Privacy policy

Who we are

This policy belongs to Redigi Pty Ltd, ACN 683 525 859, ABN 46 683 525 859, of PO Box 2, Brunswick South VIC 3055, Australia, trading as Suburb Reports. In this policy, "we", "us" and "our" mean Redigi Pty Ltd.

Suburb Reports is the product behind the campaign pages published on suburbreports.au. Each page is built and run for the real estate agency selling the property it describes, and it wears that agency's brand rather than ours. This is the one privacy policy we publish for all of them.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles, and we do not rely on the small business exemption, whatever our turnover. We also follow the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth) and the Australian Consumer Law.

What this covers

This policy covers suburbreports.au, every campaign page published on it, and the emails sent from those campaigns.

It replaces the privacy notice that individual campaign pages carried in their own footers. Where a page still carries one, this document governs.

The selling agency is a separate business with its own privacy policy and its own obligations. This document says what we do. It does not speak for them, and it does not displace what they publish.

Who collects it, and who it is for

This is the part most marketing companies leave vague, so we will be specific.

The enquiry is for the selling agent, and the agent owns it. When you ask for the documents on a campaign page you are asking the agency selling that property. Your details go to them and into their records: that is how they get the documents to you and answer your questions. That enquiry is theirs.

We are the ones who collect it, and we would rather say so than hide behind the agency's brand. The page is ours, the form is ours, the record is written into our database, the personal link we email you is signed with our key, and the emails leave our systems. Under Australian law an entity that collects and holds personal information carries the obligations of the Privacy Act for what it holds. So we carry them for our copy and the agency carries them for theirs, and neither of us can point at the other.

We hold it to run that agency's campaign, and for nothing else. We act on the agency's instructions for their campaign. We do not use your enquiry for our own marketing, we do not add you to a list of our own, and we do not offer you anything of ours on the back of it.

One agency's information never reaches another. Enquiries, contacts and advertising audiences built for one agency are never pooled with another's, never carried across when a campaign or a client relationship ends, and never sold. There is no shared pot of leads behind the scenes. Audiences are built per campaign, for the property being advertised. The advertising dataset that measures our campaign pages is held by us rather than by each agency, and section 9 explains that plainly, including why it does not weaken anything in this clause.

What travels between campaigns is method, not people. We learn what works, for instance that someone who opens a statement of information is likelier to register for the auction. That kind of learning is a number, not a person, and no individual travels inside it.

When an agency stops working with us, we stop using what we hold for them, and we act on their instruction about what happens to it. Our right to use it at all only ever existed so that we could run their campaign.

What we collect

From the enquiry form. A campaign page asks for what the agent needs in order to answer you. Today that is your name, your email address, your phone number, and your answer to one question about where you are at with the property. A page may ask for slightly more or less; whatever it asks is on the page in front of you, and that is the whole of it.

The one field you cannot see. The form carries a single hidden box that a person never sees and never fills in. It exists to catch automated spam, and anything submitted in it is discarded rather than stored. We mention it because "there are no hidden fields" would not be true, and a policy that shades the truth on a small thing is worth nothing on a large one.

What we record alongside your answers. Which campaign and which property you enquired about, which agency it is for, the address of the page you sent it from, and the time.

What the form does not take. When you send the enquiry we do not record your IP address or your device with it. Being straight about the limit of that: on a page carrying the advertising pixel, sending the form is one of the events reported to Meta, and any request a browser makes reveals its own address to whoever receives it. So we are telling you what our record does not contain, which is worth saying, rather than claiming your address went nowhere. Section 7 says what the pixel sends and section 8 says what submitting the form sends with it.

What we do not want at all. We do not seek sensitive information as the Privacy Act defines it, such as health, race or political views. Please do not send it to us.

Where a campaign page carries advertising tracking, section 7 sets out what that collects and section 8 sets out what is sent to the advertising platform.

Your documents link, and what is recorded

After you ask for the documents we email you a link that is personal to you. It carries a signed code that identifies your enquiry, which is what lets the page know who is opening it.

Each time that link is opened we record it: the time, the browser and device it was opened in, and the page that sent you there. We do not record your IP address.

Why. So the vendor can be told honestly how many buyers actually read the documents. That is the whole purpose, and it is why the link is personal rather than general.

