1. Scope
This policy explains how PropRetire Pty Ltd handles personal information when you use the
PropRetire website, an account or a support channel.
We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy
Principles where they apply.
We handle the identity and account details you provide, the personal and financial information
entered in portfolio records, and messages sent through contact or support channels. A portfolio
can contain information about clients, household members and other legal owners even though they
are not account users.
Using the service also creates authentication, billing and operational records. These can
include security-factor enrolment and use, recovery-code status and use, active and revoked
sessions, IP addresses, browser or device details, request and error logs, and security events.
Stripe sends billing events to PropRetire. The application stores the Stripe customer reference,
the subscription status, cadence, trial and billing period dates, and a receipt of each billing
event received, while Stripe remains the payment and invoice provider.
When you register, the account keeps the tag of the PropRetire link that brought you, such as
the name of the site it was posted on, and Google's click id when that link was a Google ad.
3. Collection and use
Most account, portfolio and support information comes directly from the account user. Technical
and security records arise when the website or application is used, and billing records also
come from Stripe.
We use this information to create and secure accounts, operate the portfolio records and
requested workflows, and manage billing. We also use it to send service messages and notices
about changes to an email address or security factor, answer support requests, diagnose faults,
investigate misuse and meet applicable legal obligations.
During your free trial we may email you the next setup step, and we email you the day after the
trial ends if no card was added. Each of these emails has a link that stops them at once, with
no sign-in, and the account keeps the day you stopped them. Service messages and notices still
come.
We use the link's tag and Google's click id to learn which links and ads bring customers.
While you are signed in to an account, we record which results you open and which reports you
download, once a day each, in our own database. A record holds the account, the result's name
and the day, never a figure. We keep these records for 400 days, and deleting the account
deletes them. No outside analytics tool receives them. We count them to learn which parts of the
product customers use and how many accounts reach a first result. Visits while signed out are
not recorded, and nothing a report reader or a client answering an information request does is
recorded.
4. Service providers and disclosure
PropRetire uses Stripe for billing and Resend for email. Hosting, database and security
infrastructure also processes the information needed to run the website and application. The
information handled by each provider depends on that function.
When an account came from a Google ad, PropRetire sends Google Ads the ad's click id and the
time the trial started or the first payment was made, so Google can report which ads bring
customers. It sends nothing else about the account.
Property forms can provide Google Places suggestions in the Street address field. PropRetire
does not contact Google until the Street address field receives focus. When suggestions are
enabled, Google receives the address text you enter and technical request information. You can
switch to manual entry instead. Google controls its processing locations and retention under its
terms and privacy policy.
PropRetire requests address components only. It does not save a Google place ID, coordinates or
the raw Google response. If you submit the form, PropRetire saves the resulting street address,
suburb, state and postcode together with the matching official Australian suburb reference.
The website, application and database are hosted in Australia. Stripe, Resend and Google may
store or process the information they receive outside Australia, including in the United States.
Information held in a provider system is also governed by our arrangement with the provider, the
provider's privacy terms and applicable law. This policy does not promise a fixed provider
retention period.
We may disclose personal information when the law requires it or when needed to investigate
misuse, protect an account or protect the service.
5. Cookies and browser storage
PropRetire uses secure cookies for signed-in account sessions, information-request sessions and
secure-report sessions. Browser storage keeps the selected theme and active portfolio selection.
Until you register, and for no more than 30 days, it also keeps the tag and Google click id of
the link that brought you. Blocking or clearing these cookies or browser storage can end a
session or reset those preferences. Portfolio financial records and calculated reports are not
stored in browser storage.
6. Security
PropRetire takes reasonable steps to protect personal information, including authentication,
account-to-portfolio authorisation and restricted operational access. No internet service can
eliminate every security risk.
7. Retention and account deletion
Different records serve different account, billing, support, security and legal purposes, so
this policy does not promise one retention period for all personal information. Saved account
and portfolio records are held in the application database for the life of the account unless a
record is deleted through the product. Other operational records may be kept for a different
period according to their purpose, provider rules and applicable law.
Ending paid access does not delete an account. To delete an account, the registered user
requests deletion, confirms the current password and completes a second-factor check when
two-step verification is enabled. PropRetire then records the request and stops current Stripe
subscriptions renewing. Fourteen days later it runs the request: it cancels those subscriptions,
deletes the Stripe customer record with its saved payment methods and permanently removes the
user, account, portfolios and saved records from the application database. The account can be
read but not changed during those fourteen days, and the request can be cancelled until it runs.
Cancelling it does not restart renewal. Deletion also removes account-owned local email-delivery
records. Records belonging to another account's information request or sent report remain with
that workflow under its retention boundary.
Stripe keeps the payment and invoice records it must retain after the customer record is
deleted, and deleting the account does not erase records held in another provider system. Those
records remain subject to the provider terms and applicable law.
8. Access, correction and complaints
You can update account and portfolio information available in the product. You can also ask to
access or correct other personal information we hold. For those requests, account deletion
questions or a privacy complaint, contact us using the address below. We may ask for identity
information reasonably needed and proportionate to the request, and may need to clarify the
information involved. Applicable law determines the scope and timing of any required response.
9. Questions
Email privacy@propretire.com.au. If you are not satisfied with our response, you may contact the Office of the Australian
Information Commissioner. For account or product questions, use the contact page.