Legal

Privacy & Cookie Policy

Last updated: 15 September 2026

1. Who we are and how to contact us

Homechecker is operated by the registered business name holder operating as Homechecker (ABN 18 890 160 412), based in Melbourne, Victoria. We are responsible for handling the personal information we collect through homechecker.com.au.

For privacy questions, requests under the Privacy Act, or to make a complaint, contact us through the Moyne Ross contact page.

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs").

2. Information we collect from you directly

When you sign up and use Homechecker, we collect:

  • Account information: your email address and the password you choose. We store a hashed version of the password, not the password itself.
  • Profile information you provide: your name, the property the read concerns (its address and any notes you add about it), and any context you choose to share.
  • Evidence you upload (optional): documents, photographs, and files you choose to provide to sharpen the read — for example, building or pest reports, photographs, plans, your own notes, and, if you are a prospective purchaser, a Section 32 / vendor statement or agent communications.
  • Payment information: Stripe handles full card details. We receive order, contact and transaction information used for fulfilment, receipts, credits and refunds. This can include the property description or address and references linked to it. We do not store your full card number.
  • Communications: any messages you send us via email or our contact channels.

3. Information about third parties in your uploads

Files are sent to storage when selected, before the final Continue step. Uploads are optional. Only share material you are entitled to provide, and remove unrelated personal or sensitive details such as identity numbers, signatures and bank information. We use relevant material to prepare your Read, including through the AI providers described below.

An important and sensitive point. The documents you upload often contain information about people other than you — vendors, prior owners, tenants, neighbours, inspectors, and agents. Those individuals have not given us their consent.

In practice, this typically includes:

  • The property's full address, which alone may identify the current vendor;
  • The vendor's name, where it appears on a Section 32, vendor statement, contract of sale, or strata documents;
  • Names of prior owners appearing on title chain, council records, or planning documents;
  • Names and signatures of inspectors, agents, conveyancers, and surveyors who have signed off on documents;
  • Names of current or past tenants where these appear in tenancy schedules, leases, or strata correspondence;
  • Information about neighbours or adjoining properties incidentally captured in photographs, dilapidation reports, or fence-line surveys.

Our approach:

  • We treat all third-party information in your uploads as personal information protected by the Privacy Act and the APPs;
  • We use relevant third-party information to provide and check your Forecast; building observations may also be used as described in section 6;
  • We do not publish or sell private third-party information. Necessary service-provider processing is described in sections 7 and 8;
  • By uploading material, you warrant that you have the right to share it with us (see clause 3.2 of our Terms);
  • Where reasonably practicable, the Forecast we deliver does not reproduce identifying information about third parties from your uploads — we extract structural facts about the building, not names.

4. Information we collect automatically

When you visit homechecker.com.au we collect basic technical server log information: your IP address, browser type and version, the pages you visit, the time and date of your visit, and the referring URL where applicable. This is standard server-side data used to operate and secure the service.

We use Vercel Analytics, a cookieless, privacy-preserving product analytics service, to understand aggregate page views and key product events (for example, that a purchase succeeded or a Forecast was viewed). It does not use cookies, does not identify you individually, and does not track you across other websites. We do not use Google Analytics, Facebook Pixel, or any advertising or behavioural tracking on the Homechecker site, and we do not run advertising or remarketing campaigns based on your browsing behaviour.

5. Cookies

We and our authentication services use cookies or similar browser storage for sessions and site functionality. Vercel Analytics is cookieless; that does not mean the whole site or every third-party service is free of cookies or technical logs.

Address search and maps use Google services. Embedded video can send technical information to its provider when loaded; the Guides video loads after you choose to play it. Providers may use their own storage under their privacy terms. We do not use advertising or remarketing cookies for Homechecker.

6. How we use your information

We use the information we collect to:

  • Produce and deliver your Forecast;
  • Communicate with you about your order, including evidence requests, delivery notifications, and any clarifying questions;
  • Process your payment through Stripe;
  • Operate and secure the service (authentication, session management, abuse prevention);
  • Comply with our legal and tax obligations (including the retention of transaction records);
  • Improve our methodology and calibrate future assessments, as described under "Building intelligence library" below.

We do not use your information to:

  • Market unrelated products to you;
  • Train AI models;
  • Build behavioural profiles for advertising;
  • Share with third parties for their own marketing purposes;
  • Sell to data brokers or any other third party.

