Privacy policy
Last updated: [date]
1. Who we are
StrataWorx ([legal entity name], ABN [number]) provides software that helps strata managing agents handle email, work orders and scheme records. This policy explains how we handle personal information. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
When a strata firm uses StrataWorx, the firm decides what information goes into the service. For information about owners, tenants and contractors, we act on the firm's behalf and handle it under our agreement with that firm.
2. What we collect
- Firm users: name, work email, role, sign-in details and activity logs.
- Strata roll: scheme and lot details, and owner and tenant names, emails and phone numbers that the firm imports.
- Emails: messages received in connected inboxes or forwarded to StrataWorx, including attachments, and the replies and work orders sent.
- Documents: by-laws, minutes, contracts and other files the firm uploads to the knowledge base.
- Call transcripts: recordings and transcripts from the after-hours phone line, if the firm turns it on.
- Billing: billing contact and subscription details. Card details are held by Stripe, not by us.
- Website enquiries: name, firm, email, phone and portfolio size submitted through our early-access form.
3. How we use it
- To provide the service: sorting emails, drafting replies and work orders, answering questions from scheme documents and running AI agents.
- To bill the firm, provide support and keep the service secure.
- To contact people who ask us about StrataWorx.
We don't sell personal information, and we don't use customer content to train AI models.
4. Where it is stored
StrataWorx's database, files, backups and application are hosted in Australia, in the AWS and Supabase Sydney region (ap-southeast-2). All AI processing is done by Claude models on AWS Bedrock in Australia (Sydney and Melbourne). Emails, documents and AI answers are never sent overseas for AI processing, and no other AI provider is used. Email sending, SMS and billing providers listed below may handle limited data (names, email addresses, phone numbers and message text) outside Australia. Where that happens, we take reasonable steps under APP 8 to make sure the information is protected.
5. Subprocessors
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services (Amplify Hosting) | Application hosting and server functions | Sydney, Australia (ap-southeast-2) |
| Amazon Web Services (Secrets Manager) | Storing the service's own keys and passwords | Sydney, Australia (ap-southeast-2) |
| Supabase | Database, file storage and sign-in | Sydney, Australia (ap-southeast-2) |
| Amazon Web Services (Bedrock) | All AI processing, with Claude models (AI never leaves Australia) | Australia (Sydney and Melbourne) |
| Google (Gmail SMTP) | Sending notification and reply emails | United States and other Google locations |
| Postmark (ActiveCampaign) | Sending and receiving email, when the firm's inbound address is used | United States |
| Twilio | SMS and the after-hours phone line with call transcripts (Premium) | United States and Australia |
| Stripe | Subscription billing and payments | Australia and United States |
Locations to be confirmed against each provider's agreement before launch.
6. Security
We encrypt data in transit and at rest, restrict staff access, keep audit logs and store connection secrets encrypted. Each firm can only see its own data.
7. How long we keep it
We keep customer data while the firm's subscription is active. After cancellation the firm can export its data for [30] days, then we delete it from live systems. Backups are removed within a further [period]. We keep billing records as long as tax law requires.
8. Access and correction
You can ask for access to, or correction of, personal information we hold about you. If you are an owner, tenant or contractor, contact the strata firm first, because they control that information. We'll help them respond. We aim to reply within 30 days.
9. Complaints and contact
Contact our privacy officer at [privacy@yourdomain.com.au]. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.