Because the link identifies you, passing it on means someone else's reading is recorded as yours. If a colleague, accountant or solicitor needs the documents, they can ask for their own.

What that link is not. Putting a page behind a link is not a security measure and we do not present it as one. Treat a campaign page as a public place.

Calculators and tools on the page

Some campaign pages carry a calculator, for instance a yield table you can put your own rent assumption into.

Those tools run entirely in your browser. Nothing you type into them is sent anywhere, nothing is saved, and we cannot see what you entered. There is no obligation for us to manage over figures we never receive.

That holds even on a page carrying an advertising pixel. The matching described in section 8 takes contact details from the enquiry form when you submit it. It does not read a calculator, and a rent or a yield you were testing is not sent to an advertising platform. We are saying so because "nothing is sent anywhere" is a strong sentence to leave standing on a page that does send some things, and it should be clear which is which.

What a calculator produces is arithmetic on an assumption you supplied. It is general information rather than advice, and the terms of use say more about that.

Cookies, tracking and advertising

Campaigns differ, so this section says what happens rather than which switches are on today. One campaign is advertised on Meta, another is not advertised at all, a later one may run somewhere else. A policy pinned to one campaign's settings would be wrong the week a different campaign started, and this one document governs all of them. So everything below is written as where a campaign is advertised, this is what happens. The condition is about which campaigns. What follows the condition is exact.

You can find out which of it applies to the page you used, from a person. Email privacy@suburbreports.au and we will tell you what is running on that particular campaign. We put that here deliberately, because a policy written to cover several possibilities must never become a way of avoiding a straight answer to somebody who asks a direct question.

Where a campaign page is advertised, that page carries that platform's advertising pixel. It records that the page was viewed and that the enquiry form was successfully sent, and it sets a cookie in your browser so that the platform can recognise the same browser again. It is there for the ordinary two reasons: so the agent and the vendor can be told honestly what the advertising achieved, and so the campaign can be shown a second time to somebody who has already looked at that property. On Meta, being Facebook and Instagram, that is the Meta pixel.

On such a page, submitting the enquiry form also sends a scrambled form of your email address and phone number to that platform, so that it can match you to your account. That is Advanced Matching, it is the most consequential thing in this section, and section 8 sets it out in full rather than leaving it as a line in a table.

Where a campaign page carries an analytics tag, it measures how the page was used, separately from the advertising measurement above. That is the same shape of thing and it is in the table below with everything else.

A page behind a personal documents link never carries an advertising pixel. That link identifies one named person, so measurement on the page it opens would tell an advertising platform that a particular individual read the documents. We will not do that on any campaign. It is a standing rule rather than a setting, and it is not something a later campaign can quietly switch on. What is recorded on those pages is section 5, and it stays between you, us and the vendor's report.

Separately, and on every page. Each page loads its typeface from Google Fonts, which tells Google the address you connected from and the browser you used. That is not tracking and it sets no cookie, but it is not nothing, so we name it.

The full set, named once. Each row says when it applies as well as what it does.

The platforms. Meta, being Facebook and Instagram, and Google. We also name TikTok, LinkedIn, Pinterest and X · not in use yet. That list is not closed. Where a campaign is advertised on a platform not named here, everything in this section and in section 8 applies to it in the same terms, and section 14 names the country it sits in. Naming a platform ahead of use is how this policy stays true without an amendment the day a campaign starts somewhere new.

If a page is tracking you, that page will tell you. A campaign page carrying advertising measurement says so on the page, rather than relying on you finding this document. That is how you can tell, without asking, which of this section applies to the page in front of you.

How to turn it off. Block cookies in your browser, or use a tracker blocker, though parts of a page may then not work. Use the advertising controls inside your own Facebook or Instagram account, or the equivalent controls on any other platform named above. Either works on its own.

What unsubscribing does and does not reach, said plainly. Unsubscribing stops our emails and takes you out of any audience we built from a list of our own. It does not pull you out of an audience a platform assembled from browser events, because that audience is a set of browsers and carries no email address for an unsubscribe to match you against. We would rather tell you that than let you believe one click covered it. To be removed from advertising audiences, email us as section 18 describes, and use your own account's advertising controls, which reach the half we cannot.

Advanced Matching

This gets its own section, because it is genuinely not obvious and most policies bury it.

