: Vercel for application hosting, content delivery and attachment storage, Neon for managed PostgreSQL hosting, Stripe for subscription billing and connected-account payments, Resend for transactional email delivery, GitHub for scheduled snapshot capture and attachment scanning.

Project data is held in a Neon PostgreSQL database and attachments in Vercel Blob storage, both in the region configured for the service; the current regions are available on request.

Some of these providers store or process information outside Australia. Where that happens we take reasonable steps to ensure comparable protection, including contractual data-protection commitments.

Retention

Account and project records are kept while the subscription is active. After termination they are kept for thirty days in a read-only state, then deleted or anonymised, except where we must retain them for legal, tax or dispute-resolution reasons.

Approval records and receipts may be retained for longer as evidence of the review process, because that is what they exist to prove.

Security

Tenant data is separated by database row-level security, review links are hashed and revocable, origin credentials are encrypted at rest, attachments are scanned before they can be downloaded, and access to production systems is restricted to the people who need it.

No system is perfectly secure. If a data breach is likely to cause serious harm we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

Cookies

We use cookies that are necessary for the service: session cookies for agency users, reviewer session cookies for review links, and the proxy state needed to display a reviewed site. We do not use advertising cookies.

Browser extension

The optional Approvela browser extension only works after a reviewer connects it from their review. It then stores a connection token for that review in the browser, and nothing else.

When the reviewer presses Send, the extension sends Approvela their note, the address of the page they are on, the size and scroll position of the window and the browser name. A screenshot of the visible part of the page is also sent unless the reviewer unticks it. The extension sends nothing until the reviewer presses Send, does not track browsing, and does not read other tabs or other sites.

Notes and screenshots sent through the extension become part of the review and are handled like any other review content under this policy.

Your choices

You may request access to, or correction of, your personal information, or ask us to delete it, by contacting privacy@approvela.com. We will respond within a reasonable period and, where applicable law gives you further rights such as portability or objection, we will honour them.

If you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

We will publish any change to this policy here and update the date shown at the top of the page. The current version was published on 10 October 2026.

Contact

Sam William Leverenz (ABN 19 624 756 890). The registered business address is available on request.

Privacy: privacy@approvela.com · Security: security@approvela.com · Support: support@approvela.com