Privacy Policy

This policy sets out how we collect your data, and how we use it.

We collect and handle personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). The information we collect depends on how you use OurCommons and may include:

1. account and identity information (such as your name, email address, authentication details, role, firm, building, lot, committee or office-bearer status), and invitation history;
2. strata and building records which comprises personal information, such as lot ownership and occupancy details, owner and tenant contact details, meeting agendas, motions, minutes, notices, by-laws, levy information, financial records, compliance documents, supplier records, correspondence, attachments, and documents uploaded by users;
3. communications and recording information, such as emails, SMS messages, in-app messages, support requests, feedback, meeting recordings, transcripts, summaries and attendance metadata where those features of the Platform are used;
4. payment and subscription information, such as billing contacts, plan, lot count, invoice status, payment events, limited payment-method metadata and transaction identifiers provided by our payment provider and levy information including arrears, payment plans and payment history. We do not ask you to enter payment or other card numbers into OurCommons - our Platform costs are processed by our payments-provider, currently being Stripe;
5. usage, analytics and device information, such as pages viewed, features used, clicks or product events, browser and device type, operating system and app version, device model, push-notification tokens and similar device identifiers used to deliver notifications you have enabled, IP address, approximate location derived from IP address, referral source, cookies and similar technologies used for sign-in, security, preferences and product analytics; and
6. security and operational logs, such as sign-in attempts, session events, audit logs, access-control decisions, error reports, crash and performance diagnostics, support diagnostics, fraud and abuse signals, device-integrity signals (such as an indication that a mobile device appears to be rooted or jailbroken), and records needed to investigate security incidents.

We collect information directly from you when you create an account, use the Platform, contact us, join a meeting, respond to a notice, or upload content. We may also collect information indirectly from the Subscriber which has facilitated your access to the Platform. This could include your strata manager, owners corporation or body corporate, committee members, other owners or occupiers, authorised users, suppliers, payment providers, communications providers, or other integrated services as disclosed to you. We may also leverage publicly available property or strata records, and security or analytics tools.

OurCommons is not designed for users to place sensitive information, government identifiers, health information, or full payment-card details in free-text fields or general uploads. If you, or users you grant access to, include that information in strata records, meeting material, messages, recordings or support requests, while we will handle it consistently with this policy you and those users do so at your own risk.

We use personal information to operate, keep secure, and improve OurCommons which includes creating and managing accounts, checking permissions, onboarding buildings, managing meetings and minutes, sending notices and service communications, supporting votes and approvals, processing levy and billing workflows, maintaining strata and compliance records, providing support to you or users you authorise, troubleshooting, preventing fraud or misuse and meeting our legal obligations.

We use the content and context available in your account to provide product features, including the CoMo AI assistant and other AI-assisted drafting, search, summarisation, classification, extraction and recommendation tools. This can involve sending selected prompts, documents, meeting content, transcripts or other context to an approved commercial AI provider endpoint to generate the requested result. AI outputs may be incomplete, inaccurate or non-exclusive and are not legal, financial, strata-management or other professional advice. All users and Subscribers remain responsible for reviewing outputs before use or reliance on them and remain at all times responsible for meeting their own statutory obligations.

We may use aggregated or de-identified information for internal, non-customer-facing analytics and product improvement only where a documented contextual assessment concludes there is no reasonable likelihood of re-identification in the permitted environment. We remove direct identifiers, destroy or separately control linkage keys, exclude free text, suppress cells representing fewer than 10 individuals, prohibit re-identification and reassess the method at least annually and after a material environment or dataset change. Qualifying de-identified aggregates may be retained after a subscription ends but in any event that data will only be used in accordance with this policy.

We do not use personal information to improve, fine-tune or train OurCommons' or third-party AI models unless the Subscriber's authorised signatory separately gives a prior express, provider-specific and purpose-specific opt-in identifying the content classes, duration, withdrawal effect and evidence to the contrary. Provider abuse monitoring, prompt retention, feedback, evaluation, prompt caching, file or batch storage and product analytics are separate processing activities; each enabled route is limited to a verified and disclosed commercial provider account, endpoint, geography, retention setting and storage exception to protect your data. Third-party AI model provider feedback sharing and customer-content training are switched off wherever that option is made available to us by said third-party AI model provider(s).

