Privacy policy

1. Scope

This policy explains how PropRetire Pty Ltd handles personal information when you use the PropRetire website, an account or a support channel.

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply.

2. Information we handle

We handle the identity and account details you provide, the personal and financial information entered in portfolio records, and messages sent through contact or support channels. A portfolio can contain information about clients, household members and other legal owners even though they are not account users.

Using the service also creates authentication, billing and operational records. These can include security-factor enrolment and use, recovery-code status and use, active and revoked sessions, IP addresses, browser or device details, request and error logs, and security events. Stripe sends billing events to PropRetire. The application stores the Stripe customer reference, the subscription status, cadence, trial and billing period dates, and a receipt of each billing event received, while Stripe remains the payment and invoice provider.

When you register, the account keeps the tag of the PropRetire link that brought you, such as the name of the site it was posted on, and Google's click id when that link was a Google ad.

3. Collection and use

Most account, portfolio and support information comes directly from the account user. Technical and security records arise when the website or application is used, and billing records also come from Stripe.

We use this information to create and secure accounts, operate the portfolio records and requested workflows, and manage billing. We also use it to send service messages and notices about changes to an email address or security factor, answer support requests, diagnose faults, investigate misuse and meet applicable legal obligations.

During your free trial we may email you the next setup step, and we email you the day after the trial ends if no card was added. Each of these emails has a link that stops them at once, with no sign-in, and the account keeps the day you stopped them. Service messages and notices still come.

We use the link's tag and Google's click id to learn which links and ads bring customers.

While you are signed in to an account, we record which results you open and which reports you download, once a day each, in our own database. A record holds the account, the result's name and the day, never a figure. We keep these records for 400 days, and deleting the account deletes them. No outside analytics tool receives them. We count them to learn which parts of the product customers use and how many accounts reach a first result. Visits while signed out are not recorded, and nothing a report reader or a client answering an information request does is recorded.

4. Service providers and disclosure

PropRetire uses Stripe for billing and Resend for email. Hosting, database and security infrastructure also processes the information needed to run the website and application. The information handled by each provider depends on that function.

When an account came from a Google ad, PropRetire sends Google Ads the ad's click id and the time the trial started or the first payment was made, so Google can report which ads bring customers. It sends nothing else about the account.

Property forms can provide Google Places suggestions in the Street address field. PropRetire does not contact Google until the Street address field receives focus. When suggestions are enabled, Google receives the address text you enter and technical request information. You can switch to manual entry instead. Google controls its processing locations and retention under its terms and privacy policy.

PropRetire requests address components only. It does not save a Google place ID, coordinates or the raw Google response. If you submit the form, PropRetire saves the resulting street address, suburb, state and postcode together with the matching official Australian suburb reference.

The website, application and database are hosted in Australia. Stripe, Resend and Google may store or process the information they receive outside Australia, including in the United States.

Information held in a provider system is also governed by our arrangement with the provider, the provider's privacy terms and applicable law. This policy does not promise a fixed provider retention period.

We may disclose personal information when the law requires it or when needed to investigate misuse, protect an account or protect the service.

5. Cookies and browser storage

PropRetire uses secure cookies for signed-in account sessions, information-request sessions and secure-report sessions. Browser storage keeps the selected theme and active portfolio selection. Until you register, and for no more than 30 days, it also keeps the tag and Google click id of the link that brought you. Blocking or clearing these cookies or browser storage can end a session or reset those preferences. Portfolio financial records and calculated reports are not stored in browser storage.

6. Security

PropRetire takes reasonable steps to protect personal information, including authentication, account-to-portfolio authorisation and restricted operational access. No internet service can eliminate every security risk.

7. Retention and account deletion

Different records serve different account, billing, support, security and legal purposes, so this policy does not promise one retention period for all personal information. Saved account and portfolio records are held in the application database for the life of the account unless a record is deleted through the product. Other operational records may be kept for a different period according to their purpose, provider rules and applicable law.

Ending paid access does not delete an account. To delete an account, the registered user requests deletion, confirms the current password and completes a second-factor check when two-step verification is enabled. PropRetire then records the request and stops current Stripe subscriptions renewing. Fourteen days later it runs the request: it cancels those subscriptions, deletes the Stripe customer record with its saved payment methods and permanently removes the user, account, portfolios and saved records from the application database. The account can be read but not changed during those fourteen days, and the request can be cancelled until it runs. Cancelling it does not restart renewal. Deletion also removes account-owned local email-delivery records. Records belonging to another account's information request or sent report remain with that workflow under its retention boundary.

Stripe keeps the payment and invoice records it must retain after the customer record is deleted, and deleting the account does not erase records held in another provider system. Those records remain subject to the provider terms and applicable law.

8. Access, correction and complaints

You can update account and portfolio information available in the product. You can also ask to access or correct other personal information we hold. For those requests, account deletion questions or a privacy complaint, contact us using the address below. We may ask for identity information reasonably needed and proportionate to the request, and may need to clarify the information involved. Applicable law determines the scope and timing of any required response.

9. Questions

Email privacy@propretire.com.au. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner. For account or product questions, use the contact page.