Introduction
This Privacy Policy explains how Cameron Panagis trading as OnSite Data (ABN 31 328 549 540) ("OnSite Data", "we", "us" or "our") collects, uses, stores and discloses personal information through the OnSite property photo verification platform at https://onsitedata.com.au (the "Platform").
We are committed to handling personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
This policy applies to organisations that use the Platform and their team members ("Subscribers"), to people who receive a verification link and submit photos ("Points of Contact"), and to visitors to our website.
Personal Information We Collect
Depending on how you interact with the Platform, we may collect:
- Names, email addresses, phone numbers, ABNs and business details of Subscribers and their team members
- Property addresses and loan references entered by Subscribers, which may relate to an individual borrower
- The name, phone number or email address of a Point of Contact, as provided by the Subscriber
- Photographs submitted by a Point of Contact, and details about each photograph such as when it was taken and a digital fingerprint of the file
- Location data from the Point of Contact's device while they use a verification link, including GPS coordinates and their accuracy
- IP addresses, device and browser details, and records of activity on the Platform
- Messages sent to us through our contact form
- Billing details, such as the type and last four digits of a payment card. Full card numbers are entered directly into our payment processor, Stripe, and are never stored by us
How We Collect Personal Information
We collect personal information:
- Directly from Subscribers when they register, use the Platform or contact us
- From Subscribers about the Points of Contact they send verification links to
- Directly from Points of Contact when they use a verification link
- Automatically, through server logs, cookies and website analytics, when anyone uses the Platform or visits our website
- From the Australian Business Register, when we check an ABN at signup
- From Stripe, in connection with payments
How We Use Personal Information
We use personal information to:
- Provide and operate the Platform, including sending verification links by email and SMS
- Check that a Point of Contact is at the property, and flag signs of possible fraud or inconsistency
- Produce verification reports for the Subscriber who requested them
- Manage accounts, billing and payments
- Communicate with Subscribers about their accounts and the Platform
- Keep the Platform secure, prevent misuse and limit repeated requests
- Maintain audit records that show approved verifications have not been altered
- Understand how our website is used, so we can improve it
- Comply with our legal obligations
We do not sell personal information.
GPS and Location Data
Location data is collected from a Point of Contact's device only while they are using a verification link, and only to check whether they are at the property. A Point of Contact can decline location access. If they do, the Subscriber will be able to see that location access was declined.
Location results are made available only to the Subscriber who created the job.
Disclosure of Personal Information
Information about a verification, including photographs and location results, is disclosed to the Subscriber who requested it.
We also use service providers to operate the Platform, who handle personal information on our behalf:
- Supabase, for database and file storage
- Vercel, for hosting and website analytics
- Stripe, for payment processing
- Resend, for email delivery
- Kudosity, for SMS delivery
- Google Maps, for address lookup and the maps in verification reports
- Sentry, for error monitoring
- proxycheck.io, for checking IP addresses for signs of fraud
- Upstash, for limiting repeated requests to protect the Platform, using IP addresses
- The Australian Business Register, to confirm an ABN at signup
We may also disclose personal information where required or authorised by law, including to law enforcement or regulators, or with your consent.
Overseas Disclosure
Our database and application hosting are located in Sydney, Australia.
Some of our service providers store or process information outside Australia, including in the United States. These include Stripe, Resend, Google, Sentry, proxycheck.io and Upstash. We take reasonable steps to ensure they handle personal information in a way that is consistent with the Australian Privacy Principles.
Data Retention
We keep personal information only for as long as we need it.
Approved jobs are removed from the Subscriber's dashboard after the retention period set by the team member who created the job, counted from approval. The periods available are 7, 30, 90, 180 or 365 days. Photographs and reports are permanently deleted 60 days after the job leaves the dashboard.
Photographs from jobs that are not approved are permanently deleted 60 days after the verification link closes.
We keep a record of each job, including the property address, loan reference, approval details, location verification results, activity history and a digital fingerprint of each photograph, for 7 years, so that the integrity of approved verifications can be demonstrated. After 7 years, personal information is removed from the record. We keep only what is needed for billing and financial records.
A job may be placed on legal hold if it is needed for a legal matter or dispute. While a job is on hold, nothing in it is deleted or de-identified.
Account details for Subscribers and their team members are kept while the account is active, and afterwards for as long as needed for legal, tax and audit purposes.
Once a Subscriber downloads a report or photographs, those copies are managed by the Subscriber and are outside our control.
Data Security
We use reasonable measures to protect personal information, including encrypted connections, encrypted storage, access controls, and digital fingerprints that show whether a photograph has been altered. No system is completely secure, and we cannot guarantee that personal information will never be accessed without authorisation.
If a data breach is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner.
Cookies and Analytics
We use cookies that are necessary to keep you signed in and to operate the Platform securely.
We use Vercel Web Analytics to understand how our website is used. It records the pages visited and general device and browser information, and does not use cookies.
We also keep our own simple record of visits to our public website pages. For each visit we record the page address, the referring website and any campaign tag, together with a daily code made from the visitor's network address and browser. We do not store the network address itself, we do not use a cookie for this, and the daily code changes every day, so it cannot be used to follow a visitor over time. We delete these records after 13 months. We do not record visits by people signed in to the Platform.
We do not use advertising cookies or advertising trackers.
Anonymity
Because the Platform is used to verify property and deliver reports to identified organisations, it is not practical to use it anonymously or under a pseudonym.
Access and Correction
You can ask to access, or correct, the personal information we hold about you by contacting hello@onsitedata.com.au. We will respond within 30 days.
If you are a Point of Contact, your information is held on behalf of the Subscriber who sent you the verification link, and we may refer your request to them.
Approved verification records cannot be altered, because they serve as evidence. If we decline a request to correct information, we will explain why, and you can ask us to attach a statement to the record.
Complaints
If you have a concern about how we handle personal information, contact us at hello@onsitedata.com.au. We will respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at https://www.oaic.gov.au.
Changes to This Policy
We may update this policy from time to time. The current version will always be available at https://onsitedata.com.au/legal/privacy.
Contact Us
Cameron Panagis trading as OnSite Data (ABN 31 328 549 540)
Email: hello@onsitedata.com.au
Website: https://onsitedata.com.au