Where you host or join a meeting and enable our meeting features (including CoMo's minute generation or the agenda builder), we will process audio content and meeting metadata to properly capture and timestamp the meeting, create a transcript, and generate summaries or draft minutes. A registered user provides standing express consent to this disclosed recording, transcription and AI summarisation by affirmatively accepting the signup EULA. A participant without recorded signup consent must affirmatively consent before capture; late joining without valid consent pauses capture. A non-recording participation path remains available, but any one attendee failing to agree will compromise your ability to leverage our meeting feature-set.

We may use your contact details to send service communications, including security alerts, account notices, billing notices, meeting or building workflow messages, product-change notices, and support responses. We may also send marketing communications where permitted by law. You can opt out of marketing communications using the unsubscribe link or by emailing hello@ourcommons.co. Opting out of marketing does not stop service, security, legal, billing, or scheme-related communications as configured by the administrators for your account or building, or as required by law.

For account, billing, Platform security, legal compliance and minimum necessary support or telemetry, OurCommons handles personal information for its own operational purposes. For Firm Data, the Subscriber selects the purposes and lawful upload or use. Scheme Records remain the statutory records of the relevant owners corporation, body corporate or scheme; the Subscriber handles them under its authority and OurCommons acts as technical custodian on documented instructions. We choose and oversee the disclosed providers used to deliver the Platform. Account-data requests route to OurCommons, while requests about Scheme Records generally route to the Subscriber or relevant scheme. Our Help Centre contains more information about where specific data requests are routed. Each person and owners corporation or body corporate remain legally responsible entities for their own statutory duties as they relate to responding to access requests.

Some Platform rules are automated or partly automated. They may use account details, role and building relationships, subscription status, usage events, security signals, device information, payment metadata, content metadata and workflow state to grant or restrict access, flag security or fraud risk, prioritise support or compliance tasks, recommend next actions, and personalise Platform prompts. These rules support Platform administration and recommendations; governance, statutory, levy and enforcement decisions, including professional judgments, remain the responsibility of the relevant Subscriber, owners corporation, body corporate, strata manager or user.

We do not use AI features to make final scheme-governance, statutory, levy, enforcement or professional decisions. All decisions must be made by a human. Our AI features do not have free access to your personal information except as set out in this privacy policy.

We use technical, organisational and contractual safeguards designed to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. These include encryption (in transit and at rest), role-based access controls, database access policies, server-side authorisation checks, audit logging, monitoring, vulnerability management, PITR backups, incident response processes, and limits on staff and contractor access.

Primary application data and uploaded files are stored at rest using Australian-hosted infrastructure on ap-southeast-2 servers. As is unavoidable when using frontier AI models and tools in a cost-effective way; some processing, support, security, analytics, communications, payment, recording and AI features will involve providers, personnel, infrastructure or subprocessors outside Australia, as described in clause 6 below.

No internet service can guarantee complete security. If we suspect a data breach, we will assess the incident, take steps to contain it, and determine notification responsibilities with the relevant Subscriber where Scheme Records are involved. Where required, we notify affected individuals and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme. Through the deployment of rigorous security measures we hope the consideration of this kind of issue never becomes required.

Each user's access is scoped by organisation, building, lot, role and powers/permissions carried by each user. Strata managers are assigned to buildings, committee members and owners receive access according to their building and role, and strata firm Licensees in Charge (LICs) control which authorised users are invited or removed from their firm and therefore control what data they can see at any given time. Strata firm LICs (and other system administrators, including for self-managed buildings) remain responsible for all actions taken by users provisioned under their accounts: including how those users interact with personal information. Strata firm LICs, building managers and their staff can only see buildings which they are authorised to manage. Suppliers, auditors and quantity surveyors are only able to see buildings where they have been formally selected to supply services and can only see information relevant to their role. All third parties will be required to comply with this Privacy Policy as if they were OurCommons in order to engage with buildings on the Platform.

