Privacy Policy in plain English

Last updated: 29 September 2026

This page is a short summary. It uses plain words so anyone can follow it. It does not replace the formal Privacy Policy, which is the binding legal text.

Who we are

We are Maelstrom AI Pty Ltd, an Australian company. Maelstrom AI runs one ISMS over its downpipes platform and its support platform.

• downpipes, our no-custody backup and disaster recovery for the Cloudflare data layer. Free and available now.
• Our support platform, used internally to handle support enquiries.

downpipes runs inside the customer’s own Cloudflare account, under the customer’s own keys. We hold no customer keys, no backup data, and no Cloudflare tokens for it. This means that through downpipes we do not collect, store, or see your backup or infrastructure data. We do run a licence check and an update download; neither sends us your backup or infrastructure data. The exception is our support platform: if you contact Maelstrom support, we do hold your support data. See Support data, below.

What information we collect

Almost nothing. Here is what we do see, by area:

On our website

Nothing from you. No accounts. No sign-in forms, no email fields, no newsletter pop-ups, no contact forms.

Through downpipes

Nothing about your backup or infrastructure. downpipes runs in your own Cloudflare account, under your own keys. It checks your licence and can download an update; neither sends us your backup or infrastructure data.

To issue a licence, we hold the names and work email addresses of the contacts you name. We also hold the Cloudflare account ID where the licence is used. If you buy a Business subscription, we also hold the name and email address you give at checkout. If you ask us about downpipes before you buy, we can keep a record with the contact details you give us.

Why we collect it

Two plain reasons:

1. To keep our website and infrastructure secure.
2. To issue licence tokens for downpipes.

We do not sell data. We do not run ads, profile you, or build up a record of your behaviour over time.

How we use it

Only for the reasons above, and to answer support enquiries (see Support data, below). We do not send marketing emails. We do not combine what we see across sites, across visits, across devices, or across anything else.

Who we share it with

A small number of companies, each for one job:

• Cloudflare, which runs our infrastructure and keeps our sites safe from attacks. They act on our instructions under a data processing contract.
• Amazon Web Services, which stores encrypted backup copies of our own systems in Sydney. We encrypt each copy before upload, so AWS cannot read it.
• Proton, in Switzerland, which hosts our company email, including support@maelstrom.au.
• Stripe, which runs checkout and billing for downpipes Business subscriptions. Your card details go to Stripe, not to us.
• Xero, for invoices and accounts, and Airwallex, for international payments.

The Sub-Processors page gives the full list. It lists Proton, Stripe, Xero and Airwallex separately, as providers for our own records.

For your backup and infrastructure data, downpipes adds no one to this list. That data stays in your own Cloudflare account, under your own keys. We hold none of it. This means there is nothing for us to pass on, and nobody else for us to bring in to handle it.

Our support platform is different. Cloudflare stores that data for us. See Support data, below.

We will share data with law enforcement or a regulator only if we are legally required to do so. We will tell you when we are allowed to.

How long we keep it

• Website data: our hosting provider (Cloudflare) processes technical data such as IP addresses to deliver and protect the site. Our Cloudflare account can show the IP address of a request that Cloudflare challenges or blocks. Cloudflare keeps this data for the period its service sets. Workers Logs are turned on for the website, and keep any record they hold for seven days. We do not otherwise collect anything from you on our website.
• downpipes: we keep your licence record while you are our customer. When the relationship ends, one of our operators marks the record as ended. Our system then deletes it five years after its last change. Until then, the record has no time limit. We keep the contact details of a prospective customer in the same way. You can ask us to erase your contact details sooner. We keep the log of licence emails for two years. Our audit log of licence actions can include the address a licence email went to, and has no time limit. An erasure request does not remove entries from these two logs. Encrypted backup copies of our systems keep erased details until each copy is deleted. Section 9 of the formal policy gives the detail. We do not receive your backup or infrastructure data.
• Support data: see Support data, below.

Support data

If you contact Maelstrom support, our support platform holds a different set of information. It handles support for downpipes. It holds:

• Your support conversation and any attachments
• Your email address and name
• Support bundles you upload through a one-time link
• Notes we add to your ticket
• Your entitlement record at the time of the ticket
• Technical log records, which include the IP address your request came from

We keep closed tickets and attachments for 365 days after the ticket closes. We delete support bundles 30 days after you upload them, and also as soon as the ticket closes.

Cloudflare stores this data in our own Cloudflare account, as our processor. We are the controller of your support contact and ticket details, and a processor of any bundle or attachment content you send us. Proton AG hosts our company mailboxes on the maelstrom.au domain, including support@maelstrom.au. Our support platform does not send or store support mail through Proton. The full list is on the Sub-Processors page.

You have the same rights over this data as set out in Your rights, below.

No children targeted

downpipes is not aimed at children. We treat data from everyone with the same care, whatever their age.

If you are a parent with a question, you can write to us at the address below.

Your rights

You have rights over your personal information. The main ones are:

• Ask what we hold about you.
• Ask us to correct something that is wrong.
• Ask us to delete something.
• Complain to a regulator if you are not happy with how we handle it.

In most cases, we hold almost nothing about you, so there is nothing to send or delete. That is by design. If you have contacted our support team, our support platform does hold data about you. See Support data, above, for what it is and how to ask us about it.

If you are in Australia, you can complain to the Office of the Australian Information Commissioner. If you are in the EU or UK, you can complain to your local data protection authority.

How to contact us

Email: support@maelstrom.au

For downpipes, you can also email support@downpipes.io.

Post: PO Box 169, St Arnaud VIC 3478, Australia

We reply to privacy emails within 5 business days. A full answer usually follows within 30 days.

Changes to this page

Read the full legal text

The binding version, with all defined terms and legal bases, is at Privacy Policy. If this summary seems to clash with the formal policy, the formal policy wins.