What happens, in one sentence. Where a campaign is advertised on a platform named in section 7, submitting the enquiry form on that campaign's page sends a scrambled form of your email address and phone number to that platform, so that it can match you to your account and tell us whether the advertising worked. This is not a possibility we are reserving. It is what the page does when you press the button. On Meta, being Facebook and Instagram, that is what happens today.

How the scrambling works. Your details are put through a one-way process called hashing before they are sent, along with your name or location where the page holds them. The platform hashes the details it already has the same way and compares the two. If they match, the platform knows the person who took the action is one of its users.

Being straight with you about what that means. Hashing means we are not handing over your email address as text, and a hash cannot practically be turned back into it. But hashing is not anonymity. The whole purpose is that the platform identifies you. It remains your personal information, and sending it remains a disclosure. Anyone who tells you hashed data is anonymous is being loose with the word.

Uploading a list is its own disclosure. Where we build a custom or lookalike audience by giving a platform a list, that list is hashed first, and sending it overseas is a cross-border disclosure under Australian Privacy Principle 8 in its own right, separate from anything a pixel or an API sends from the page. It is a different act with a different reason, and it does not ride along on the pixel's disclosure.

Server-side sending does not change any of this. Where events go from our server rather than from your browser, the same hashed details reach the same platform for the same purpose. A blocker in your browser will not see it, which is exactly why it is named here rather than left to be discovered.

Where it goes. The platform's country is in the section 14 table. Meta is in the United States and operates globally, so this is one of the disclosures that section covers.

Why we do it. So a vendor's advertising budget is not spent showing the campaign to the wrong people, and so the agent can be told honestly what the advertising achieved. An agent who cannot tell which advertising produced the enquiries is guessing with somebody else's money.

The notice is on the form itself, not only here. The short line under the send button on a campaign page says this before you type anything, because being told at the moment you hand something over is worth more than being told in a document you would have to go looking for.

How to stop it. This one is honest rather than comfortable: the sending happens as you submit the form, so the way to prevent it is not to submit that form, and to ring the agent instead. The number is on the campaign page. After the event, use the advertising controls inside your own Facebook or Instagram account, and email us as section 18 describes to be removed from the audiences we control. Unsubscribing stops our emails, and section 7 explains what unsubscribing does not reach.

Whose pixel, whose audiences

The advertising dataset on this domain is ours. suburbreports.au is Redigi's domain and the campaign pages on it are ours, so where a campaign here is advertised, the dataset that measures it is held by Redigi and shared across the campaigns we run. It is one dataset, not one per agency. We would rather say that in a sentence than let you infer something tidier, and an agency that would rather its campaigns ran on a dataset of its own can have that.

The agency still owns its own pixel, on its own properties. An agency's own dataset, on its own website and its own listings, is theirs: our services agreement says so in terms, at clause 17.2(b), and that has not changed. What we are describing here is a different thing on a different domain, and one does not swallow the other.

The advertising account the campaigns run from is ours, and the experience it accumulates is ours.

What we hold ourselves to, which is the part that actually protects you. Audiences are built per campaign, for the property being advertised, and are never pooled across agencies. One agency's audiences and enquiries are never used for another agency's campaign, never carried across when a campaign or a client relationship ends, and never sold. A shared dataset does not change that, and we are not relying on separate datasets to enforce it: clause 22.3(b) of our agreement requires us to stop using an agency's data on termination, the Privacy Act bars repurposing information collected for one business to a competitor, and Meta's own custom audience terms prohibit passing audiences to another advertiser. Three separate things, none of which a shared dataset touches.

What that means if you are an agency reading this. Ending with us does not hand you this dataset, because it was never only yours. It does oblige us to stop using what we hold for you, and clause 22.3(b) gives you the election over your own data at our cost. If you would rather your campaigns ran on a dataset of your own, say so and they can.

Emails, and how to stop them

What you will be sent. Having asked for the documents on a campaign, you get the documents and the things that follow for that same campaign: a schedule the day it is released, a registration link the day it lands, a change to an auction time. That is what you asked for, and it is the whole of what we send.

Every message identifies who sent it and carries a working unsubscribe. You can also simply reply to any of them with the word unsubscribe.

One step, and it holds. Unsubscribing stops the campaign emails permanently. You only have to say it once, and you do not have to say it again for each later send: every send checks first.