Database access policies, server-side checks and audit logs help enforce these boundaries which are only crossed by our support, security and operations personnel where reasonably required to provide support to users, investigate an issue, maintain the Platform, comply with the law, protect users' security, or enforce our agreements.

We retain only legally permanent or life-of-scheme constitutive records, rules, by-laws and their provenance permanently. Identified statutory, accounting and final Scheme Record classes are retained for seven years unless a longer applicable rule or legal hold controls. Shorter Victorian and Queensland disposal permissions remain classification metadata and do not cause deletion without a verified instruction and current-relevance check. Necessary security and audit logs are ordinarily retained for two years, account profiles for the account life plus 90 days, and billing evidence for its applicable statutory period.

Strata and body corporate records are statutory Scheme Records of the relevant owners corporation, body corporate or scheme, as set out in the Subscription Agreement and applicable strata legislation. Each customer, acting for itself and the relevant schemes they represent (not OurCommons) remains responsible for deciding what Scheme Records must be created, kept, corrected, exported, handed over to an incoming manager, or retained for statutory periods. OurCommons provides tools to assist with those tasks and does not provide legal advice about a scheme's record-keeping obligations.

When a subscription ends, an authorised requester has 30 days to request one standard, checksummed and resumable export under the Subscription Agreement. The 30 days is a request window, not read-only Platform access or a deletion deadline. A valid request remains deliverable within 14 calendar days after authority verification, or sooner where a statutory handover deadline applies, and includes one rerun for a documented export failure. Retention or destruction cannot overtake delivery or that rerun. We are not in any hurry to delete your data, but users are encouraged to take all steps necessary to preserve Scheme Records on the Platform in the event they cease to subscribe to our services for any reason.

A recording provider (currently Recall.ai) retains raw meeting media only until successful transcript ingestion and automated integrity checks finish, after which the audio is deleted (subject to an absolute seven-day backstop). OurCommons offers no local raw-media audio archive. Working transcripts, AI summaries, the raw text from the transcribed audio and draft minutes are deleted 90 days after approved minutes or final resolution of a notified dispute, whichever is later. A final transcript is retained for seven years only where an authorised scheme decision designates it as a Scheme Record or a legal hold applies. Consent, notice and withdrawal evidence is retained for seven years and at least as long as a derived artifact.

Restore-only point-in-time backups rotate after seven days and are unavailable to ordinary product processing. A restore reapplies current retention rules, legal holds and deletion tombstones. At expiry we destroy or irreversibly de-identify information unless law, a court order or a recorded hold requires retention. Hold release and destructive execution require two independent authorised approvals, and destruction of scheme data also requires verified scheme or customer authority (as applicable).

If an individual asks us to delete personal information, we assess the request against our role and the relevant customer's obligations. Deleting an individual account or profile may not delete Scheme Records, minutes, financial records, notices, audit logs or other records that the customer or Platform must retain. Where appropriate, we may refer the request to the relevant Subscriber, owners corporation, body corporate or strata manager because they control the underlying Scheme Record.

We use third-party service providers to host, operate, secure, communicate through, analyse, bill for and improve OurCommons. Principal provider categories include:

1. infrastructure, database, authentication, storage and application hosting providers, including Supabase and Vercel;
2. payment and subscription providers, including Stripe;
3. email, SMS, push-notification and communications providers, including Resend, MessageMedia, Expo and Apple or Google push-notification services;
4. product analytics, diagnostics, monitoring, security and error-reporting providers, including PostHog and Sentry;
5. meeting recording, transcription or processing providers, including Recall.ai where recording features are enabled;
6. AI, embedding, search and language-model providers, including Anthropic and OpenAI for selected AI-assisted features; and
7. mapping, address lookup, support, administration, legal, accounting and professional advisers where needed to operate the business.

