Skip to content
Keyfacts

Privacy policy

Effective 30 October 2026

Our approach

Keyfacts is operated by Keyfacts AU (ABN 75 194 244 750) (“we”, “us”). We collect as little personal information as we need to run the service, and we handle it in line with the Australian Privacy Principles. This policy explains what we collect, why, who we share it with, how long we keep it and your choices.

What we collect

  • Account: your email address and sign-in records (time, IP address, browser type) for security.
  • Sign-in security: to limit sign-in attempts, short-lived counts of recent requests, keyed by your IP address (for an IPv6 address, its network), and by keyed one-way hashes of your email address and network.
  • Abuse prevention: a keyed one-way hash of your normalised email address and of your network (not your full IP address), so free searches can only be claimed once, and a count of new accounts given free searches at each email domain, kept against a keyed one-way hash of the domain alone (never your address).
  • Searches: what you enter (areas, budgets, property type, bedrooms, asking price or rent, your current rent and the date of a rent-increase notice, and for an investor report the costs, deposit and interest rate you assume) and the reports we produce.
  • Free rent increase checks: what you enter (the area, rents, the dates about your notice and tenancy, and the tenancy details you choose, such as whether the home is a rooming house, social housing or let by an exempt lessor) and the figures we show, in a record kept without your IP address or any account, so we can show how each published figure was produced. The same check made again on the same day isn’t stored again.
  • Response packs: bought without an account. We keep the pack’s figures (with the tenancy details you choose, as for a free check) and your choices for the reply (such as your counter-offer), the name of the channel a link brought you from if it named one (such as from=tq, or our search ads), and a keyed one-way hash of the email you paid with, so the link is only re-sent to that address. Starting the checkout creates the order (your check’s details, and the hash of your email if you give it then) before you pay. Your name, the rental address and the agent’s name, if you type them into the letter, and your edits are saved in your browser only; they reach our server only to draw a PDF you ask for, and aren’t kept.
  • Address passes: bought without an account. We keep the addresses you check with the pass (their parts and NSW property id) and each address check as we showed it, the name of the channel a link brought you from if it named one, and a keyed one-way hash of the email you paid with, so the link is only re-sent to that address. Starting the checkout creates the order (the first address) before you pay. The free preview of an address (its zone, flood, bush fire and heritage maps, and school zones) isn’t stored on our servers; we only count that one was made. When you open the pass’s checkout, your browser tab keeps the confirmed address and its free preview as unfinished work (below), so a checkout you cancel comes back to them.
  • Lost links: if you ask us to email your links again (Find your purchase), we use the email you type only to find the response packs and address passes paid with it, by the same keyed hash, and don’t keep it. Each link goes to the address Stripe holds for that payment, never to the one typed, and the page says the same whether or not anything was found.
  • Address checks: the street address you check, the NSW property identifier and map point it resolves to, and what the planning and hazard maps held there. We don’t ask whose property it is, and we don’t need to know whether you live there.
  • Payments: handled by Stripe. We receive your Stripe customer and payment references and the status of payments, never your full card details. With each payment we give Stripe an internal reference for your account (or the pack’s order), so the payment can be matched to what it bought.
  • Cookie: one sign-in cookie, set when you sign in, keeps you signed in for 30 days from when you signed in. It can’t be read by scripts on the page, and it’s removed when you sign out or delete your account. “Sign out on all devices” on the account page ends every sign-in to your account at once. Apart from Google’s cookies when you arrive from one of our search ads, and Meta’s when you arrive from one of our Facebook or Instagram ads (both below), we don’t use advertising or tracking cookies. Our own staff’s browsers also carry a cookie that keeps their visits out of our counts; it holds no identifier and is set only by a special link we use ourselves.
  • Unfinished work: forms keep what you typed in your browser tab, not on our servers, to carry it through sign-in or a purchase (and the page to return to after a purchase; for an address pass, the confirmed address and its free preview, for the way back from a cancelled checkout), for an hour (two hours for the page to return to). Our pages delete it once it’s older than that: when a page of this site opens, and every few minutes while one is open. It’s also deleted when you sign out. If no page of this site is open, or the browser has paused it, it stays in the browser until one runs again, or until you close the tab.
  • Email to us: if you write to our support or privacy address, your message, your email address and the names of any attachments.
  • Technical: server logs needed to keep the service secure and working. We count how many times each step of the rent increase check and pack, and of the address pass, happens each day, as plain numbers, and how many people made each step that day. A checkout cancelled on the way back from Stripe, and an address pass payment that didn’t go through (counted from Stripe’s notice, whose event id we keep so it’s counted once), are counted the same way, by the number of addresses. A free check that couldn’t be made is counted the same way, and our server logs keep which kind of entry stopped it (such as dates out of order), never what was entered. Visits that arrive from one of our ads are counted the same way, with whether the ad’s tag (below) could run; where it couldn’t run as the address was, our server logs keep the names (never the contents) of the parts of the address in its way. To count a person only once a day, we keep a keyed one-way hash of your IP address (for an IPv6 address, its network) together with the day and the step: the address itself isn’t stored, the hash is different for every day and every step, and it’s deleted after two days. No cookie or identifier is set for this.
  • Page visits: Vercel Web Analytics counts visits to our pages without cookies: the page’s address (a private link reduced to its kind, and nothing after a “?” except the name of the channel a link came from, such as from=tq), the site you came from, your browser, operating system and device type, and your approximate location (country, region and city). Vercel tells visits apart by a one-way hash of the request, which it discards after 24 hours, and we see totals only. If the link you arrive by names its channel (such as from=tq, or our search ads), a check or purchase you start on that page is counted under it, and your browser tab remembers the channel’s name for two hours from your arrival, so one you make after looking around is counted under it too.
  • Clicks on our search ads: if you arrive by clicking one of our Google search ads, your browser loads Google’s tag for Google Ads, and a short notice says so. It stores the ad click’s identifier in Google cookies on this site (for up to 90 days; set for this site only, and sent only over a secure connection) and tells Google when that visit finishes a free rent increase check or buys a response pack or an address pass (with its price and reference). With each of these, Google receives the page’s address (with any private link, such as a pack’s or a report’s, removed), the time, your IP address, and your browser and device details, as any website you visit does. It doesn’t receive what you typed into a check or a pack. We turn off Google’s page-view counting, ad personalisation and Google signals for it, and it never runs on a pack’s, an address pass’s or a saved report’s page, or on a page whose address holds more than the ad’s own details and the choices our own links and tabs put there (an area, postcode, kind of home, bedrooms, Rent or Buy): never a figure you typed, a street address, or the page to return to after signing in. If the address of the page you land on holds parts no page of ours uses (an app can add its own to an ad’s link), they’re removed from it before the tag loads. Visitors who didn’t come from one of our ads don’t load it. Your browser tab remembers which purchases it has reported, and that you saw the notice, for two hours.
  • Clicks on our Facebook and Instagram ads: if you arrive by clicking one of our ads on Facebook or Instagram, your browser loads Meta’s pixel, and a short notice says so. It works like Google’s tag above, on the same pages only. It sets two Meta cookies on this site, each for up to 90 days: one holds the ad click’s identifier, the other a random identifier for this browser, which Meta uses to link the visit’s later events to it. It counts the page you arrive on, and tells Meta when that visit finishes a free rent increase check or buys a response pack or an address pass (with its price and reference). Meta receives the page’s address (with any private link removed), the time, your IP address, and your browser and device details. It doesn’t receive what you typed into a check or a pack, and we turn off its automatic collection of page details and button clicks. Visitors who didn’t come from one of our Meta ads don’t load it.

