Privacy policy

Last updated: <TBD-by-lawyer>

This privacy policy explains how Campaign OS Pty Ltd ("we", "us", "our") collects, uses, holds and discloses personal information. It applies to our software-as-a-service platform at <TBD-domain> and any related services (the "Platform").

We are bound by the Australian Privacy Principles (APPs) under the *Privacy Act 1988* (Cth) and the Notifiable Data Breaches scheme.

1. What we collect

We collect the following categories of personal information:

• Account information — name, email, phone number, role, the office you belong to.
• Vendor + property information — the names, addresses, contact details and property attributes that your real-estate agency stores in the Platform about its clients (sellers / vendors).
• Marketing campaign data — the artwork, schedules, budgets and supplier records associated with campaigns you run on the Platform.
• Usage data — IP address, browser type, pages viewed, error reports. Used for diagnostics + service improvement.
• Financial information — payment-method tokens (we never see card numbers — Stripe handles those) and invoicing details.

We do not knowingly collect sensitive information as defined by the Privacy Act.

2. How we collect it

• Directly from you when you create an account, configure your office, or load campaigns.
• Automatically when you use the Platform (logs, telemetry).
• From third parties only when you authorise the connection — e.g. AgentBox, Xero, Stripe, Campaign Track.

3. How we use it

• To provide the Platform's core functionality (quote generation, supplier coordination, reconciliation, reporting).
• To deliver transactional communications (signing links, variation requests, invoice statuses).
• To diagnose and fix software issues.
• To send service updates and security notices.
• To meet our legal and regulatory obligations.

We do not sell your personal information.

We do not use your campaign data to train AI models. Where the Platform uses AI features (Claude for semantic matching, Google Document AI for invoice extraction), prompts and outputs are processed in-flight and not retained for model training. See "<TBD-by-lawyer: vendor sub-processor list>" below for current providers.

4. Disclosure

We may disclose your personal information to:

• Subprocessors that operate parts of the Platform — Supabase (database hosting, Sydney region), Clerk (authentication), Vercel (web hosting), Stripe (payments), Anthropic (AI semantic matching), Google (Document AI for invoice OCR), Sentry (error tracking), BetterStack (log management).
• Your authorised integrations — AgentBox, Xero, and the suppliers you connect to the Platform.
• Law enforcement and regulators where required by law.

A current list of sub-processors is available at <TBD-domain>/legal/subprocessors.

5. Cross-border data transfers

We store production data on Australian infrastructure (Supabase Sydney region). Some sub-processors (Stripe, Anthropic, Google, Vercel, Sentry, BetterStack, Clerk) may process data outside Australia in the course of providing their service. In each case the sub-processor's standard contractual clauses require equivalent privacy protections.

6. Security

We protect your personal information through:

• Row-level security in the database — every record is tagged with a tenant identifier; cross-tenant reads are blocked at the database layer.
• Encryption in transit (TLS 1.3) and at rest (Supabase / AWS encryption).
• Multi-factor authentication on administrative accounts via Clerk.
• Audit logging on sensitive actions (auction date changes, financial mutations, integration credentials).
• Regular security reviews and penetration tests.

Despite these measures no system is impenetrable. If a notifiable data breach occurs we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme.

7. Retention

We retain personal information for as long as needed to deliver the Platform plus any period required by law. When your agency terminates its account we will delete or de-identify your data within 90 days unless we are required to retain it (e.g. financial records under the *Income Tax Assessment Act*).

8. Your rights

Under the APPs you can:

• Request access to the personal information we hold about you.
• Request correction of inaccurate personal information.
• Make a complaint about how we handle your personal information.
• Opt out of marketing communications (transactional notices cannot be opted out of).

To exercise any of these rights, email <TBD-by-lawyer: privacy@domain>. We will respond within 30 days.

9. Cookies + tracking

The Platform uses essential cookies for authentication (Clerk session cookies) and a small number of operational cookies for error correlation. We do not use third-party advertising cookies.

10. Children

The Platform is a B2B SaaS for real estate professionals. We do not knowingly collect personal information from anyone under 18.

11. Changes

We may update this policy from time to time. Material changes are notified to active customer admins by email at least 30 days before they take effect.

12. Contact

Privacy questions:

<TBD-by-lawyer: privacy@domain>

Postal:

<TBD-by-lawyer: registered office address>

If you are not satisfied with our response you may contact the Office of the Australian Information Commissioner:

https://www.oaic.gov.au

Status: TEMPLATE — DO NOT PUBLISH WITHOUT LEGAL SIGN-OFF.

This template is a starting point only. Sections marked `<TBD-by-lawyer>` require legal review before the policy goes live. Confirm with counsel that the sub-processor list, retention periods, and cross-border transfer clauses match the current commercial arrangements.