Privacy Policy

What we collect

• Account details: your name, your email address and your password (stored only as a hash). We also hold your email verification status, and, if you turn it on, your two-factor authentication secret and backup codes.
• Property addresses: every address you search, including the pre-check you run before paying and, if you use it, the point you click on the map to confirm the right property. Addresses are collected even if you never buy. We also keep the reports generated for you.
• Payment information: payments are taken by Stripe, and we never see or store your full card number. From Stripe we keep a customer ID, a payment ID, the card brand, the last four digits, and a card fingerprint (used only to flag likely duplicate purchases), plus the amount, status and date of each payment and any refund.
• Order records: when you accept our terms at checkout we record the time you accepted and the version of the terms.
• Sign-in and technical data: when you sign in we store your session, including the IP address and browser details it was created from. Our servers also keep operational logs. We set a cookie to keep you signed in, and another to tie an address pre-check to your browser until you sign in.
• Emails: we send transactional emails only (email verification, password reset, your tax invoice and account notices). We do not send marketing emails.
• Usage analytics and error monitoring: we use PostHog to see how the site is used (page views, interactions and purchase steps) and Sentry to record software errors. Either may be switched off at times. Neither is used to show you advertising.

The planning data in a report (zone, overlays, site measurements, neighbourhood statistics) comes from public sources and describes the property, not you. But the address you search is linked to your account, so we treat it as personal information.

Why we collect it

To generate and deliver the reports you ask for, keep your report history available to you, take payment and issue tax invoices, keep a record of the terms you accepted, detect duplicate purchases and misuse, support you when something goes wrong, and understand how the product is used so we can improve it. We do not sell your personal information.

Who we share it with

We use the following service providers, and send them only what they need for the job:

• Stripe: payments, and the email address on your payment.
• Resend: sends our emails, so it handles your email address and the content of each email, including the property address on your tax invoice.
• Anthropic: produces the automated “Analysis” sections. We send it the property address and the planning data and clause text for that property. We do not send your name or email.
• Government and data providers: to build a report we send the address or its location to Victorian government spatial services (Vicmap), the Australian Bureau of Statistics and, for address matching, Geoscape. We also fetch planning clause text from PolicyPing, a related service, by council and clause number only. No address or personal information is sent to PolicyPing.
• PostHog and Sentry: analytics and error monitoring, as described above.
• OpenStreetMap: the maps in ReefReport load map tiles directly from OpenStreetMap servers, so your browser sends them your IP address and the map area being viewed.

We may also disclose information where the law requires it, for example to a court or regulator.

Overseas disclosure

Some of these providers handle data outside Australia. Anthropic and PostHog are in the United States, and Stripe, Resend, Sentry and OpenStreetMap run international infrastructure. We choose providers with their own privacy and security commitments, but we cannot guarantee that overseas recipients are bound by the Australian Privacy Principles in the same way we are.

How long we keep it

Paid reports are kept indefinitely. A paid report is a dated record of what the planning data showed when you bought it, and we do not edit or delete it, so that you can rely on it later. Payment records are kept for accounting and tax purposes. Account details are kept while your account is active.

Your choices

You can see your reports any time in your account. To get a copy of the personal information we hold about you, correct it, or have your account deleted, email support@reefreport.com.au from your account email address. We handle these by hand, so please allow a few business days.

What deleting your account does. We remove your login, name and email address and you can no longer sign in. We keep the reports and the payment records of purchases you made, but they are no longer linked to you in our system. Because reports contain the property address, an address you searched can still be in our records after your account is deleted. We also keep a short internal record that the deletion happened, including the name and email it applied to, so the deletion can be audited. Stripe may keep its own records of your payment under its own policies, and deleting your ReefReport account does not remove those.

Security

We take reasonable steps to protect your information. Connections to our servers are encrypted, passwords are stored hashed, card details stay with Stripe, and access to our systems is limited to the people who operate ReefReport. No online service can guarantee perfect security.

Complaints

If you are concerned about how we have handled your personal information, contact us at support@reefreport.com.au and we will try to resolve it. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Not advice

A ReefReport is a screening snapshot, not planning, legal or financial advice. See our Terms of Service.

Changes to this policy

We may update this policy as the product changes. We will change the date at the top when we do.

Contact

support@reefreport.com.au