Privacy Policy

1. Introduction

RealestateCopilot ("we", "us", "our") is an Australian-owned and operated service. This Privacy Policy explains how we handle personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) when you use our AI property-research platform (the "Platform"). The short version: your data is hosted in Australia, we do not sell it, we do not use it to train AI models, and documents in internal-only collections never leave our servers.

2. What we collect

• Account information: email address, display name if you set one, and password (stored only as a cryptographic hash). Waitlist applications may include the details you choose to provide.
• Usage data: search queries, chat messages with Phil, property views, saved properties, preferences, and drafting-tool inputs.
• Location preference: a city/state search default you enter manually or ask us to detect once from browser geolocation.
• Technical and security data: IP address, browser type, session identifiers, and security and audit logs (for example logins, uploads, deletions) used for session management, abuse prevention, and account protection.
• Feedback: anything you submit through the feedback tools, with its page context.
• Knowledge documents (eligible plans): documents you choose to upload to your organisation's private knowledge base, encrypted at rest.

We do not ask for, and you should not submit, sensitive information (such as health, racial, or religious information) or government identifiers. Where practical you may use the Platform pseudonymously: an email address is the only identity we require.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Platform
• Personalise your property search experience and AI recommendations
• Convert optional browser geolocation into a city/state search default when you ask us to
• Create and manage your account, including email verification and waitlist review
• Respond to feedback and improve the Platform
• Send you important updates about your account or the service
• Detect, prevent, and address technical issues or abuse

4. Where your data lives and how it is protected

Your active service data is hosted on servers located in Sydney, Australia. Backup creation, restore testing, and expiry are controlled separately from active-store deletion and must be verified operationally before any deletion receipt states that backup expiry is complete. Protections include:

• Passwords are cryptographically hashed and never stored in plain text
• Sessions are managed via secure, HTTP-only cookies
• All traffic is encrypted in transit using HTTPS/TLS
• Uploaded knowledge-base documents are encrypted at rest (AES-256-GCM) before they reach the database
• Access to user data is restricted to authorised processes, and sensitive account actions are logged in a tamper-evident audit trail. New records use an opaque actor ID, a keyed network pseudonym, and a coarse browser label rather than the account ID, raw network address, or full browser string
• Documents in collections marked "internal only" are indexed and searched entirely on our own servers and are never sent to any external AI service, at upload or at query time

No method of electronic storage is 100% secure and we cannot guarantee absolute security, but security is designed in rather than bolted on. If a data breach occurs that is likely to result in serious harm, we will notify affected users and the OAIC as required by the Notifiable Data Breaches scheme.

5. Data Sharing

We do not sell your personal information.

We may share your information only in the following limited circumstances:

• Service Providers: Trusted providers that process data on our behalf to operate the Platform (see Section 6). They may use your data only to provide their service to us
• Legal Requirements: If required by law, regulation, or legal process
• Safety: To protect the rights, property, or safety of RealestateCopilot, our users, or others

6. Third-party services and overseas disclosure

To operate the Platform we use a small set of sub-processors, each bound by their own privacy terms. Some are based in the United States, which means limited data is disclosed overseas as described below (APP 8). We choose business-grade APIs whose terms prohibit training on submitted data, and we send the minimum needed:

• Anthropic (Claude), US: powers Phil. Chat messages and the context needed to answer them are processed by Anthropic's API. Anthropic does not train its models on data submitted through its commercial API.
• Perplexity (Sonar), US: AI-powered web search for public property listings and live facts. We send the derived search query, never your identity or account details.
• Voyage AI, US: generates embeddings for standard knowledge-base collections on eligible plans. Text sent for embedding is not used to train models. Internal-only collections never use this service; they are embedded on our own servers.
• Resend, US: sends transactional email (verification, password reset, approvals). Receives your email address and the message content.
• Cloudflare Turnstile: bot and abuse protection at sign-up.
• BigDataCloud: reverse geocoding used only when you choose automatic location. We send coordinates from our server and store only the resulting city/state preference.
• DigitalOcean (Sydney, Australia): infrastructure hosting. Your stored data stays in Australia.

We do not use third-party advertising, analytics, or tracking services. We encourage you to review the providers' privacy policies.

7. Your rights

• Access: request a copy of the personal data we hold about you
• Correction: request that we correct inaccurate information
• Deletion: request deletion of your account and associated data
• Export: request a portable copy of your data

To exercise these rights, use the feedback button in the app or email privacy@realestatecopilot.com.au. We respond within 30 days and do not charge for reasonable requests. We do not send marketing communications without your consent; the only emails you receive are transactional (verification, resets, account notices).

If you are unhappy with our handling of your information or a privacy complaint, contact us first and we will investigate and respond within 30 days. You may also complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).

8. Cookies and Local Storage

We use cookies and browser local storage for:

• Authentication: Maintaining your logged-in session
• Preferences: Remembering your theme (light/dark mode) preference
• Session State: Preserving dashboard state (chat history, property results) within a browser session

We do not use third-party tracking cookies or analytics trackers during the beta phase.

9. Data retention

We retain your account information, chat history, and saved data while your account is active. A content-history purge deletes saved chats, the active chat, and generated reports only; it is not account deletion. On full account deletion, active user stores are removed or pseudonymised according to the documented deletion receipt. The separate encrypted mapping from opaque audit actors to an account is deleted, while narrowly defined security or legal records may remain in immutable audit replicas until their published maximum retention expires (currently up to 400 days). Older records created before actor pseudonymisation may retain an immutable account identifier until that same expiry. Backup expiry is reported separately after the backup schedule is operationally verified.

10. Children's Privacy

The Platform is not intended for users under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will take steps to delete that information promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date always reflects the current version, and material changes will also be notified by email or in-app notice. We encourage you to review this policy periodically.

12. Contact us

Questions about this Privacy Policy or your data? Contact privacy@realestatecopilot.com.au.