The personal information shared with a provider depends on the feature used and the provider's role. For example, billing providers may receive billing contacts, payment metadata and invoice events; communications providers may receive names, contact details and message content; AI or recording providers may process meeting content, transcripts, documents, prompts or outputs when those features are used; analytics and monitoring providers may receive usage events, device information, IP addresses and error diagnostics.

Some providers, their personnel, infrastructure or subprocessors may be located outside Australia. Likely overseas processing locations or regions include the United States, the United Kingdom, the European Union or European Economic Area, Singapore, other Asia-Pacific locations, and other countries where our providers operate or engage subprocessors. We take reasonable steps to assess and manage overseas processing and provider access, including contractual protections, data minimisation, security controls and vendor review appropriate to the service. As noted above, our primary database which holds persistent data, including personal information, is hosted through Supabase at ap-southeast-2.

We are not in the business of selling personal information or sharing it with data brokers. We may disclose information where required or authorised by law, to protect security or safety, to investigate suspected unlawful activity or serious misconduct, to complete a business restructure or transfer, or with consent.

You can ask us to give you access to personal information we hold about you, correct information you believe is inaccurate, out of date, incomplete, irrelevant or misleading, or delete personal information where deletion is available. Please email hello@ourcommons.co with enough detail for us to identify the information and the request.

We may need to verify your identity, authority, role, building relationship or lot relationship before acting on a request. We may also ask for clarification if the request is broad or unclear. We aim to respond to privacy access and correction requests within 30 days, or within another reasonable period where a request is complex. Resolution of your request may take more time but we will work with you to resolve any request as soon as we can.

Access, correction or deletion may be limited where the law allows or requires a different outcome, including where giving access would affect another person's privacy, reveal confidential or commercially sensitive information, compromise security, interfere with legal proceedings or investigations, or conflict with statutory scheme-record, accounting, audit, backup, dispute or legal-hold obligations. If we refuse or limit a request, we will explain the reason where it is reasonable and lawful to do so.

Some information in OurCommons is controlled by the relevant Subscriber, owners corporation, body corporate, strata management firm or building operator rather than by us alone. If your request concerns Scheme Records, meeting records, notices, lot ownership records, financial records or communications sent on behalf of a scheme, we may refer you to the relevant customer or work with them to handle the request as doing so may be outside our power or control.

For privacy questions, access or correction requests, deletion requests, marketing opt-outs, or complaints, email hello@ourcommons.co.

If you make a privacy complaint, please include the relevant account, building or scheme details, what happened, and what outcome you are seeking. We will acknowledge the complaint, investigate it, and aim to respond within 30 days. If we need more time because the issue is complex or requires input from a subscriber, provider or adviser, we will let you know.

In this policy, the following capitalised terms have the same meanings as in our Subscription Agreement, available at ourcommons.co/legal/subscription-agreement. They are restated here in full so this policy can be read on its own:

1. The Platform means the OurCommons web application, mobile applications, websites, APIs, software, documentation and related services made available by OurCommons, excluding Third-Party Services except to the extent OurCommons controls them.
2. The Subscriber is the strata management firm, owners corporation, body corporate or other entity identified as the customer in the Order Form.
3. Subscriber Data means data, documents, records, communications and content submitted to, generated through, stored in or processed by the Platform for the Subscriber or its schemes. Subscriber Data includes Firm Data and Scheme Records.
4. Firm Data means Subscriber Data relating to the Subscriber's own business operations, staff, portfolio administration, billing relationship and internal account administration, excluding Scheme Records.
5. Scheme Records means Subscriber Data relating to a strata scheme, owners corporation, body corporate or community titles scheme, including meeting records, owner and occupier contact details, levy records, financial transactions, compliance documents, by-laws, correspondence, notices, work orders and records required or commonly maintained under applicable strata, community titles or body corporate laws.

If a definition changes in the Subscription Agreement, the restated definition in this policy is updated in the same release so the two documents cannot drift apart.