Commercial sensitivity. We recognise that the combination of a specific property address, the contents of its documents, and a Forecast indicating repair exposure is sensitive information. If you are a prospective purchaser, it could affect your negotiating position were it to reach the vendor's agent or a competing buyer; if you own the property or are preparing to sell, it is information you would not want disclosed without your say-so. We treat it accordingly: it is never disclosed outside our service-provider chain except as described in this Policy. Its uses include producing and reviewing your Forecast and the building-observation uses below. Internal access is limited to personnel who need it for those purposes.

Building intelligence library. Producing Forecasts builds an internal library of structural facts about buildings — element conditions, indicative costs, construction era, and building characteristics, keyed to the property. We retain and aggregate these building-level facts across assessments to calibrate future analysis. The library contains building observations rather than Customer names, account details or uploaded documents. Property-linked information can nevertheless identify people; removing a name alone does not make it anonymous. Where library statistics inform other customers' assessments, properties are described only at suburb level — never by street address. If you ask us to delete a Forecast, the building observations derived from it are removed from the library as part of that deletion.

7. Third-party AI services and your consent

Cross-border data transfer. Producing the Forecast involves sending your information to third-party AI providers whose servers are located outside Australia, primarily in the United States and other countries where the suppliers operate. Overseas processing does not automatically remove our privacy responsibilities.

We use Google Gemini and Anthropic Claude as part of our analytical pipeline. Relevant property information, documents, images and assessment outputs may be processed by different providers at different stages. The platform is model-agnostic and we may introduce additional AI providers in future; if we do, we will update this Policy and our Terms before any new provider processes your information.

When we send data to AI providers:

  • We use commercial API endpoints that are contractually configured to not train models on the data we send;
  • Provider retention depends on the service, feature and agreement. It can cover service delivery, safety, security and legal needs, rather than abuse prevention alone. Search grounding and other features may have separate retention terms;
  • We do not opt customer evidence into voluntary training-data sharing. Authorised provider review may still occur under applicable service, safety or legal terms; this is not a promise of zero retention or no human access;
  • We do not control AI provider systems and cannot guarantee how they will perform, but we take reasonable steps to choose providers with strong data protection postures.

A statement of our approach to AI in general — including which systems we use, how we govern them, and how we manage risk — is published at moyneross.com/ai.

8. Who we share your information with

We share information only with the following categories of recipient:

  • Stripe Payments Australia Pty Ltd and its global affiliates — for payment processing, fraud prevention, and tax compliance;
  • Supabase, Inc. — for database hosting and authentication, where we store your account and your Forecasts;
  • Vercel, Inc. — for hosting and serving homechecker.com.au;
  • Anthropic PBC — for AI analysis as described in clause 7, on a per-request basis;
  • Resend, Inc. — for sending transactional emails (account confirmations, payment receipts, delivery notifications);
  • Google LLC — for Gemini AI processing as described in section 7, and Google Maps Platform: when you type a property address, the address-autocomplete service is provided by Google; and we retrieve street-level and satellite imagery and geocoding data for the property from Google as part of the public signal set;
  • Victorian Government data services (and equivalent bodies in other states) — we query public property datasets, such as title plan and planning-overlay records, using the property address;
  • Government, regulatory, or law enforcement authorities — only where we are legally required to disclose information, or where disclosure is necessary to protect our legal rights.

We do not sell your information. We do not authorise our service providers to use your information for their own purposes beyond the service, security and legal processing described in this Policy and the applicable agreements.

9. Where your information is stored

We use service providers that store and process data in the United States and other countries where the relevant suppliers operate. Processing location depends on the service and its configuration:

  • Stripe — Australia, United States, and other jurisdictions where Stripe operates;
  • Supabase — primarily the United States (or other regions if we configure them);
  • Vercel — global edge network, primarily United States;
  • Anthropic — primarily the United States;
  • Google — the United States and other countries where its relevant services operate.

By using Homechecker you consent to your information being transferred to and stored in these jurisdictions. We take reasonable steps to ensure overseas recipients handle your information in a manner consistent with the Australian Privacy Principles.

10. How long we keep your information

Our retention practices are:

  • Account information: for as long as your account is active, plus seven (7) years following closure under our existing retention arrangements. This is not a statement that every account field is legally required for seven years.
  • Uploaded evidence: retained while your Forecast remains accessible to you in your dashboard. We delete uploaded evidence on your request, subject to any legal obligation requiring us to retain it.
  • Forecasts: retained in your dashboard indefinitely so you can revisit them. Deleted on request.
  • Payment records: seven (7) years under our existing accounting and record-retention arrangements.
  • Communications: three (3) years from the last interaction, unless longer retention is required by law or for legitimate business purposes (e.g. an active dispute).
  • Server logs: a rolling 90-day window for security and abuse-prevention purposes.

