1. Scope
This policy explains how PropRetire Pty Ltd handles personal information when you use the
PropRetire website, an account or a support channel.
We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy
Principles where they apply.
We handle the identity and account details you provide, the personal and financial information
entered in portfolio records, and messages sent through contact or support channels. A portfolio
can contain information about clients, household members and other legal owners even though they
are not account users.
We keep the documents you add, such as statements and notices, so they can be read again and filed with the records they filled.
Using the service also creates authentication, billing and operational records. These can
include security-factor enrolment and use, recovery-code status and use, active and revoked
sessions, IP addresses, browser or device details, request and error logs, and security events.
Stripe sends billing events to PropRetire. The application stores the Stripe customer reference,
the subscription status, cadence, trial and billing period dates, and a receipt of each billing
event received, while Stripe remains the payment and invoice provider.
When you register, the account keeps the tag of the PropRetire link that brought you, such as
the name of the site it was posted on, and Google's click id when that link was a Google ad.
We count page views with PostHog, in the EU, without cookies and without identifying you. It
gets the page's address, with any record's id taken out, the tags of the link that brought you,
and the name of the website you came from, never its page. To tell one visit from another
without a cookie, it also sees your IP address, browser and time zone, and doesn't keep your IP
address. It also counts how often a search finds nothing, never your words.
When you email yourself a calculator's working, we keep your email address, which calculator it
was and when you sent it. The figures you entered go only into the email, and we remove our copy
of them once the email is sent, or once we stop trying to send it.
3. Collection and use
Most account, portfolio and support information comes directly from the account user. Technical
and security records arise when the website or application is used, and billing records also
come from Stripe.
We use this information to create and secure accounts, operate the portfolio records and
requested workflows, and manage billing. We also use it to send service messages and notices
about changes to an email address or security factor, answer support requests, diagnose faults,
investigate misuse and meet applicable legal obligations.
During your free trial we may email you the next setup step, and we email you the day after the
trial ends if no card was added. Each of these emails has a link that stops them at once, with
no sign-in, and the account keeps the day you stopped them. Service messages and notices still
come.
We use the link's tag and Google's click id to learn which links and ads bring customers.
A calculator's working goes to the address you gave, and sending it makes no account. We use the
record of each send to stop anyone flooding an inbox with them, and to learn which calculators
people find useful. Each of these emails has a link that stops them going to your address again,
with no sign-in. If you use it, we keep your address and the day, so we never send to it again.
We keep these records until you ask us to delete them.
While you are signed in to an account, we record which results you open and which reports you
download, once a day each, in our own database. A record holds the account, the result's name
and the day, never a figure. We keep these records for 400 days, and deleting the account
deletes them. No outside analytics tool receives them. We count them to learn which parts of the
product customers use and how many accounts reach a first result. Results opened while signed
out are not recorded, and nothing a report reader or a client answering an information request
does is recorded. Apart from these records, PostHog counts the app's page views as it does the
site's, in the EU, without cookies or knowing who you are, and with every record's id taken out
of the page's address.
PostHog also counts four steps after you sign up: your first document added, your first record
accepted, your first result opened, and a next document added within 30 days of the first. Our
server sends each one when it happens, as a bare count with a new random id, so it carries no
name, email address, account, document or figure, and PostHog doesn't see your IP address. It
says only whether it came from a person's account or a business, and, for a result, which one.
We count them to see where people stop.
4. Service providers and disclosure
PropRetire uses Stripe for billing, Resend for email, PostHog to count page views and first steps and Amazon Web Services to keep documents. Hosting, database and security infrastructure also processes the information
needed to run the website and application. The information handled by each provider depends on that
function.
When an account came from a Google ad, PropRetire sends Google Ads the ad's click id and the
time the trial started or the first payment was made, so Google can report which ads bring
customers. It sends nothing else about the account.
Property and purchase forms can provide Google Places suggestions in the address field.
PropRetire does not contact Google until that field receives focus. When suggestions are
enabled, Google receives the address text you enter and technical request information. You can
switch to manual entry instead. Google controls its processing locations and retention under its
terms and privacy policy.
PropRetire requests address components only. It does not save a Google place ID, coordinates or
the raw Google response. If you submit a property form, PropRetire saves the resulting street
address, suburb, state and postcode together with the matching official Australian suburb
reference.
A document you add to be read, such as a loan statement or a fact find, on Add documents, Add
loan, Record balance or Add property, goes to a document reading service in the United States,
which reads it into figures for you to review. A bank's CSV or Excel export goes there too. An
OFX or QFX file is read on our own server in Australia. On Import clients, a firm that reads its
client list sends each client's rows to the same service, without any column headed tax file
number, and the list isn't kept once it's read. With each document it reads, the service gets a
short summary of your household's records, so each figure lands on the right record: each
property's address and the costs recorded for it, each loan's name, lender, the last four digits
of its account and its property, each bank account's name, bank, last four digits and any loan
it is the offset of, the latest balance of each loan and bank account, each person's name and
date of birth, each income's and living cost's name, amount and how often, the names, kinds and
dates of documents you've kept, and the figures you've accepted from documents and those still
waiting for your review, each with its date and the document it came from. The summary never
holds a tax file number or a full account number. When your records or documents change, and
otherwise at most once a day, the service also gets that summary without amounts, with what your
results still need and which documents are missing, to work out which documents to add next. We
plan to move this reading to a service in Australia. The service says it deletes what it's sent
within 30 days, unless the law or a check for misuse needs it kept longer. We keep documents encrypted with Amazon Web Services in Sydney, and nowhere else. Please black out any tax file number before you add a document. Where one is left in, we paint it out of or remove it from what we send wherever we can find it, and cover it in the copy we keep, with any part of a page we can't read, such as a logo, as it could hold one. Where we can't cover it, we don't keep the document.
