ACR Tech
Privacy Policy
This viewer is operated by ACR Technical Group Inc. (“ACR Tech”), Snow Lake, Manitoba, Canada. It is a private tool for viewing survey data we have captured for our clients. It is not open to the public and there is no way to create an account for yourself.
What we collect, and why
Your email address
This is the account. Signing in means proving you control an address that someone at ACR Tech, or at your own company, has already invited. We also store a display name when your sign-in provider gives us one, so that people managing a team can tell colleagues apart.
Sign-in records
For each active session we store the time it started, when it expires, when it was last used, and the browser and IP address it came from. The browser and IP are recorded so that you can look at your own sessions and recognise them — they are never used to decide whether to let someone in, because both are trivially forged.
We do not store passwords, because there are none. Session tokens and one-time sign-in codes are stored only as SHA-256 hashes, so a copy of our database is not a set of working logins.
An activity log
We record security-relevant events — signing in, signing out, invitations, role changes, capture deletions — with the time, the address that did it, and the IP address. This is what lets a company owner answer “who changed this, and when”. It is not analytics, and we do not use it to study how you use the viewer.
Your workspace
Marked points, saved sections and display preferences you create are stored against your account and are private to you. Other people at your company cannot see them. Some display preferences are also kept in your browser's local storage so the viewer looks the same next time.
Survey data
Point clouds, meshes, designs and alignments are uploaded by ACR Tech, not by you. They belong to the client they were captured for, and are visible only to people that client's account permits.
What we do not do
- No advertising, and no advertising or analytics trackers.
- No selling, renting or sharing of personal information.
- No profiling, and no automated decisions about you.
- No email from us except sign-in links and codes you asked for.
Cookies
Only cookies the viewer cannot work without:
- Session cookie — keeps you signed in. Contains a random secret and nothing about you. HttpOnly and Secure, so scripts cannot read it.
- Sign-in state cookie — exists for ten minutes during a Microsoft or Google sign-in, to prove the reply came back to the browser that started it.
- Share cookie — set when you open a share link, so you can view the one capture it grants.
There are no cookies for any other purpose.
Who else is involved
- Cloudflare hosts the viewer and stores its database and files.
- Microsoft or Google — only if you choose that button. They tell us the verified email address on the account and your name. We never see your password, and we ask for nothing else: not your files, not your contacts, not your calendar.
- Resend delivers sign-in emails when you use a magic link.
Each of these processes data on our behalf. None of them is given your survey data, and none is permitted to use anything for their own purposes.
Where it is held
Cloudflare is a global network, so data may be processed on servers outside Canada, including in the United States.
How long we keep it
- Sign-in codes and links: fifteen minutes, single use.
- Sessions: thirty days from last use, and removed when you sign out.
- Your account, workspace and the activity log: for as long as you have access, and afterwards while we need it for security and for our contract with the client. Ask and we will delete what we are not required to keep.
Your rights
Under Canadian privacy law you may ask what we hold about you, ask for it to be corrected, and ask for it to be deleted. Write to the address below and we will answer within thirty days. You may also complain to the Office of the Privacy Commissioner of Canada.
You can sign out of every device at any time from the account menu, which immediately invalidates every session.
Children
This is a professional tool. It is not directed at children and we do not knowingly create accounts for anyone under 18.
Changes
If we change this policy we will update the date at the top. Material changes will be told to account holders by email.
Contact
ACR Technical Group Inc., Snow Lake, Manitoba, Canada
awall@acrtech.ca