Where we are not legally required to retain information, we will delete or de-identify it within thirty (30) days of a valid request.

Forecasts for properties you no longer need. We recognise that a Forecast for a property you considered and chose not to pursue carries a different sensitivity than one for a home you own. You can request deletion of any specific Forecast at any time, with or without reason, and we will remove it from your dashboard and our active systems within seven (7) days of the request. The associated payment record will be retained for the seven-year tax window in a separate, restricted system. Payment-provider records and linked transaction references may still identify the property. We will explain what must remain and why when responding to your request; this clarification does not retrospectively remove prior deletion commitments.

Archiving a Read hides it from the main dashboard; it does not delete the report or evidence. Deletion requests should also address relevant copied evidence and derived observations. Backup and provider-held copies need to be handled through the applicable deletion or expiry process, with any remaining retention explained to you.

11. Your privacy rights and choices

You can make the requests below. Statutory access and correction rights sit alongside the additional deletion and other choices described in this Policy:

  • Access: ask what personal information we hold about you;
  • Correction: ask us to correct information that is inaccurate, out of date, incomplete, or misleading;
  • Deletion: ask us to delete information we are not legally required to retain;
  • Withdraw consent: withdraw your consent to processing — noting that this may mean we can no longer provide the service to you;
  • Object: object to particular uses of your information;
  • Complain to us: complain about how we have handled your information;
  • Complain externally: if our response is unsatisfactory, complain to the Office of the Australian Information Commissioner at oaic.gov.au.

To exercise any of these rights, contact us through the Moyne Ross contact page. We will respond within thirty (30) days. There is no fee to make an access request. If a reasonable, lawful cost for providing access applies, we will explain it before proceeding.

Expedited response where you have a deadline. If you have an active Forecast and a real-world deadline — an auction, an offer cooling-off period, a contract signing, or another time-critical matter — let us know in your request and we will aim to respond within seven (7) days. For private organisations, the access standard is a reasonable period, generally 30 days. Our thirty-day response period is a service commitment, not a universal statutory deadline. We recognise that where you are working to a deadline, a thirty-day delay can be functionally equivalent to no response at all.

Some rights may be limited where the information is required for legal purposes, where deletion would prevent us delivering a service you have paid for, or where another applicable legal exception applies. Overseas processing alone does not remove our responsibilities. We will explain any refusal or limitation and the available complaint options.

12. Security

We take reasonable steps to protect your information from misuse, loss, and unauthorised access, modification, or disclosure. These steps include:

  • Encrypted transport (HTTPS / TLS 1.2+) for all data in transit;
  • Encryption at rest for stored data in Supabase;
  • Authentication and access controls limiting who can view Customer information;
  • Use of established service providers (Stripe, Supabase, Vercel, Google, Anthropic, Resend) with substantial security programmes of their own;
  • Routine review of provider terms and configurations.

No system is perfectly secure. If we become aware of a data breach that is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme.

13. The AI assistant connector

Homechecker publishes a free, read-only connector (“Homechecker Guides”) that lets AI assistants such as Claude and ChatGPT search and cite our published guides. The connector has no accounts and no login, and it cannot see anything you have uploaded to Homechecker — it serves only the guide library that is already public on this site. See homechecker.com.au/ai for how it works.

When an assistant uses the connector, our application keeps privacy-minimised operational events so we can understand whether the service is healthy and which parts of the public guide library are being used. Those events may include the MCP method or tool name, query length, non-identifying filters such as jurisdiction or property type, result counts, match strength, outcome, duration and a timestamp. For modern MCP requests, the protocol method carried in the Mcp-Method header may be recorded as that method name. We do not intentionally log the raw question, IP address, session identifier, identifying request-header values, names, email addresses or account identifiers at the application layer, and we make no attempt to identify who asked. Because upstream assistants and infrastructure may have their own data practices, keep personal information out of connector queries.

These operational events sit in our hosting provider’s standard application logs for its normal retention period and are used to operate, secure and improve the connector and guide retrieval. For questions about the connector, use the Moyne Ross contact page.

14. Children

Homechecker is not intended for use by anyone under 18 and we do not knowingly collect information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

15. Changes to this policy

We may update this Policy from time to time. The current version is the one published on this page. Material changes will be flagged prominently and, where reasonably practicable, notified to active account holders by email at least fourteen (14) days before they take effect.

16. Contact

For privacy questions, requests under the Privacy Act, or to make a complaint, use the contact page below and mention Homechecker privacy:

Moyne Ross contact page
Homechecker (ABN 18 890 160 412)
Melbourne, Victoria, Australia

← Back to HomecheckerTerms & Conditions →