How we collect, use, disclose, and protect personal information when you use WebStream websites and Audentia-operated online services.
Effective date: 15 June 2026 · Last updated: 15 July 2026 · Version 1.3
Audentia Nova Pty Ltd ("Audentia", "we", "us", "our") provides the WebStream application control platform and related websites and services, including webstream-acp.com (the "Website"), the customer entitlement portal (the "Portal"), AWS Marketplace fulfilment, and the WebStream software deployed in customer environments (the "Software").
This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our Website and Audentia-operated online services. It also explains how customer-hosted WebStream deployments differ.
WebStream is primarily deployed in customer-controlled environments (for example, on AWS EC2 instances in the customer's account). This creates two distinct situations:
We act as the data controller for personal information we collect through:
When you run WebStream in your own environment, you are generally the data controller for:
Customer Content remains under your control. Audentia provides a technology platform for application delivery and governance. We do not routinely access, inspect, or store the content of your applications or end-user documents except:
If you are an end user accessing WebStream through your employer or service provider, please contact that organisation for questions about how your session data is handled.
We may collect:
We use Google Ads (gtag / Google advertising tags) on webstream-acp.com to measure advertising performance, including form submissions and click-throughs from ads. Google may set or read cookies or similar identifiers and receive online identifiers (such as IP address) and event data according to Google’s terms. See Google’s Privacy Policy. We do not use Google Analytics as a general site analytics product on webstream-acp.com.
Our Website may load fonts and scripts from third-party CDNs (for example, Google Fonts, jsDelivr) which may receive your IP address as part of normal HTTP requests.
When you register for or use the Portal, we collect:
If you subscribe via AWS Marketplace, we receive and process:
ResolveCustomer and subscription notifications);If you use our community support board, we collect:
The Software may send operational and licence telemetry to Audentia or AWS infrastructure, including:
Essential licensing heartbeats and enforcement-related telemetry may be mandatory and cannot be fully disabled. Other telemetry may be configurable depending on edition and deployment.
We design telemetry to avoid collecting application document content. Telemetry is distinct from Customer Content stored in your deployment (Section 2B).
When you operate WebStream, the Software may process and store the following in your environment under your control:
| Data type | Typical handling |
|---|---|
| Usernames, display names, emails | IAM database (customer PostgreSQL) |
| Authentication events | IAM activity_log and session logs |
| IP addresses, user-agents | IAM audit and HTTP access logs |
| Session duration, performance metrics | Metrics Engine (customer PostgreSQL) |
| File transfer events | Filename, size, path — not file content |
| Print events | Event metadata; PDF output stored per customer configuration |
| Clipboard governance events | Event type, direction, policy outcome; up to 200 characters of clipboard text may be logged if activity logging is enabled |
| Session recordings (optional, higher editions) | Encoded session files (.wsrec) on customer storage; disabled by default |
| Screen streaming | Transient transport between browser and session host; not retained by Audentia |
Default activity log retention in the Metrics Engine is 10 days (configurable). Session recording retention defaults to 30 days when recording is enabled (configurable).
We use personal information to:
We do not sell your personal information. We do not use Portal data for unrelated third-party marketing.
We may share personal information with:
| Recipient | Purpose |
|---|---|
| AWS | Hosting (Lambda, DynamoDB, SES, Secrets Manager, Marketplace APIs). Portal data primarily in ap-southeast-5; Marketplace metering in us-east-1 |
| Web3Forms | Relaying evaluation / PoC contact form submissions; delivers as email to support@webstream-acp.com. May apply spam filtering (CleanTalk, Akismet). See Web3Forms Privacy Policy |
| Google Ads conversion and click-through measurement on the marketing website (gtag). May process online identifiers and event data per Google’s privacy policy | |
| Professional advisers | Legal, accounting, or compliance where required |
| Law enforcement / regulators | When required by law or to protect rights and safety |
We require service providers to handle information consistently with this policy and applicable law.
Audentia is based in Australia. Our cloud services use AWS regions including ap-southeast-5 and us-east-1. If you access our services from outside Australia, your information may be processed in those regions.
Where required, we take reasonable steps to ensure appropriate safeguards for cross-border transfers.
Website: We use cookies and similar technologies that are strictly necessary for the site to function. We also use Google Ads tags to measure ad click-throughs and form conversion events. Those tags may set or read advertising cookies or similar identifiers. You can control cookies through your browser settings; blocking advertising cookies may reduce measurement accuracy but will not prevent you from using the site.
Portal: We use cookies and browser storage necessary for authentication and session management (for example, access tokens). These are strictly functional.
WebStream client: The browser client may use sessionStorage for session identifiers and authentication tokens during an active session.
You can control cookies through your browser settings; disabling functional cookies may prevent Portal login.
| Data category | Retention |
|---|---|
| Portal accounts, licences, audit logs (Audentia cloud) | Duration of relationship + 2 years, then delete or anonymise |
| Support board posts/tickets | Duration of relationship + 2 years, unless you request earlier deletion where permitted |
| Evaluation / PoC form submissions | Received by Audentia via email (support@webstream-acp.com); retained relationship + 2 years. Web3Forms may temporarily process/store during relay per their policy |
| Web server logs | 90 days |
| Customer deployment logs/recordings | Customer-controlled — see Section 4 |
Metering and billing records may be retained longer where required for tax, accounting, or AWS Marketplace obligations.
