Terms of Use & Privacy Notice

This notice applies to anyone who creates an account on the S&A Data Services (SADS) client portal to view a project's schedule and, where granted, its 3D model. It does not apply to SADS staff, who use a separate internal system.

• Identity: first name, last name, email address.
• Credentials: your password, stored as a salted hash (scrypt) -- we cannot recover it, only verify it.
• Usage: sign-in times, which project pages and model versions you open, and downloads, kept as an activity log against your account.
• Technical: IP address and browser user agent at sign-in, for security and abuse prevention.

• To create and secure your account, and to tell you apart from other people on the same project.
• To show you only the projects and content a SADS project manager has actually granted you -- membership is per project, per person.
• To keep a record of who viewed or downloaded a model version, for attribution if a file is later found outside the portal.
• To detect and slow down abuse of the sign-in and sign-up forms (rate limiting, lockouts).

We do not use your data for marketing, and we do not build advertising profiles from it.

We do not sell or rent your data. It is processed by the infrastructure providers that run the portal on our behalf, acting as data processors under our instructions:

• Supabase -- database hosting (account records, activity log).
• Microsoft 365 / Graph -- sending you account emails (confirmation, password reset).
• Autodesk Platform Services -- rendering the 3D model in your browser, only for the project(s) you have model access to.

We disclose data beyond this only where required by Malaysian law, or with your separate consent.

• Passwords are hashed (scrypt), never stored or logged in plain text.
• Sessions use httpOnly, Secure cookies that client-side scripts cannot read.
• Repeated failed sign-ins are throttled with an increasing delay.
• A password that has appeared in a known public data breach is rejected at signup and at reset.
• Every model view, version open and download is logged against your account and the date.

We keep your account and activity log for as long as you have access to at least one project, and for a reasonable period afterwards for record-keeping and dispute purposes. You may ask us to delete your account at any time (see Section 8); we will do so unless we are required to retain specific records by law.

Your name is editable from My profile. Your email is the address your project access is matched against, so it is not self-service editable -- contact your SADS project manager to change it, and we will update the matching record at the same time.

You may, at any time:

• Ask what personal data we hold about you.
• Ask us to correct inaccurate data.
• Withdraw your consent and ask us to delete your account and associated data.
• Ask which projects your account currently has access to.

To exercise any of these, contact S&A Data Services through your usual project contact, or the email address on the portal's sign-in page.

• Access is personal to you -- do not share your password or session.
• Content viewed here (schedules, models) belongs to the project and its consultants. A downloaded model file (where that permission has been granted to you) may not be redistributed beyond your own organisation's use of the project.
• We may suspend or revoke access for misuse, including sharing credentials or attempting to access a project you are not a member of.

If we make a material change to what we collect or why, we will update the date at the top of this page and, where the change is significant, notify account holders by email.