From a bank's export we keep the date and amount of each payment in, and from an owner statement
the amount it says was paid to you, until you delete the document. We don't keep who paid or
what the bank's line says.
When a firm adds its clients from its Mercury deals, we save each deal's Primary applicant as
a client, with their name, email and date of birth. The deal's other applicants' names and
dates of birth, and its properties and home loans, come in as drafts, and nothing reaches that
client's records until the firm accepts it. Apart from each deal's name and Mercury's ids,
kept so nothing comes in twice, we keep nothing else Mercury holds about a person. A deal's
other debts, and contacts on no deal, stay in Mercury.
If you add your Coming up dates to a calendar, the calendar you choose, such as Google, Apple or
Microsoft, fetches each date and its short title from a private link and keeps them under its
own terms. End access on the link and it stops.
When you link your household to a firm, everyone at that firm can read the figures in the view
you pick, until you or the firm ends access. They can open and download the documents you've filed only while you have Share documents on, and only within that view. We keep a record of each one they open or download, which you can read on the firm's page under Who sees these records. A document still waiting for your review isn't shared. If you add a picture to your
account, everyone at that firm sees it beside your name, until access ends. If your firm adds a logo,
each household that shares with it sees it beside your business name, until access ends.
The website, application and database are hosted in Australia. Stripe, Resend and Google may
store or process the information they receive outside Australia, including in the United States.
The document reading service reads documents in the United States. PostHog keeps the page views
it counts in the EU.
Information held in a provider system is also governed by our arrangement with the provider, the
provider's privacy terms and applicable law. This policy does not promise a fixed provider
retention period.
We may disclose personal information when the law requires it or when needed to investigate
misuse, protect an account or protect the service.
5. Cookies and browser storage
PropRetire uses secure cookies for signed-in account sessions, information-request sessions and
secure-report sessions. Browser storage keeps the selected theme and active portfolio selection.
Until you register, and for no more than 30 days, it also keeps the tag and Google click id of
the link that brought you. If a firm asks to see your records before you have an account, it
keeps that request for no more than 14 days, until you open it. It keeps the figures you last
entered in the capital gains calculator until you add a property or 30 days pass, so your first
property starts from them. Blocking or clearing these cookies or browser storage can end a
session or reset those preferences. Portfolio financial records and calculated reports are not
stored in browser storage.
6. Security
PropRetire takes reasonable steps to protect personal information, including authentication,
account-to-portfolio authorisation and restricted operational access. No internet service can
eliminate every security risk.
7. Retention and account deletion
Different records serve different account, billing, support, security and legal purposes, so
this policy does not promise one retention period for all personal information. Saved account
and portfolio records are held in the application database for the life of the account unless a
record is deleted through the product. Other operational records may be kept for a different
period according to their purpose, provider rules and applicable law.
We keep documents for the life of the account, even while a subscription has lapsed, until they're deleted. A deleted document goes with every earlier copy after 30 days in the bin, or at once if you empty it. Deleting the household or the account deletes its documents. Our nightly database backups keep a deleted document's name and details, never the document, for 14 days, and copies taken before an update to the app can keep them longer.
Ending paid access does not delete an account. To delete an account, the registered user
requests deletion, confirms the current password and completes a second-factor check when
two-step verification is enabled. PropRetire then records the request and stops current Stripe
subscriptions renewing. Fourteen days later it runs the request: it cancels those subscriptions,
deletes the Stripe customer record with its saved payment methods and permanently removes the
user, account, portfolios, saved records and sent reports from the application database. The
account can be read but not changed during those fourteen days, and the request can be cancelled
until it runs. Cancelling it does not restart renewal. Deletion also removes account-owned local
email-delivery records. A sent report's PDFs and secure link are otherwise kept for seven years.
A Business's information requests and sent reports stay with it when someone other than its
founder leaves.
Stripe keeps the payment and invoice records it must retain after the customer record is
deleted, and deleting the account does not erase records held in another provider system. Those
records remain subject to the provider terms and applicable law.
8. Access, correction and complaints
You can update account and portfolio information available in the product. You can view, download or delete each document we keep from Documents. You can also ask to access or correct other personal information we hold. For those requests,
account deletion questions or a privacy complaint, contact us using the address below. We may ask
for identity information reasonably needed and proportionate to the request, and may need to clarify
the information involved. Applicable law determines the scope and timing of any required response.
9. Questions
Email privacy@propretire.com.au. If you are not satisfied with our response, you may contact the Office of the Australian
Information Commissioner. For account or product questions, use the contact page.