Where you make a verified request for earlier deletion of personal information we hold as controller, we follow the process and timeframes in Section 12.
Personal information and related records that Audentia holds as controller in Audentia-operated AWS services (including the customer entitlement Portal, licence administration, and Marketplace fulfilment data we store) are protected using AWS infrastructure backup capabilities, including continuous backups / point-in-time recovery for DynamoDB tables and versioning for designated S3 objects where configured.
For those Audentia-operated stores, we maintain a rolling recovery window of at least 21 days. This is a backup recovery window, not the live retention period in Section 9. AWS platform capability may allow restore further back within the provider’s maximum window; we commit publicly to at least 21 days.
Backup and recovery under this section do not cover Customer Content or other data in your WebStream ACP deployment (your AWS account or environment). You are responsible for backup of customer-hosted systems.
We implement administrative, technical, and organisational measures appropriate to the information we hold, including encryption in transit (HTTPS/TLS), hashed passwords, AWS Secrets Manager for signing keys, and access controls on Portal APIs.
No method of transmission or storage is completely secure. You are responsible for securing your WebStream deployment, network access, and customer Content.
To report a vulnerability or security incident related to WebStream or Audentia-operated services, see our Security Incident Reporting process or email security@webstream-acp.com.
Australia: Under the Privacy Act 1988 (Cth) and Australian Privacy Principles, you may request access to or correction of personal information we hold about you, and complain to us or the Office of the Australian Information Commissioner (OAIC).
Additional rights for California residents and for individuals in the European Economic Area (EEA) / United Kingdom are described in Sections 13 and 14.
Email privacy@webstream-acp.com with the subject line beginning with [PRIVACY]. Include:
We will verify your identity (and authority to act for an organisation, where applicable) before fulfilling the request.
Business days exclude weekends and Australian public holidays observed in Western Australia.
Deletion or anonymisation under this section covers personal information in Audentia-operated systems, including Portal accounts, related licence administration records that identify you, and support board content attributable to you, except where Section 12.4 applies.
Customer Content in your WebStream ACP deployment (session data, application data, logs, and recordings in your environment) is controlled by you. We do not delete data from your AWS account or other customer infrastructure as part of this process. Direct those requests to your organisation’s administrators.
We may retain or only partially delete information where:
If your subscription is governed by the Standard Contract for AWS Marketplace (SCMP) (or another written EULA on the listing), Buyer Data return and deletion after subscription termination or expiration follow that agreement (SCMP typically provides a 45-day window for return or buyer-initiated retrieval/deletion of Buyer Data, then permanent deletion within a reasonable time). On-request deletion of personal information we hold as controller in the Portal and related Audentia services remains subject to the 30-day timeframe in Section 12.2, subject to the exceptions above.
If you are a resident of California, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), may provide additional rights regarding personal information we hold as a business.
Sale and sharing: We do not sell personal information. We do not share personal information for cross-context behavioural advertising as that term is used under the CCPA/CPRA. We use Google Ads only to measure our own advertising performance (including form conversions and click-throughs), not to sell your data to third parties for their advertising. We do not use Portal data for unrelated third-party marketing.
Categories: Depending on how you interact with us, we may collect identifiers (such as name and email), commercial information (such as licence or Marketplace subscription status), internet or electronic network activity (such as Portal authentication and audit events, and advertising measurement events), and professional information (such as organisation and role) as described in Section 3.
Your rights may include the right to know/access, delete, and correct personal information, and to non-discrimination for exercising these rights. To submit a request, follow Section 12.1 or email privacy@webstream-acp.com with the subject line beginning with [PRIVACY][CCPA]. We will verify your identity before fulfilling the request. Authorised agents may submit requests with proof of authority.
These rights apply to personal information Audentia holds as controller. They do not require us to delete Customer Content from your own WebStream ACP deployment.
Audentia is established in Australia. Our primary privacy framework for Audentia-operated services is the Privacy Act 1988 (Cth). We do not currently publish a public GDPR/UK GDPR compliance certification, standard Article 28 data processing agreement, or EU-only hosting option for the customer entitlement Portal.
If you are in the EEA or UK, or you process personal data of individuals there:
Until such an agreement is in place, do not assume that use of Audentia-operated Portal or Marketplace fulfilment services alone meets your organisation’s GDPR/UK GDPR obligations for EEA/UK personal data.
WebStream is a business platform. We do not knowingly collect personal information from children under 16.
The WebStream Ops MCP Server is open source and may be deployed separately by customers or operators. When deployed, it connects to your WebStream Gateway API and may expose administrative data to AI clients according to your configuration and privacy mode settings. Audentia is not responsible for MCP deployments you operate outside our hosted services.
We may update this policy from time to time. The "Last updated" date at the top will change. Material changes will be posted on this page. Continued use of our services after changes constitutes acknowledgement where permitted by law.
Audentia Nova Pty Ltd
Office 26, 217 Hay Street, Subiaco, Western Australia 6008
Email: privacy@webstream-acp.com