Privacy Policy

1. Introduction

Brickwise Pty Ltd (ABN pending) (“Brickwise”, “we”, “our”, “us”) operates the Brickwise property investment readiness platform at brickwise.com.au. We are committed to protecting your privacy and handling your personal information in accordance with the Australian Privacy Principles (“APPs”) set out in the Privacy Act 1988 (Cth) (“Privacy Act”).

This Privacy Policy explains the kinds of personal information we collect, how we collect and hold it, the purposes for which we collect, use and disclose it, how you can access and correct it, how you can complain about a breach of the APPs, and whether we are likely to disclose it to overseas recipients. This policy satisfies the requirements of APP 1.4.

2. Kinds of Personal Information We Collect

We only collect personal information that is reasonably necessary for our functions and activities (APP 3). We collect the following kinds of personal information:

• Identity information: Name and email address when you create an account.
• Financial profile data: Household income range, deposit amount, living expenses, existing debts, and other financial details you provide in our questionnaire. This information is used solely for generating your investment readiness assessment and is not shared with third parties for marketing purposes.
• Investment preferences: Goals, investment timeline, risk tolerance, location preferences, and property type interests.
• Payment information: Billing details processed securely by Stripe. We do not store or have access to your full credit card number, CVV, or card expiry date. We receive only a Stripe customer identifier and transaction confirmation.
• Usage data: Pages visited, features used, session duration, device type, browser type, and IP address. Analytics data is collected via PostHog and is used to improve our service.
• Communication data: Records of any emails or support requests you send to us.

We do not collect sensitive information (as defined in the Privacy Act) such as health information, racial or ethnic origin, political opinions, or biometric data.

3. How We Collect and Hold Your Information

We collect personal information:

• Directly from you when you create an account, complete the questionnaire, purchase a report, subscribe to our Pro plan, or contact us.
• Automatically through cookies and similar technologies when you use our platform. See our Cookie Policy for details.
• From third-party services such as Supabase (authentication), Stripe (payment confirmation), and PostHog (analytics).

Collection notice (APP 5): At or before the time we collect your personal information, we take reasonable steps to notify you of:

• Our identity and how to contact us
• The fact that you are able to access the information we hold about you
• The purposes for which we collect the information
• The entities or types of entities to which we usually disclose that kind of information
• Any law that requires the particular information to be collected
• The main consequences if all or part of the information is not provided

How we hold information (APP 11): Your data is stored securely using Supabase (PostgreSQL database hosted on AWS infrastructure in Sydney, Australia). We implement row-level security (RLS) policies ensuring that authenticated users can only access their own data. All data in transit is encrypted using TLS 1.2 or higher. We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure.

4. Purposes of Collection, Use, and Disclosure

We collect, use, and disclose your personal information for the following purposes:

• To generate your personalised Investment Readiness Report and provide our core service
• To process payments and manage your subscription through Stripe
• To send you transactional communications, including report delivery, purchase confirmations, and account notifications
• To send you marketing communications where you have provided your express consent, in compliance with the Spam Act 2003 (Cth). Every marketing email includes a functional unsubscribe mechanism and our sender identity. You can withdraw consent at any time
• To improve our platform, algorithms, and user experience through analytics
• To facilitate broker introductions where you have expressly opted in
• To comply with applicable laws and regulations

5. AI Processing and Automated Decision-Making

We use artificial intelligence (Google Gemini) to generate narrative sections of your Investment Readiness Report. Only de-identified and aggregated data is sent to the AI service — specifically income bands and deposit ranges, not your exact financial figures or any personally identifiable information. All numerical calculations (borrowing capacity, cashflow projections, readiness scores) are computed by our deterministic calculation engine, not by AI.

Automated decision-making disclosure: Our platform uses automated processes to generate investment readiness scores, suburb recommendations, and strategy suggestions based on the information you provide. These outputs are general in nature and are not personal financial advice. In anticipation of the Privacy Act amendments taking effect in December 2026, we disclose that automated processing forms a substantial part of the decision-making involved in generating your report and recommendations.

6. Third-Party Service Providers

We disclose personal information to the following third-party service providers, who process data on our behalf and are bound by their own privacy policies:

7. Cross-Border Disclosure of Personal Information

We are likely to disclose your personal information to overseas recipients (APP 1.4(f) and APP 1.4(g)). Specifically, personal information may be transferred to recipients in the following countries:

• United States: Vercel (hosting), Stripe (payments), Google (AI processing with de-identified data only), Resend (email delivery)
• European Union: PostHog (analytics)

In accordance with APP 8, before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the overseas recipient does not breach the Australian Privacy Principles. We achieve this by selecting service providers that maintain privacy and security standards comparable to Australian requirements and that are bound by contractual obligations regarding data protection.

8. Accessing and Correcting Your Information

Under APP 12 and APP 13, you have the right to request access to the personal information we hold about you and to request correction of any information that is inaccurate, out of date, incomplete, irrelevant, or misleading.

To request access or correction:

• Email us at privacy@brickwise.com.au
• We will respond to your request within 30 days
• We will provide access in the manner you request, if it is reasonable and practicable to do so
• There is no charge for making a request, though we may charge a reasonable fee for providing access if the request requires substantial effort

In limited circumstances, we may refuse access or correction in accordance with the exceptions set out in APP 12.3 or APP 13.3. If we refuse, we will provide you with written reasons and information about how to complain.

9. Complaints

If you believe we have breached the Australian Privacy Principles, you may lodge a complaint with us:

• Step 1: Contact our Privacy Officer at privacy@brickwise.com.au with details of your complaint
• Step 2: We will acknowledge your complaint within 7 days and investigate within 30 days
• Step 3: We will provide you with a written response outlining the outcome of our investigation and any steps we will take

If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC):

• Online: www.oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

10. Data Retention

We retain your personal information only for as long as is reasonably necessary for the purposes for which it was collected, or as required by law. Specifically:

• Assessment data: Retained for 12 months to allow you to revisit your results
• Generated reports: Retained for 24 months
• Account information: Retained while your account remains active and for a reasonable period afterwards
• Payment records: Retained as required by Australian taxation law (typically 5 years)

You can request deletion of your personal information at any time by contacting privacy@brickwise.com.au. We will take reasonable steps to destroy or de-identify personal information once it is no longer needed, in accordance with APP 11.2.

11. Cookies and Similar Technologies

We use cookies and local storage for authentication, session management, and analytics. For full details, please see our Cookie Policy.

12. Marketing Communications and the Spam Act

We comply with the Spam Act 2003 (Cth). We will only send you commercial electronic messages (including marketing emails and newsletters) where you have given your express or inferred consent. Every marketing communication we send will:

• Clearly identify Brickwise Pty Ltd as the sender
• Include our contact information
• Contain a functional unsubscribe mechanism that we will honour within 5 business days

You can opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting privacy@brickwise.com.au. Opting out of marketing communications will not affect transactional emails (such as purchase confirmations and account notifications).

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the updated policy on our website with a revised “Last updated” date. We encourage you to review this policy periodically.

14. Contact Our Privacy Officer

If you have any questions about this Privacy Policy, wish to exercise your rights, or need to make a complaint, please contact our Privacy Officer:

• Email: privacy@brickwise.com.au
• Entity: Brickwise Pty Ltd