PropertyFlags
Legal

Privacy

What we collect, who processes it, how long we keep it and the choices you have.

Last updated 2 October 2026
01

What we collect

  • The address you query. Typing an address into the search box sends it to our server so we can look it up in government registers. A property address on its own is public information; we treat it carefully anyway.
  • The email you give at checkout. Stripe collects it during payment; we read it from Stripe to send your report link and any refund notice. We never see your card details.
  • A report record. For each paid report we keep a log row: the address, the state, which pre-release checks passed, refund status, and a compressed copy of the report data as generated. This is our evidence of exactly what you were shown, and it backs the correction promise in our Terms.
  • A free-check record. When you run a free flag check, we keep a compressed copy of what the registers returned for that address. It is filed under the address and state you checked, not under you, and it carries no email address, no payment details and no advertising id. It is there so that a later check or purchase of the same address does not have to query every government service again.
  • An email address, only if you ask us to send you a free result. The free check works without it. If you use the optional box under your flag counts, we store that address alongside the address you checked and the counts, so we can send you that result and one reminder the next morning. If you arrived through a link with a referral tag, we store the tag too, so we know which channel brought you.
  • An advertising click id, only if you arrived from one of our ads. A Google ad link carries an identifier (a gclid) in its address. If you arrive with one, your browser keeps it in local storage for 90 days, and if you later buy a report we attach it to that purchase and tell Google that a click of that id led to a sale, with the amount. It carries no name or email, we never receive a profile of you back, and if you did not come from an ad there is no id and nothing is sent.
  • Your IP address and browser type, when you buy. At checkout we record the IP address and browser type you used with your Stripe payment, so a purchase can be counted in our visit statistics without being lost to ad blockers. Plausible does not keep the IP address.
  • Google’s advertising cookies. Our pages load Google’s tag, which can set cookies in your browser and tells Google which page you visited, with the page address stripped of anything that identifies your report or your address. When a report is bought it also tells Google a sale happened and its amount, using a reference that cannot be traced back to your report.

We collect nothing beyond the items above: no account, and no marketing list. The optional email above is used for that one result and one reminder, nothing further, and both emails carry an unsubscribe link.

We also count visits with Plausible, a privacy-focused analytics service that sets no cookies, stores no data on your device and does not build a profile across sites. It tells us how many people opened a page or ran a free check, never who they are. When you buy a report, the sale is counted in Plausible from our server, using the IP address and browser type recorded at checkout so the count is not lost to ad blockers. Plausible does not store that IP address.

02

Who processes it

Delivering the service involves a small set of providers, each seeing only what its job requires:

  • Stripe processes payment and holds your email and receipt, together with the IP address and browser type used at checkout.
  • Resend delivers our transactional emails (report link, refund notice).
  • Supabase stores the report record described above.
  • Anthropic receives the generated report data (not your email) to write the plain-English summary.
  • Vercel hosts the site and keeps standard server logs.
  • Plausible counts page views and free checks, without cookies or any storage on your device.
  • Google Ads measures our advertising. Its tag (gtag.js) runs on our pages and may set cookies in your browser; it tells Google which pages were visited and, when a report is bought, that a sale happened and its amount. Google handles that data under its own privacy policy. You can block it with your browser’s tracking protection or an ad blocker, and the site keeps working. Separately, for visitors who arrived from one of our ads and then bought, we send the click id described above with the time and amount of the sale.

The report itself is built from queries to Australian government data services; those queries contain the property coordinates and address, never your identity.

03

How long we keep it

  • The compressed report snapshot is deleted automatically after 90 days. That window covers the correction and dispute process in our Terms.
  • The remaining log row (address, checks passed, refund status) is kept for bookkeeping and dispute history.
  • The free-check record is deleted automatically after 7 days. The short delivery-status note that drives the waiting page after a purchase is deleted after 48 hours.
  • The note that lets us re-check a government source for you in the 24 hours after a purchase (your email address, the property address and what the report is still waiting on) is deleted automatically after 7 days.
  • If you asked us to email you a free result, that row (your address, the property you checked and the counts) is deleted automatically after 30 days.
  • If you unsubscribe, we keep your email address on a do-not-email list and nothing else. That list is permanent on purpose. It is the only way we can be sure we never email you again, and it is not used for anything but blocking.
  • The advertising click id is held by your own browser for 90 days and then expires by itself. Clearing your browser storage removes it immediately.
  • Payment records, including the IP address and browser type recorded at checkout, live with Stripe under their retention rules.
  • Google’s cookies are held by your own browser and expire on Google’s schedule. You can delete them at any time in your browser settings, and blocking them does not stop the site working.
04

Your choices

Email hello@propertyflags.com.au to ask what we hold that is linked to your purchase, or to ask us to delete the report snapshot earlier than the 90-day window. Include your Stripe receipt so we can find the record.

To stop the free result emails, use the unsubscribe link in either email. It works in one click and takes effect immediately. You can also email us and we will do it for you.

We do not sell personal information, and we do not use your queries or reports to build marketing profiles.

← Back to PropertyFlags · Terms of Service

ProductFree flag checkBuyer’s reportRenter’s reportSample reportsCoveragePartners
LearnGuidesSuburb guidesResearchNewsIn the pressWhat the flag count means
CompanyAboutOur data rulesContactFor AI agents
LegalTerms of ServicePrivacyRefundsData attribution
PropertyFlags · Sydney, Australia · ABN 23 142 520 951 · hello@propertyflags.com.au. Payments are processed by Stripe; we never see your card details. The register responses behind every paid report are kept for 90 days after purchase; email us and we send you the file. Address search uses G-NAF © Geoscape Australia, licensed by the Commonwealth of Australia under the Open G-NAF End User Licence Agreement. Contains data © the States and Territories of Australia and other suppliers, reproduced under Creative Commons Attribution licences.