Privacy Policy
Effective: 28 September 2026
Information we handle
We handle account names, email addresses, password hashes, verification status, optional Google account identifiers, session/authentication tokens and admin MFA records. Property data includes addresses, coordinates, listing details/media and authority declarations. Activity includes saved properties, conversations/messages, attachments, read receipts and offers/history. Consultant data includes profiles, services, rates, optional licence/ABN/business details, declarations and enquiries. We also handle subscription/provider references, legal acceptances, reports, operational email records, rate-limit records and basic view counts.
Collection and purposes
Information comes from you, other users communicating with or reporting you, and providers such as Stripe for payment status or Google when you choose sign-in. We use it to operate accounts, publish requested content, enable communication, manage subscriptions, support users, protect the service, assess reports and meet applicable obligations. Without necessary information, some features cannot be provided.
Payments and security
Full card details are entered with Stripe, not collected in our application forms. Passwords and session tokens use hashes; admin accounts require MFA. Access controls protect private records. Messages are not end-to-end encrypted. No online service can guarantee absolute security. We assess incidents and notify affected people or authorities where applicable law requires.
Public content and conversations
Published listings include addresses, descriptions, media and displayed lister details; Consultant profiles contain information selected for publication. Public listings can appear in search/social previews, and sold/leased historical pages may remain accessible. Third-party copies can persist after removal. Account email addresses are not public seller contact details. Conversations are available to participants; authorised admins may review reported messages or conversations for moderation, with access logged. Avoid uploading unnecessary sensitive information or others’ information without an appropriate basis.
Providers
The architecture uses Stripe for payments, Resend for operational email, Cloudflare R2/S3-compatible media storage, DigitalOcean hosting and optional Google sign-in. Maps request tiles from Esri ArcGIS and OpenStreetMap, which receive technical request information and requested tiles. Autocomplete uses an imported GeoNames-derived catalogue; this does not send each search to GeoNames. Provider handling also depends on their terms and our arrangements with them.
Overseas handling
Providers and subprocessors may handle information outside Australia. An Australian website or storage choice does not mean all information stays in Australia. Contact us for information about relevant provider arrangements. We consider applicable requirements when arranging overseas handling and do not claim a Privacy Act exemption.
Retention
We retain records for operation, security, disputes, billing and legal needs. Removing a listing does not immediately erase messages, offers, billing records, reports or backups. Backup copies may persist for a limited period under backup-retention processes. Some records form part of other participants’ communications. We use purpose-based retention criteria rather than one universal period and will not retain information indefinitely without purpose.
Access, correction and closure
For account closure, access, correction, privacy complaints or deletion/removal requests, contact contact@forsaleasap.com.au. Closing an account, withdrawing a listing, cancelling a subscription and deleting records are different actions. Explain which actions you request. Records may reasonably remain for billing, security, disputes, legal obligations and other participants’ messages. There is no general self-service export or deletion tool. We may seek proportionate identity information before releasing or changing private data. Requests are assessed under applicable law; where records reasonably must remain, we explain the relevant reason where permitted.
Current emails are operational/transactional, including account verification, security and relevant marketplace activity. Receiving these emails does not constitute permission for unrelated marketing. No marketing-consent system is introduced.
Privacy complaints and changes
Contact contact@forsaleasap.com.au with privacy concerns. We assess and respond to complaints; applicable rights to approach the OAIC or other authorities are not restricted. We update this policy when practices change and provide appropriate notice of material changes.