Privacy Policy

1. Introduction

This Privacy Policy is issued by Lauri Tapani Jalonen (ABN: 98 684 068 750), with a registered address at 9 Bartlett Place, Parmelia WA 6167, Australia (referred to in this policy as “RenterSay”, “we”, “us”, or “our”). RenterSay is an Australian online platform that enables tenants to anonymously review residential rental properties by address.

This policy explains what personal information we collect, how we use and store it, who we share it with, and what rights you have in relation to that information.

RenterSay takes the view that this platform may fall within the scope of the Privacy Act 1988 (Cth) — including potentially as a residential tenancy database under s6D(4)(c) of that Act — and treats all personal information as subject to the Australian Privacy Principles (APPs) regardless of revenue threshold. We do not rely on the small business exemption.

The statutory privacy tort introduced by the Privacy and Other Legislation Amendment Act 2024 (which commenced on 10 June 2025) applies to all entities, with no small business exemption. RenterSay takes this obligation seriously and has designed its platform to minimise the risk of serious invasions of privacy.

2. What Personal Information We Collect

2.1 Account Information

When you create an account (via our authentication provider, Clerk), we collect:

• Your email address
• Your name (as provided to Clerk — used for account management only, never displayed publicly on reviews)
• Sign-in provider tokens (if you use a social sign-in provider such as Google)

2.2 Review Content

When you submit a review, we collect:

• Your tenancy dates — recorded at month and year granularity only (not as exact dates)
• Your star rating across multiple categories
• Your written review text
• Issue flags you select (e.g., maintenance problems, bond disputes)

2.3 Vote and Complaint Data

We record which reviews you have voted on to enforce our one-vote-per-user policy. IP addresses are not stored per vote.

If you submit a complaint about a review, we collect your email address and name (required) and your optionally provided company name, along with the substance of your complaint.

2.4 Usage Data

We automatically collect standard server logs and error traces when you use the platform. This includes technical information such as browser type, device type, pages visited, and timestamps.

2.5 What We Do Not Collect

We do not collect, store, or display landlord names, agent names, or real estate company names. The sole unique identifier for all reviews is the property address. This is a core legal and design decision that is non-negotiable.

3. How We Use Your Personal Information

We use personal information only for the following purposes:

• Operating and improving the platform — to provide and maintain the RenterSay service and to improve platform features and performance
• Authenticating users — to verify your identity and maintain the security of your account
• Moderating review content — to assess reviews against our Content Guidelines before and after publication
• Responding to complaints and legal notices — to assess and action complaints about published reviews within the 7-day timeframe required by Australian defamation law, and to respond to legal notices
• Sending transactional notifications — to notify you of moderation outcomes, complaint decisions, and other matters relating to your account or reviews (e.g., moderation outcome emails)
• Complying with legal obligations — to meet our obligations under the Privacy Act 1988 (Cth), Australian defamation law, and other applicable laws

We do not use personal information for advertising. We do not sell personal information to third parties. We do not use personal information to train AI or machine-learning models.

4. Third-Party Service Providers and Overseas Transfers

RenterSay uses the following third-party processors to operate the platform. All are US-based companies, and their use involves cross-border transfers of personal information under Australian Privacy Principle 8:

• Clerk (auth.clerk.dev) — authentication and user account management
• Neon (neon.tech) — database hosting (PostgreSQL, US servers)
• Vercel (vercel.com) — application hosting and infrastructure (US servers)
• Resend (resend.com) — transactional email delivery

RenterSay is committed to ensuring each provider handles personal information consistently with the Australian Privacy Principles. We are in the process of executing Data Processing Agreements (DPAs) with each of the above providers requiring APP-equivalent data handling, breach notification obligations, and processing restrictions. Until those agreements are finalised, we rely on each provider’s published privacy commitments and standard contractual terms.

By using the platform, you acknowledge that your personal information may be processed in the United States.

Except as described above, we do not share your personal information with any other third parties, unless required to do so by Australian law (for example, in response to a valid court order or law enforcement request) or with your explicit consent.

5. Review Anonymity

Reviews are published anonymously — reviewer names are never displayed publicly. The platform is designed to ensure that your identity as a reviewer cannot be determined from the information shown on a published review.

To protect reviewer identity, only the month and year of a tenancy period are displayed — never the exact dates. Your account’s connection to a specific review is stored internally for moderation and fraud prevention purposes only.

We will not disclose a reviewer’s identity in response to a landlord complaint unless we are compelled to do so by a valid Australian court order.

While the platform is designed to protect reviewer identity, RenterSay cannot guarantee complete anonymity if a reviewer includes identifying information in their own review text. Reviewers are responsible for the content they submit.

6. Data Retention

We retain personal information only for as long as necessary for the purposes for which it was collected, or as required by law.

• Account data is retained until your account is closed, and for 12 months thereafter for legal dispute resolution purposes.
• Review content is retained indefinitely while the review is published. If a review is removed, the content is deleted, subject to any legal hold obligations.
• Complaint records are retained for 3 years from the date of resolution.
• Transactional emails and logs are retained for 90 days.

Where we are required by law to retain information for a specified period, we will comply with that requirement regardless of the above timeframes.

7. Your Privacy Rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the following rights:

• Right of access — to request access to the personal information we hold about you
• Right to correction — to request correction of personal information that is inaccurate, out of date, or incomplete
• Right to deletion — to request deletion of your account and associated personal data, subject to our legal retention obligations
• Right to complain — to complain to the Office of the Australian Information Commissioner (OAIC) if you believe we have breached the APPs

To submit a data export or deletion request, or to make an access or correction request, please contact us at: privacy@rentersay.com.au

We will respond to access and correction requests within 30 days.

8. Cookies and Tracking

The platform uses session cookies for authentication (via Clerk) and standard server-side analytics. These cookies are essential for the platform to function.

No third-party advertising cookies are used. No cross-site tracking is performed. RenterSay does not display advertising and does not use advertising networks or behavioural tracking tools.

9. Security

Personal information is stored on servers with encryption at rest and in transit. Access to user data is restricted to authorised personnel only. Authentication is managed by Clerk, which supports multi-factor authentication and industry-standard security practices.

Despite these measures, no internet transmission or electronic storage system is 100% secure. We cannot guarantee the absolute security of your information.

In the event of a data breach that is likely to result in serious harm, affected users and the Office of the Australian Information Commissioner (OAIC) will be notified in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, platform features, or legal obligations. Material changes will be notified by email at least 14 days before taking effect.

Your continued use of the platform after the effective date of any updated Privacy Policy constitutes your acceptance of the updated policy.

11. Contact and Complaints

For privacy enquiries, access requests, correction requests, or to make a privacy complaint, please contact us:

• Email: privacy@rentersay.com.au
• Mailing address: 9 Bartlett Place, Parmelia WA 6167, Australia

Complaints about how we handle personal information can also be made directly to the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992