1. Who we are
This Privacy Policy explains how Catchment Simulation Solutions Pty Ltd (ABN 46 116 032 887) (CSS, we, us, our) collects, uses, stores, and protects personal information when you use the CSS Software online portal and related account services.
- Trading name
- CSS Software
- Website
- software.csse.com.au
- Contact
- csse.com.au/contact
- Postal address
- Suite 1, Level 10, 70 Phillip Street, Sydney NSW 2000
We provide subscription management, product licensing, downloads, and account services for CSS software products including CatchmentSIM, Storm Injector, TRIM, and others.
2. Scope
This policy applies when you:
- create or manage an account on CSS Software;
- purchase or administer subscriptions and staff access;
- sign in via email and password or corporate single sign-on (SSO);
- authorise desktop applications (e.g. Storm Injector) through your browser;
- download product installers or receive account and billing notifications.
It does not apply to third-party services we do not control (your identity provider, Xero, or Stripe checkout).
3. Our commitment to Australian data sovereignty
CSS is an Australian company. Customer account and entitlement data is hosted primarily in Sydney, New South Wales, Australia.
- Data controller: Catchment Simulation Solutions Pty Ltd (Australia)
- Governing framework: Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs)
- Sovereignty intent: account, subscription, licensing, and related operational records are stored on Australian infrastructure and handled under Australian law
Some supporting services (payments, email, enterprise authentication) may process limited data outside Australia — see section 10. We do not sell your personal information.
4. What personal information we collect
Account and identity
Name, work email, company name, postal address, account role, and preferences. Passwords are stored as a one-way hash, not plain text. Corporate SSO users are authenticated by your organisation's identity provider — we do not store your corporate password.
Subscriptions and billing
Product subscriptions, staff access grants, quote and invoice mirrors, and integration references (Xero, Stripe). Card numbers are not stored in CSS databases.
Desktop applications (e.g. Storm Injector)
Session records for seat enforcement, optional machine label and device fingerprint, client version, and hashed OAuth tokens. We do not collect model content or project files through licensing.
Version check-in and downloads
Product version reported, check-in timestamps, and download audit events.
Technical data
Session cookies, IP address and user agent in security logs, and short-lived SSO exchange records.
5. What we do not store in the account platform
- TRIM simulation or project data — model paths, queue state, worker telemetry, and TUFLOW run metadata are handled under the TRIM Privacy Policy, not in the billing database
- Project file contents — we do not store CatchmentSIM, Storm Injector, or other desktop project files through the licensing service
- Raw passwords, authorisation codes, or OIDC tokens
- Payment card numbers or CVV (handled by Stripe)
6. How we use personal information
- Provide and secure the CSS Software service
- Bill and administer subscriptions
- Send service communications you request or that relate to your subscription
- Detect abuse and maintain audit trails
- Comply with Australian law
7. How we protect your information
We use defence-in-depth security appropriate to commercial account and billing data.
- Infrastructure (Sydney): databases not exposed publicly; TLS for all access; firewall-restricted entry points
- Application: hashed passwords; HttpOnly session cookies; OIDC with PKCE for enterprise SSO; role-based access on every API call; encrypted OIDC client secrets
- Operations: limited production access; encrypted backups with restore testing; security patching
If you believe your account is compromised, contact us promptly via our contact form.
8. Retention
- Active accounts: for the life of the account plus a reasonable wind-down
- Commercial records: typically 7 years for Australian tax and accounting requirements
- Version check-ins: raw events up to 24 months; aggregated trends longer
- Security logs: up to 24 months
9. Disclosure to third parties
We disclose personal information only to service providers that help us operate CSS Software:
- Xero — contacts, quotes, and tax invoices
- Stripe — card payments (where enabled)
- Email provider — transactional messages
- Your identity provider — SSO authentication only
A sub-processor list is available on request via our contact form.
10. Overseas disclosure
Primary databases are in Australia. Limited data may be processed overseas when we use global payment or email services, or when your organisation's identity provider is hosted outside Australia. We take reasonable steps under APP 8 to ensure overseas recipients protect your information.
11. Your rights
You may request access to or correction of personal information we hold about you.
Privacy requests: use our contact form with sufficient detail to identify your account. We will respond within a reasonable period (ordinarily 30 days).
Complaints: contact us first via our contact form. If unresolved, you may contact the Office of the Australian Information Commissioner (oaic.gov.au).
13. Changes and contact
We may update this policy. The effective date at the top will change when we do.
Contact: csse.com.au/contact
Postal address: Suite 1, Level 10, 70 Phillip Street, Sydney NSW 2000
TRIM privacy policy: trim.csse.com.au/privacy