Privacy Policy

The kinds of personal information we collect and hold depend on how you use the Service. They include:

• Account and contact details — your name, email address, phone number and login credentials.
• Property and financial information — property addresses and details, purchase prices and dates, valuations, loan balances, interest rates and structures, income and expenses, cashflow and related records.
• Tax-related information — depreciation, cost base, capital gains and similar records you enter or that we calculate from your data.
• Ownership structure information — details of the individuals, joint owners, trusts, companies or SMSFs that own your properties.
• Information about other people — for example, tenant names, tenancy dates and rent, where you choose to record them (see Section 6).
• Documents you upload — such as rental or agent statements, receipts and contracts, and the information they contain.
• Professional and firm information — for accountants, advisers, brokers and firms, business and team details and client relationships.
• Usage and technical information — device and browser information, IP address, log data and information collected through cookies and analytics (see Section 13).

We do not generally seek “sensitive information” (as defined in the Privacy Act). Please do not upload sensitive information unless it is necessary for the Service.

We collect personal information:

• Directly from you — when you register, enter data, upload documents, contact us or use the Service.
• From documents you upload — including through automated and AI-assisted extraction (see Section 4).
• From third-party services you connect — such as a bank-data feed (only with your consent — see Section 14) or market-data sources.
• Automatically — through cookies and analytics when you use our website and apps.

Where it is reasonable and practicable, we collect personal information directly from the individual it is about. Where we collect it from someone else (for example, you providing information about a tenant), we take reasonable steps to make the individual aware of the collection, unless an exception applies.

We collect, hold, use and disclose personal information to:

• provide, maintain and secure the Service and its features;
• create and administer your account, and process documents and calculations you request;
• enable the sharing you authorise with professionals and firms;
• process payments and manage subscriptions;
• provide support and respond to your enquiries and complaints;
• detect, prevent and address security issues, fraud and misuse;
• improve and develop the Service (using de-identified or aggregated information where we can);
• send you service and, where you have opted in, marketing communications (see Section 12); and
• comply with our legal obligations.

We use your personal information only for the purpose we collected it, for a related purpose you would reasonably expect, or as otherwise permitted by law or with your consent.

To save you entering data manually, the Service can extract information from documents you upload. This may involve automated and artificial-intelligence tools, including trusted third-party providers who process the document to return structured data.

• We use providers under terms that do not permit your content to be used to train their own models, and that limit how long they retain it.
• Some of this processing may occur outside Australia — see Section 7.
• A person reviews and confirms extracted data as part of the workflow; we do not make decisions that produce legal or similarly significant effects about you by automated means without human involvement.

We may disclose personal information to:

• Professionals and firms you authorise — only the specific information you choose to share, for as long as your grant remains in place. You can change or revoke a grant at any time.
• Our service providers — who help us run the Service, such as cloud hosting and storage, document-processing and AI providers, payment processors, email and communications, analytics, and (where offered) an accredited bank-data provider. We require them to protect personal information and use it only for the services they provide to us.
• Our professional advisers — such as lawyers, accountants and insurers, where reasonably necessary.
• Authorities — where required or authorised by law, a court or a regulator.
• A buyer or successor — if we sell or reorganise our business, subject to appropriate protections.

We do not sell your personal information.

If you record personal information about another individual (for example, a tenant), you confirm that you are authorised to do so and that you have made any notifications and obtained any consents required for us to collect and handle that information on your behalf. We handle it in accordance with this policy. If an individual believes we hold personal information about them that was provided by one of our users, they can contact us using the details in Section 17 and we will respond in accordance with the APPs.

Some of our service providers — in particular certain document-processing and AI providers — may store or process personal information outside Australia. Where this happens, we take reasonable steps to ensure the information is handled consistently with the APPs, and we contract with providers who commit to appropriate protection. The countries in which providers may process information can change as we change providers; we will keep this policy up to date and can give you current details on request. Where the law requires your consent for an overseas disclosure, we will obtain it, and you acknowledge that once information is disclosed overseas we may not be able to control how it is handled to the same extent as in Australia.

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include:

• encryption of information in transit and at rest;
• access controls, including multi-factor authentication and least-privilege access, so people can only reach the data they need;
• logical separation of each customer’s data, and logging of access;
• hosting of the Service and its database in Australia (Sydney), with reputable providers — noting that certain document-processing and AI providers may process information overseas (see Section 7);
• vetting of our service providers; and
• staff access controls and training.

No system can be guaranteed completely secure, but we work to protect your information and to improve our safeguards over time. We take reasonable steps to destroy or de-identify personal information when we no longer need it (see Section 10).

We maintain procedures to detect, assess and respond to data breaches. If a data breach involving your personal information is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

We keep personal information for as long as we need it to provide the Service and for a reasonable period afterwards to meet legal, accounting and record-keeping requirements. When you close your account, we will delete or de-identify your personal information within a reasonable period, except where we are required or permitted by law to retain it, and noting that residual copies may persist in backups for a limited time.

You can access and update much of your information directly in the Service. You may also ask us for access to the personal information we hold about you, or to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading, by contacting us using the details in Section 17. We will respond within a reasonable time. We may need to verify your identity first. Access is usually free, though we may charge a reasonable cost for some requests, and we will tell you in advance. If we refuse access or correction, we will explain why and how you can complain.

We may send you service messages (such as security, billing and account notices) that are necessary to provide the Service. We will only send you marketing communications where you have opted in or where the law otherwise allows, and every marketing message will identify us and include an easy way to unsubscribe. You can opt out of marketing at any time using the unsubscribe link or by contacting us. We handle marketing in accordance with the APPs and the Spam Act 2003 (Cth).

Our website and apps use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Service is used so we can improve it. You can control cookies through your browser settings, though some features may not work properly without them.

Where the Service offers a bank-data feed, connecting it is optional and happens only with your consent, through an accredited data recipient under the Consumer Data Right (CDR) regime. Where that regime applies, the data is handled in accordance with the CDR rules and the applicable CDR consents and protections, in addition to this policy. You can withdraw a bank-feed consent at any time.

The Service is intended for adults (18 and over) and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe we have, please contact us and we will delete it.

We may update this policy from time to time. The current version will always be available at /privacy, with the effective date shown at the top. If we make a significant change, we will take reasonable steps to let you know.

If you have a question, a request about your information, or a privacy complaint, please get in touch:

We will acknowledge your complaint, investigate it, and aim to respond within a reasonable time (usually within 30 days). If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner: