Archistar

The Privacy Policy expressly disclaims ownership of the plans and information users upload to the platform, treating the user as the party controlling and sharing that content. This is a user-favorable position on input ownership.

The documents do not clearly assign ownership of AI-generated outputs (e.g., pass/fail reports, generative design results). The API Terms state Archistar remains sole owner of the Zoning Database, API and Flat-files, and that outputs are unverified and must not be relied upon as advice, but the Website/Platform Agreement is silent on who owns generated design or report outputs.

The API Terms restrict the Subscriber from using the Zoning Database to train AI/ML models, but the documents do not make a clear commitment about whether Archistar itself uses user-uploaded plans to train its own models. The Privacy Policy states it may use personal information to 'improve our products and services' and to 'conduct research,' and says it does not collect personal information contained within uploaded plans — but is otherwise silent on training on non-personal plan content.

The Privacy Policy provides self-serve download/delete functionality within the platform and commits to acting on off-platform deletion requests within a reasonable time, but retention is described only generally ('as long as is necessary or as required by law') with no fixed schedule or deletion SLA. The API Terms impose strict destruction/return obligations on the Subscriber on termination. No security-specific retention (e.g., audit log) commitments are disclosed.

Archistar explicitly states it will not sell personal information, and much disclosure (to councils/municipalities) is integral to the service the user signed up for. However, the Privacy Policy lists a broad range of recipients — related bodies corporate, service providers, insurers, and anyone acquiring the business — and permits overseas transfers, so disclosure is wide though disclosed. Sharing generally requires user instruction for uploaded plans.

The Privacy Policy provides clear opt-out and consent-withdrawal mechanisms: marketing unsubscribe, a general right to withdraw consent by contacting the Privacy Officer, Google Analytics opt-out, and CCPA opt-out of sale rights. These are meaningful, though withdrawing consent may limit service access.

As a govtech platform serving municipalities, no relevant compliance certifications (SOC 2, ISO 27001, FedRAMP, StateRAMP, NIST) are named in the accessible documents. The vendor claims general compliance with the Australian Privacy Act, PIPEDA and CCPA, and references GDPR-style rights for European residents, but provides no third-party attestations. The trust center (trust.archistar.ai) was inaccessible, so no certification evidence could be verified.

Despite being an AI-first plan-review platform that issues 'pass/fail' compliance determinations affecting building permits, the accessible policy documents provide no transparency into model behavior, no explainability commitments, and no enterprise audit rights. The API Terms disclaim that outputs are human-reviewed and warn they must not be relied upon as advice.

The documents disclose encryption in transit and at rest, 'industry standard security technologies,' geographically segregated data residency (AU/US/CA), and shared-responsibility user guidance. However, there is no mention of penetration testing, bug bounty, formal incident response, or breach history, and the referenced trust center was inaccessible. Security is described in general commercial terms with broad disclaimers.

The Website/Platform Agreement notes that a signed written agreement (i.e., an enterprise contract) overrides the standard terms, and corporate accounts allow administrators to control and access users' accounts. This implies material differences may exist under negotiated enterprise/DPA terms, but no enterprise documents were accessible to confirm improved data handling on paid tiers.

The API Terms state outputs are not reviewed by a human before delivery, and the Privacy Policy allows staff (technical support, programming, account support from Australia) to access personal information for support and monitoring. Transmissions are also 'routinely monitored.' There is no explicit statement about staff reading uploaded plan content, but access rights for support/quality purposes are reserved.

The Privacy Policy discloses that personal information may be shared with government agencies, regulators, law enforcement, courts, and in response to subpoenas or legal documents. No current litigation or specific government data requests are disclosed. This is standard disclosure but signals cooperation with legal/law-enforcement demands.

The Privacy Policy discloses a broad range of PII (name, contact details, DOB, employer, payment/bank/card details, IP address, device IDs, location, usage patterns, credentials) and notes it may collect sensitive information (health, racial/ethnic origin, political opinions, religious beliefs, criminal record) with consent where necessary. Collection is disclosed with stated purposes and it disclaims collecting personal information embedded in uploaded plans, warranting a moderate rating.

The Privacy Policy is dated 10 September 2025 — well within 12 months of the analysis date — but the API and Website/Platform Terms carry no discoverable effective date. While the Privacy Policy addresses platform data flows, SSO, cookies and overseas processing, it and the terms are largely silent on the AI/ML and generative model processing central to the shipped product (AI PreCheck's generative AI, computer vision and automated pass/fail compliance determinations). Coverage of the product's core AI capabilities is only partial, capping this at YELLOW.

Three documents were supplied (API Zoning Database Terms, Privacy Policy, Website & Platform Agreement) and no material contradictions were identified. Provisions on data ownership, no-sale of data, deletion rights and jurisdiction are consistent across documents; the API Terms and Website Terms govern distinct products but are complementary rather than conflicting.