Privacy notice

This notice explains what personal data [اسم المشغّل], [العنوان البريدي] ("we", "us") collects when you use Intact Apps (NDT Intact, Weld Intra, NDT Interval, NDT Insonify, NDT Infer, Intact QA, Intact Plant, Intact Valves), used through one account at intactapps.com, and what we do with it. You can reach us about it at [email protected].

1. Two roles

1.1 Data your organisation puts into the service (reports, files, registers, requests, timesheets, its clients' people, everything in section 1.7 of the terms): your organisation decides why and how it is processed and is the controller. We process it only on its behalf, as its processor, under the data processing agreement that is part of our terms. If you want to know what an organisation holds about you, or to have it corrected or removed, ask the organisation; where you ask us, we pass your request on to it.

1.2 Account data, sign-in records, the waiting list, support correspondence and the data this notice describes below: we decide, we are the controller, and this notice applies directly.

2. What we collect

2.1 Your account: your name, email address, your password as a one-way hash, your language, your two-factor settings, and your phone number if you add one. One account opens every application of the family you have access to.

2.2 Sign-in records: the time, IP address and browser of each sign-in, failed sign-in and sign-out, and of each change to your password or second factor; and, for the desktop application, the device you signed in from and when you added or removed it. You and our platform administrators can see them. An organisation you work for cannot.

2.3 Organisation activity: an audit log in each organisation of signing, reviewing, issuing, withdrawals, downloads, share links, permission changes, client acceptances, entering a workspace, and the other events the terms describe, each with the person, the time and the IP address. The organisation's owners and admins can see it. It cannot be edited or deleted, because the issued documents depend on it.

2.4 What you leave with us: the name, email address, company, role and message you leave on the waiting list or an invitation form; the emails you send to our support and contact addresses; and the content of a bug report you choose to send.

2.5 Billing: which plan an organisation has, when it started, renewed and ended, and Paddle's identifiers for the subscription and its payments. Payment card details are given to Paddle and never reach us.

2.6 Technical records: server logs with the address, time and page of each request, kept for security and troubleshooting; and error reports, which carry identifiers of the record and the request concerned but never names, addresses, or the content of a report.

2.7 Customer content: whatever your organisation enters or uploads, which we hold for it as section 1.1 says.

3. Why, and on what basis

3.1 To provide the service you asked for (the contract between us): to open and secure your account, to sign you in to each application, to run your organisation's work, to send the emails the service needs (invitations, notifications about reports and messages, confirmation of your address, a new password), to give support, and to bill through Paddle.

3.2 To keep the service secure and working (our legitimate interest, which we judge not to be outweighed by yours): sign-in records, the audit log, server logs, error reports, protection against attacks and abuse, and backups.

3.3 To keep the records the law and issued documents require (our legal obligations and our and our customers' legitimate interest): who signed, reviewed and issued what, and when; billing records; records of consent to these terms.

3.4 To answer you and to tell you about the service (our legitimate interest, or your consent where we ask for it): the waiting list, invitation forms and support. We send no marketing email you have not asked for, and every such email has a way to stop them.

3.5 With your consent, where the law of your country makes consent the basis: by creating an account and accepting our terms you consent to the processing this notice describes, including the storage of your data in the hosting regions in section 6; you may withdraw that consent by closing your account, as section 7 says.

4. Who else handles it

4.1 Our sub-processors: the providers that host the application, store its files and backups, send its emails and collect its error reports, each bound to us by a data processing agreement and listed, with where they keep the data, on our sub-processors page. We tell organisations before we add or replace one.

4.2 Vultr, only for organisations that have switched AI features on, and only for the documents and text a person chooses to submit for a draft. It does not use them to train models.

4.3 Paddle, our merchant of record, which sells subscriptions in its own name and handles your payment details under its own privacy notice.

4.4 Your organisation and your clients: the people in your organisation see what its roles allow; a client sees what your organisation shares with it through its portal; a verification page shows a report's number, revision, the issuing organisation's name, its issue date and status to anyone holding its PDF.

4.5 Authorities and others when the law requires: we disclose data when a law, a court order or a lawful request of an authority requires it, after checking it is valid, and to establish or defend a legal claim. We tell the people concerned where the law allows.