We keep a minimal record of that unsubscribe permanently, because forgetting it would mean contacting you again after you told us not to. That retention protects you rather than us.

Unsubscribing from us does not unsubscribe you from the agency. They hold their own copy and send their own messages. Tell us and we will tell you exactly who to contact there, rather than leave you working it out.

To stop everything at once, or to ask us to take you out of advertising audiences we control, email privacy@suburbreports.au.

Chat and messaging

Where a campaign runs chat or messaging, this is what happens. It covers a chat window on a campaign page, a click-to-message advertisement, a direct message or a comment reply on the agency's Facebook or Instagram account, SMS, and any messaging platform a later campaign uses. As with the enquiry form, the conversation is with the selling agency and it wears their brand, and as with the enquiry form our software is receiving, storing and answering it. That is the thing worth knowing.

What a conversation collects. What you write, the buttons you tap, the property you asked about, the advertisement that brought you, any contact details you give, and the identifier the messaging platform gives you. On Facebook and Instagram that identifier is a Page-scoped ID, a code that identifies you to that page and to us without being your account name. The message history is kept with it, because a conversation you have to start again is not a conversation.

Who carries it. The platform carrying the message holds it, because it carries it. We store the conversation in our own database in Sydney. Where a model drafts a reply, the content of your message is sent to Anthropic in the United States, and under our agreement with them business data sent through their interface is not used to train their models.

ManyChat, while it lasts. Some conversations still pass through a third-party chat platform called ManyChat, which we are replacing with our own system. While they do, your messages and subscriber record are handled in ManyChat's systems in Germany. When a conversation moves across, that stops.

Ongoing messaging, and the consent position. After you message a page, the platform allows a limited period to reply. To message you after that window we need you to opt in, and we will ask plainly rather than assume. That opt-in is recorded with the evidence of how you gave it, it is a real choice, and you can withdraw it at any time by replying stop, by saying so in the conversation, or by emailing privacy@suburbreports.au.

Comments. Where you comment on a campaign's post or advertisement, we may reply publicly under the comment and privately in a message. We do not delete or hide your comment.

What it does not touch. A conversation is not the personal documents link, and the standing rule in section 7 holds whatever else is running: a page behind that link never carries an advertising pixel. Conversations are kept as section 15 sets out, and one agency's conversations never reach another, which is section 3.

Software, and what it does not decide

We use software throughout this, and we would rather tell you plainly than leave you guessing.

What is not decided by software at all. No computer decides whether you can buy a property, what price you are offered, or whether an agent will deal with you. Those are decisions people make, at the agency.

What software does. It takes the form, it sends the emails, it records that a personal link was opened, and, where advertising runs, it groups people into advertising audiences based on what they engaged with. Where enquiries are put in an order for an agent to work through, software does that too.

If a campaign page ever answers you automatically, that page will say so, and you will be able to ask for a person. We will not let anyone believe they are talking to a human when they are not, including by saying nothing.

Who else sees it

We disclose personal information to:

• The selling agency named on the campaign page you used. This is the point of the enquiry, not a side effect of it.
• Advertising platforms, where a campaign is advertised, as described in sections 7 and 8. Meta and Google today, with TikTok, LinkedIn, Pinterest and X named though not yet in use, and any other platform a campaign is advertised on.
• Messaging platforms, where a campaign runs chat or messaging, as described in section 11. Meta carries Messenger and Instagram messages by necessity, and ManyChat is the chat bridge still in use on some conversations.
• The suppliers who run the machinery, named, because a list of categories tells you nothing: Supabase (the database, hosted in Sydney), Cloudflare (page hosting and delivery), Google (the Workspace account the campaign emails send from, and the typeface the pages load), Resend (delivery for some of our email), Anthropic (the models that draft a chat reply), and the automation service that carries an enquiry from the form to the email that answers it.
• Professional advisers such as accountants and lawyers, where a matter needs them.
• Anyone we must tell by law, or to protect someone's safety.

We do not sell your personal information, and we do not share one agency's enquiries with another.

Outsourcing does not move our responsibility. If a supplier we chose mishandles your information, that remains our problem to answer for.

Our services agreement requires every agency to handle the information we pass them lawfully and properly. That is a term of the agreement, not a hope.

