Privacy Policy

ThermalVariations is operated by Bailey Holdsworth trading as ThermalVariations, ABN 29 813 854 114, Queensland, Australia ("we", "us", "our"). We provide automated thermal fault detection for solar assets (the "Service"). We are committed to protecting your privacy and handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what we collect, why we collect it, how it is stored, and your rights.

1. Information we collect

• Account information. Your email address and authentication identifiers, managed through AWS Cognito. We never see or store your password.
• Inspection data. Job names, site labels, panel counts and the aerial thermal imagery you upload.
• Payment information. Payments are processed by Stripe. We do not collect, store or have access to your full card details. We retain records of invoices and payment status.
• Technical data. Standard server logs (IP address, browser type, timestamps) used for security monitoring and service operation.

2. How we use your information

• To provide the Service: processing your imagery, generating fault reports and managing your account.
• To process payments and issue invoices.
• To secure the Service, detect abuse and meet legal obligations.
• To communicate with you about your inspections, your account and service updates.

We do not sell your data. We do not share your imagery with other customers. Your imagery is not used to train models shared with other customers.

3. Storage, processing and security

• Australian data storage. All uploaded imagery and generated reports are stored in Amazon S3 in the AWS Asia Pacific (Sydney) region (ap-southeast-2), Australia. Authentication is handled by AWS Cognito in the same region.
• Where processing happens. Automated analysis runs on our application platform (Render) and the web tier runs on Vercel, which may execute outside Australia depending on provider region. Our database is hosted by Neon. Imagery is transferred over TLS, processed in memory, and the source of record remains the Sydney S3 bucket. The full sub-processor list with locations is in section 4.
• Imagery is encrypted in transit (TLS) and at rest with AWS S3 server-side encryption (AES-256).
• Data is logically isolated per customer. Access is restricted to your authenticated account.
• Report downloads use short-lived signed links that expire automatically.
• Authentication is handled by AWS Cognito with industry-standard token security.

No method of transmission or storage is completely secure. While we apply commercially reasonable safeguards, we cannot guarantee absolute security. If we become aware of a data breach that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

4. Third-party services

We rely on a small number of sub-processors to operate the Service:

• Amazon Web Services (imagery and report storage in S3; authentication in Cognito). Sydney region, Australia.
• Render (application platform that runs the API and the automated analysis worker). Region set by the provider; may be outside Australia.
• Neon (managed Postgres database holding account, job, site and finding records). Region set by the provider; may be outside Australia.
• Vercel (web application hosting and delivery). Web functions are configured for the Sydney region; the global edge network terminates requests worldwide.
• Cloudflare (TLS termination and proxying of API traffic). Global edge network.
• Stripe (payment processing). See the Stripe privacy policy for how they handle payment data.

Where a sub-processor executes outside Australia, we take reasonable steps to ensure it handles your information consistently with the APPs, including contractual data-processing terms. We will update this list and the date at the top of this page before we add or replace a sub-processor that handles your imagery or personal information; if you hold an active account we will also notify you by email.

5. Retention and deletion

Raw imagery is archived 30 days after upload and deleted about 13 months after upload unless you ask us to keep or delete it sooner. Reports are retained while your account is active so you can revisit past inspections. You may request deletion of your imagery, reports or entire account at any time by contacting us. We will action deletion requests within 30 days, except where we are required to retain records for legal, tax or accounting purposes.

6. Your rights

You may at any time:

• Request access to the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your data (subject to legal retention requirements).
• Request a copy of your imagery and reports.
• Complain about our handling of your information.

To exercise any of these rights, contact us at support@thermalvariations.com. If you are not satisfied with our response, you may lodge a complaint with the OAIC at oaic.gov.au.

7. Cookies and analytics

We use first-party cookies only: session cookies to keep you signed in; a short-lived security cookie used during sign-in to prevent cross-site request forgery; and, if you arrive from a campaign link or another website, a first-party attribution cookie (90 days) that records the campaign tags and referring page so we can attribute an enquiry you later send us. That cookie is not shared with anyone and is only read when you submit a form. We do not use advertising or cross-site tracking cookies.

Page-view and form-submission counts are measured with Vercel Web Analytics, which is cookieless and does not identify individual visitors. If you submit an enquiry form we store the details you enter, together with the attribution above, so we can reply.

8. Changes to this policy

We may update this policy from time to time. Material changes will be flagged on this page with an updated date. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

9. Contact

Questions about this policy or our data practices: support@thermalvariations.com