Privacy Policy

1. Who this applies to

This policy covers StrataFlow, a building and strata management platform used by property and strata managers, and by the tenants, owners, and contractors connected to the buildings they manage. It applies whether you use StrataFlow as staff, as a resident, as an owner, or as a contractor receiving a work order through it.

2. What we collect

Depending on your role, StrataFlow holds:

• Staff: name, email, phone, and your role within the organisation.
• Tenants: name, email, phone, unit and lease details, rent and bond amounts, and how you've asked to be contacted.
• Owners: name, email, phone, ownership share, and whether you live in the unit you own.
• Contractors: name, trade, phone, email, company, and licence details, used to send you work orders.
• Documents and photos uploaded against a tenant, owner, maintenance job, quote, or invoice — this can include lease agreements, identification, or contracts of sale, depending on what your building manager chooses to store.
• Complaints and maintenance requests you submit, including any description or photos you provide.
• Communications — a record of notices, work orders, and reminders sent to you or by you through the platform.

We do not directly store payment card details. Subscription payments are handled by Stripe (see section 4).

3. Why we collect it

Information is collected to run the core service: identifying who you are when you sign in, routing maintenance and complaints to the right building and unit, sending notices and work orders to the right person, and giving your building manager an accurate record of your tenancy, ownership, or contractor relationship.

4. Who we share it with

We don't sell personal information. Data is shared only with the service providers that make StrataFlow work, each acting as a processor on our behalf:

• Neon — database hosting for all information described in section 2.
• Vercel — application hosting.
• Cloudflare — private storage for uploaded photos and documents (and DNS for our domain).
• Resend — delivery of email notices, reminders and sign-in confirmation codes.
• Twilio — delivery of SMS notices and work orders, where you've opted into text messages.
• Stripe — payment processing for subscription billing.

Within your own building, staff can see resident and owner contact and tenancy details as needed to do their job. Complaints are visible to staff by design — including who raised them — but never to the person or unit a complaint is about.

5. How long we keep it

Records are generally kept for the duration of your tenancy, ownership, or contractor relationship, plus a reasonable period afterward for legal, financial, and dispute-resolution purposes. Removed records are retained in a recoverable but inactive state rather than deleted immediately, so a mistaken removal can be undone; they are not shown to anyone in normal use once removed.

6. Your rights

Under the Australian Privacy Principles (Privacy Act 1988), you can ask to see the personal information we hold about you and ask us to correct it if it's wrong. Most day-to-day corrections — like a wrong phone number or email — can be handled directly by your building manager. For anything else, contact us using the details below.

7. Security

Access to your data is scoped to your own organisation and, for residents and owners, to your own records — staff in a different building or company cannot see it. Every service listed in section 4 is a reputable, security-audited provider; none of them are chosen casually.

8. Contact

Questions about this policy, or requests relating to your personal information, can be sent to [CONTACT EMAIL].