If our business is ever sold or merges, information may transfer with it. Whoever took it on would be bound by this policy, or would have to tell you before anything changed.

Links to other places. Campaign pages and the emails link to places we do not run, including the agency's own site, portals and auction platforms. Once you follow a link you are on their territory and their privacy practices apply, not ours.

Sending information overseas

Our database is hosted in Sydney, Australia, so your enquiry sits in Australia.

Some of the suppliers and platforms above are overseas, so depending on the campaign and how you dealt with it, information can be handled in these places.

The one we have not settled. The automation service that carries an enquiry from the form to the email answering it may handle that information outside Australia. We are confirming exactly where before we name a country, and we would rather tell you that we are still checking than name one we have not checked.

Before we send personal information overseas we take reasonable steps to see that it is handled consistently with the Australian Privacy Principles.

A platform marked "not in use yet" is one we offer but have not run for anybody. It is named because we would rather list it once than quietly add a country later, but nothing has gone there. Where a campaign is advertised on a platform not named above, it is subject to the same steps and this table is updated with the country it sits in.

How long we keep it

We keep personal information only while we need it, then destroy it or strip it of anything that identifies you.

That last one is the exception worth explaining. If you unsubscribe we keep a minimal record of it forever, because forgetting that you opted out would mean contacting you again after you told us not to. That retention protects you rather than us.

The agency keeps its own copy on its own schedule. Ours ending does not end theirs.

Keeping it safe

We protect your information with access controls, encryption in transit, credentials held in a secure vault rather than in code, and access limited to the people who need it.

No system is perfectly secure. If a data breach happens that is likely to cause you serious harm, we will assess it promptly and notify you and the Office of the Australian Information Commissioner as the law requires.

Your rights

You may:

• Ask what we hold about you, and get a copy.
• Correct it if it is wrong or out of date.
• Stop the emails at any time, in one step.
• Ask us to delete it, as described in section 18.
• Ask how we got it, if you did not give it to us directly.
• Complain, as described in section 19.

Email privacy@suburbreports.au. We will respond within 30 days and we will not charge you to ask.

We may need to check it is really you before we act. That is not obstruction, it is the point: handing someone's information to a stranger who claimed to be them, or deleting it on a stranger's say-so, would be the worse failure. We will ask for the least we can get away with.

Someone else can act for you, an accountant or a solicitor for instance, and we will ask for proof you authorised them.

These rights are not absolute, and occasionally the law lets us decline part of a request. If that happens we will tell you which part and why, rather than going quiet.

Asking never counts against you. We will not treat you differently, or stop helping you, because you exercised any of these rights.

Deleting your information

You can ask us to delete the personal information we hold about you at any time.

Email privacy@suburbreports.au from the address or number you used. We will confirm within 30 days what we deleted, and what, if anything, we had to keep and why.

We may need to keep a small amount, for example the record that you unsubscribed so we do not contact you again. We will tell you if that applies.

The agency holds its own copy, and deleting ours does not delete theirs. We will act on ours, and tell you exactly who to contact at the agency so you can ask them too. We will not leave you to work that out.

Deleting your information sets out the same route step by step, including what happens to your place in an advertising audience.

Complaints

Tell us first. Email privacy@suburbreports.au and we will acknowledge within 5 business days and respond within 30 days.

Coming to us first is offered, not required. If you are not satisfied, or if you would rather not come to us at all, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992. Complaints about spam or telemarketing go to the Australian Communications and Media Authority at acma.gov.au.

Changes

We may update this policy as the service changes or the law does. The current version always sits at this address with the date it took effect. If a change materially affects you, we will do more than quietly update the page.

Because this one document serves every campaign page on suburbreports.au, a change here changes what all of them say at once. That is the point of having one rather than a notice per campaign, which is how a set of pages ends up disagreeing with itself.

Contact us

Redigi Pty Ltd, trading as Suburb Reports
ACN 683 525 859  ·  ABN 46 683 525 859
PO Box 2, Brunswick South VIC 3055, Australia
privacy@suburbreports.au
1300 287 682

privacy@redigi.com.au reaches the same people, if you would rather write to the company than to the product.

Either address reaches a person, for anything about this policy, your information or your privacy.

A question about the property itself goes to the selling agent, not to us, because they hold the answer and we do not. Getting in touch sets out which questions reach whom.