Privacy Policy

1. About this policy and who we are

MAPLE Ascent™ is a vertical-transport (lift, escalator and moving-walk) SaaS platform operated by MAPLE Ascent Pty Ltd (referred to in this policy as “MAPLE Ascent”, “we”, “us” or “our”).

• Legal entity: MAPLE Ascent Pty Ltd
• ABN: 72 666 254 708
• Business address: Level 57, MLC Centre, 25 Martin Place, Sydney NSW 2000, Australia
• Contact: hello@mapleascent.com · +61 2 9238 2288

“MAPLE Ascent”, “the platform” or “the Services” means the mapleascent.com website and the tools and products offered through it, including the Traffic Studio and EnergyCalc Studio tools, the Andy AI assistant, the MAPLE Ascent Dashboard, the Maintenance Tenders service, and any account, licence or report services connected to them.

Elevator Project Management (“EPM”) is our affiliated lift consultancy. Some of the opportunity-related contact and business-development activity described in this policy is, with your consent, carried out by or shared with EPM (see Sections 6 and 8).

We are an APP entity under the Privacy Act 1988 (Cth) and we handle personal information in accordance with the Australian Privacy Principles (APPs). This policy explains, in an open and transparent way (APP 1), how we collect, hold, use, disclose, secure and dispose of personal information, and how you can access it, correct it, opt out of marketing, or make a complaint. This policy covers personal information only. Building, lift, project and commercial design data that does not identify an individual is commercial-in-confidence and is handled under Section 6.

2. What personal information we collect, and why

We collect personal information that is reasonably necessary for our functions and activities (APP 3):

We collect personal information directly from you wherever practicable. If we collect it from a third party (for example, a colleague who sets up an account for you), we take reasonable steps to make you aware of this collection and of this policy (APP 5).

You do not have to identify yourself for everything. Where it is lawful and practicable, you may deal with us anonymously or under a pseudonym — for example, the free analytical estimate in the studios can be used without an account. Some functions (buying a report, holding a licence, or being contacted about opportunities) cannot be provided anonymously. We do not seek to collect sensitive information (such as health, racial, political or biometric information); please do not enter it into the tools or into Andy.

3. How “Andy” is handled

Andy is an assistant built into MAPLE Ascent. On this public website, Andy is a demonstration: when you type a question, the text is sent to our own servers, which return an illustrative, example response. Your input is not sent to any third-party AI provider. You should know that:

• Please do not put personal or confidential information into Andy — treat it as a public demo, not a private channel.
• We use what you type only to generate Andy’s response and to operate, secure and troubleshoot the feature, and we retain these messages for up to 12 months before deleting or de-identifying them.
• Andy’s responses on this site are illustrative and should not be relied on; check anything important with a competent person.

4. Cookies and analytics (GA4)

When you visit mapleascent.com we use cookies and similar technologies. Essential cookies keep the site working and keep you securely signed in. Analytics cookies — we use Google Analytics 4 (GA4) to understand how visitors use the site so we can improve it. GA4 sets cookies and collects information such as a truncated/anonymised IP address, device and browser type, pages viewed and interactions, which is processed by Google and may be stored overseas under Google’s own privacy terms.

You can control cookies through the consent controls (where shown) and through your browser settings. Blocking analytics cookies will not stop you using the site.

5. How we use and disclose personal information

We use and disclose personal information only for the purpose we collected it, for a directly related purpose you would reasonably expect, or where you have consented or the law permits or requires it (APP 6). Typical uses are to provide and support the platform, your account, licences and reports; process payments and issue invoices; respond to enquiries; secure the platform; comply with legal obligations; and contact you about opportunities relevant to your project(s) and occasional product updates, which you can opt out of at any time (Section 8).

We disclose personal information to:

• Our service providers, under contract, including hosting and deployment (Vercel), our database/storage and session-store providers (Upstash Redis and Vercel Blob), payment processing (Stripe), analytics (Google, for GA4), contact-form delivery (Web3Forms), and accounting (Xero) for invoicing and financial records.
• Our affiliated consultancy, Elevator Project Management (EPM) — so that EPM can follow up with you about opportunities relevant to your project(s). You can opt out at any time (Section 8).
• Our CRM (Insightly) — when you purchase from us or give us your details, we may hold you as a lead/contact for opportunity follow-up and occasional updates. Insightly is US-hosted (Section 7); you can opt out, or ask us to remove your record, at any time (Section 8).
• Others where the law allows or requires it — to comply with a law, court/tribunal order or regulator request, or to protect our legal rights.