4.6 A successor: if our business is transferred, the data goes with it on this notice, and we tell account holders.

We do not sell personal data, and we do not share it with advertisers.

5. Security

5.1 Organisations are kept apart in the application and the database, and every feature is tested to prove one cannot reach another's data. Connections are encrypted. Files are stored in private storage and reached only through links that expire after five minutes; every download is recorded. Passwords are hashed and must be at least twelve characters and not known from a breach; two-factor sign-in is available to everyone and can be required by an organisation. The activity log cannot be edited. Backups are encrypted. Uploads are scanned for malicious software. Our own access to production is limited to named administrators with two-factor sign-in and is logged.

5.2 No system is perfectly secure. If a breach affects your personal data, we tell the organisations concerned without undue delay and, where the law requires, you and the supervisory authority.

6. Where the data is

6.1 An organisation chooses its hosting region when it is created: Europe (Amsterdam, the default), North America (New York) or Asia (Singapore). Its files, scan data, drawings, PDFs and backups of them stay in that region. The records database, account data and the application run in Europe. Emails are sent from the European Union, and error reports are kept there. Our sub-processors page says where each provider keeps data.

6.2 We are established in the Republic of Kazakhstan, and some of our providers are established outside the European Economic Area. Where data protection law regards this as a transfer, we rely on the European Commission's standard contractual clauses, on an adequacy decision where one exists, or on another lawful mechanism, as our data processing agreement sets out, and on your consent where the law of your country asks for it.

7. How long

7.1 Your account: as long as it is open. You may close it on your account page at any time; it closes in every application. For thirty days we can reopen it at your request. Then it is anonymised: your name, email address, phone, password and second factor are removed. The record itself stays, so that signatures, reviews, audit entries and sign-in records still point at someone; a name recorded inside an issued report or an audit entry stays as it was, because those are the issuing organisation's business records.

7.2 Sign-in records and device records: as long as your account exists, for your security and ours; they cannot be edited, and when your account is anonymised they no longer point to a named person.

7.3 Organisation activity: as long as the organisation exists; when it closes, as the terms say (ninety days to reopen, deletion within thirty days after that, keeping only the verification record of each issued report).

7.4 The waiting list and invitation forms: until the account they led to is made, or twelve months after our last contact with you, whichever is first. Support correspondence: two years after the matter closed.

7.5 Billing records: as long as the law on accounting and tax requires, from the end of the subscription.

7.6 Server logs: a short time, for troubleshooting and security, and never more than ninety days. Error reports: ninety days.

7.7 Backups: deleted data leaves our backups as they are rotated, within ninety days.

7.8 Customer content: for your organisation to decide, within what the terms say about a closed organisation.

8. Cookies and what your browser keeps

8.1 We use only what the service needs: a session cookie while you are signed in; a security token against forged requests; a cookie that remembers that this browser signed in to an application, for a year, so that you are signed in quietly across the family; your choice of language; and, in your browser's own storage, your choice of light or dark appearance and, while you draft offline, your unsent work. The desktop application keeps a copy of your organisations' data on your computer for working offline, and the backups it makes go where you tell it. We use no advertising or tracking cookies and no analytics that profile you.

9. Your rights

9.1 You may ask us to show you the personal data we hold about you as controller, to correct it, to delete it (as far as section 7 allows), to restrict or object to its processing, to give it to you in a portable form, and to withdraw a consent you gave; and you may complain to a supervisory authority: in Kazakhstan, the authorised body for personal data protection; in the European Union, the authority of the country where you live or work; elsewhere, your national authority. Write to [email protected]; we answer within one month, and we may ask you to confirm who you are. Where the data belongs to an organisation's records (section 1.1), we pass your request to the organisation and help it answer.

9.2 Your own sign-in history, your own hours and pay where you can see them, and your own work log can be downloaded by you from the application before you close your account.

10. Children

10.1 The service is for business use by adults. We do not knowingly collect data from anyone under eighteen; if you believe we have, write to [email protected] and we will delete it.

11. Changes

11.1 We publish changes to this notice here, with the date of the current version, and tell account holders by email about a material change before it takes effect.

12. Contact

[اسم المشغّل], [العنوان البريدي]. Write to [email protected].

Last changed: 18 October 2026.