Privacy Policy

What we collect

When you use ReefReport we collect: your email address and password (via our authentication provider), the property addresses you search, payment information processed by Stripe (we never see or store your full card number — Stripe handles this directly), a card fingerprint used only to flag likely duplicate purchases, and the reports we generate for you.

How we use it

We use this information to generate and deliver your property reports, process payment, prevent abuse (duplicate-purchase detection via card fingerprint), and retain your report history so you can access what you paid for at any time, indefinitely, without paying again.

Third parties

We send address and location data to Victorian government spatial services (Vicmap), the Australian Bureau of Statistics, and Geoscape (for address resolution) to generate your report. We use Anthropic’s API to generate the plain-language analysis sections of your report — the property address and relevant planning data are sent to Anthropic for this purpose. We use Stripe for payment processing and Resend for transactional email. None of these providers use your data for their own marketing purposes.

Data retention

Paid reports are kept indefinitely so you never lose access to something you paid for. Each paid report is a dated snapshot of the planning data as it stood when you purchased it, and we never edit or delete these snapshots — that permanence is deliberate, so that you (and anyone you later share the report with) can trust it still shows exactly what was true at the time, and so our own records stay consistent.

Account data — your email address, password, and other profile details — is kept for as long as your account is active, and you can request its deletion at any time by contacting us (see below). Deleting your account removes this personal information, but paid report snapshots are retained as described above.

Overseas disclosure

Some of the third parties listed above are based overseas or run infrastructure located outside Australia — notably Anthropic (United States) for report analysis, and PostHog (United States, for our product analytics). When we send data to these providers as described above, it may be processed on servers located outside Australia. We choose providers with their own privacy and security commitments, but we cannot guarantee those overseas recipients are bound by the Australian Privacy Principles in the same way we are.

How we protect your information

We use industry-standard measures to protect the personal information we hold, including encrypted connections (HTTPS/TLS) between your browser and our servers, encrypted database connections, and access to production systems restricted to the people who operate ReefReport. Payment card details are handled entirely by Stripe — we never see or store your full card number. No method of storing or transmitting data is completely secure, so while we work to protect your information we cannot guarantee its absolute security.

Your rights

You can request a copy of the personal information we hold about you, ask us to correct it, or ask us to delete your account and personal details (paid report snapshots are retained as explained under Data retention). Contact support@reefreport.com.au for any of these requests.

Complaints

If you have a concern about how we’ve handled your personal information, contact us first at support@reefreport.com.au so we can try to resolve it directly. If you’re not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Analytics

We use PostHog to understand how the product is used (e.g. where people drop off between searching an address and completing a purchase), so we can improve it. This does not include the content of your property reports.

Contact

Questions about this policy: support@reefreport.com.au