We do not sell your personal information, and we do not disclose your client building or commercial design data externally for marketing (see Section 6).

6. Confidential building and commercial design data

We treat the building, project, lift/escalator and commercial design data you enter into the studios as confidential and commercial-in-confidence by default. It is used to run your analysis and produce your reports, and is held against your project/account. It is for your use, and for MAPLE Ascent’s and EPM’s internal business-development use only. We do not share, sell, publish or disclose your project or design data to any external party for marketing or any other purpose, except: (a) to the service providers in Section 5 strictly to operate the platform; (b) with your consent; or (c) where the law requires it. Public-facing material (marketing examples, Andy demo reports) uses anonymised data only.

“Internal business-development use” means our own and EPM’s staff may review project/building data to understand portfolios and identify potential opportunities (for example, ageing or inefficient assets). When you purchase from us or provide your details, we may contact you about an opportunity and add your lead/project data to our CRM (Sections 7 and 8). You can opt out of these communications, and ask us to remove your CRM record, at any time.

7. Cross-border (overseas) disclosure — APP 8

Some of our service providers store or process data on servers outside Australia, including in the United States. Under APP 8 we take reasonable steps to ensure overseas recipients handle your information consistently with the APPs (for example, through our contracts). The overseas recipients we currently use or plan to use include:

Insightly is the key cross-border item. Insightly is hosted in the United States. When you purchase from us or provide your details, your contact and project/opportunity details may be sent to and stored in the United States. We take reasonable steps to require Insightly to protect your information, but overseas privacy laws may differ from Australian law. By providing your details or purchasing after reading this notice, you agree to this overseas disclosure (APP 8). You can opt out, and ask us to remove your CRM record, at any time — see Section 8.

8. Direct marketing and how to opt out — APP 7 and the Spam Act

When you purchase from us or give us your details, MAPLE Ascent (and our affiliated consultancy EPM) may contact you about opportunities relevant to your project(s) and occasional product updates, and may hold your details in our CRM (Section 7) for this purpose. We rely on this notice rather than a separate tick-box, and we make opting out easy: every marketing email includes a one-click unsubscribe link, as required by the Spam Act 2003 (Cth), and you can opt out at any time — or ask us to delete your CRM record entirely — by emailing hello@mapleascent.com. Opting out does not affect transactional messages necessary to operate your account, licences or reports.

9. Data security, encryption and storage — APP 11

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These steps include role-based access controls and hashed credentials with optional multi-factor authentication (TOTP) for account admins; encryption in transit (HTTPS/TLS) and encryption at rest, which our infrastructure providers (Vercel and Upstash) apply to stored data; security headers and rate-limiting; server-side handling of secrets; and internal processes to limit access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a data breach likely to result in serious harm, we will respond in line with the Notifiable Data Breaches scheme and notify affected individuals and the OAIC as required.

10. How long we keep your information, and deletion — APP 11

We keep personal information only for as long as we need it for the purposes in this policy, or as required by law. In general:

• Enquiry and contact-form data — up to 24 months after we last deal with your enquiry.
• Account and project data — while your account is active; deleted within 90 days of account closure or a verified deletion request.
• Payment and tax records — 7 years, to meet our financial-records obligations.
• Andy conversation logs — up to 12 months.
• Analytics (GA4) — up to 14 months.
• Marketing/CRM records (if you opt in) — until you unsubscribe or ask us to delete them.

When we no longer need information, we take reasonable steps to destroy or de-identify it. You can ask us to delete your account and/or project data at any time by emailing hello@mapleascent.com. We will action reasonable deletion requests, except where we are required to retain certain information (such as financial records) or need it to resolve disputes or enforce our agreements.

11. Accessing and correcting your information — APP 12 & 13

You can ask us for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Email hello@mapleascent.com. We will respond within a reasonable time. We do not usually charge for access requests; if a charge applies we will tell you first. If we refuse access or correction, we will explain why and how you can complain.

12. How to contact us or make a complaint

If you have a question, an access/correction request, or a privacy complaint, contact our Privacy Officer at MAPLE Ascent Pty Ltd, Level 57, MLC Centre, 25 Martin Place, Sydney NSW 2000 — hello@mapleascent.com · +61 2 9238 2288. We will acknowledge your complaint and aim to resolve it within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC): oaic.gov.au · 1300 363 992 · GPO Box 5288, Sydney NSW 2001.

13. Changes to this policy

We may update this policy from time to time. The current version, with its “Last updated” date, will always be available at mapleascent.com. Where changes are significant, we will take reasonable steps to bring them to your attention.