Why we use it

To sign you in, deliver and store your reports, keep track of searches and payments, prevent abuse, meet our legal obligations (including tax record-keeping), answer your questions and improve the service. We don’t sell personal information and we don’t use it for advertising, except to tell Google Ads or Meta when a visit from one of their ads finishes a free check or buys a pack or a pass (above), so we can see which ads work and so they can show our ads to people more likely to find them useful.

Automated reports

Reports are produced automatically from your inputs and public statistics. They don’t make or support decisions about you.

Who we share it with

  • Hosting and database: Vercel (application hosting and page-visit counts; our functions run in Sydney, and Vercel, a United States company, may process request logs, including IP addresses, and visit counts in the United States) and Supabase (database in Sydney).
  • Email delivery: Resend, to send your sign-in codes and your response pack’s or address pass’s private link, and to receive mail sent to our support and privacy addresses and forward it to our mailbox. Email addresses, codes and messages are processed in Japan (Tokyo) and may be processed in the United States.
  • Our mailbox: mail you send to our support or privacy address is forwarded to a mailbox hosted by Google (Gmail), which may process it in the United States and other countries.
  • Advertising measurement: Google (Google Ads), only for visits that arrive from one of our search ads: the ad click’s identifier, when that visit finishes a free check or buys a pack or a pass, and what any website request carries (the page’s address with private links removed, IP address, browser and device details). Google may process it in the United States and other countries, and handles it under its own privacy policy (policies.google.com/privacy).
  • Advertising measurement: Meta Platforms (Facebook and Instagram ads), only for visits that arrive from one of our Meta ads: the ad click’s identifier, a random identifier for the browser, the page arrived on, when that visit finishes a free check or buys a pack or a pass, and what any website request carries (the page’s address with private links removed, IP address, browser and device details). Meta may process it in the United States, Ireland and other countries, and handles it under its own privacy policy (facebook.com/privacy/policy).
  • Payments: Stripe, which takes your card details and emails your receipt (it processes data in Australia, the United States and other countries).
  • NSW Government map services: for an address check, the address parts you type go to the NSW Address Location Service, and the resolved map point goes to the NSW cadastre, planning, bush fire and points-of-interest services, to read what they hold there. While you type an address, what you’ve typed so far goes from our server to the NSW address register (Spatial Services) to suggest the addresses that start with it; the register’s answers are kept in our server’s memory for up to 10 minutes, under the text they were asked for, and aren’t written anywhere. No account details are sent with these requests.
  • Authorities, where the law requires it.

Where providers store or access information outside Australia, we use reputable providers bound by contract to protect it.

How long we keep it

  • Account information: until you delete your account. After that we keep only a closed-account record: an internal account number, when the account was opened, given free searches and closed, and the hash of your email address (below).
  • Reports: kept for six years after they are produced, so we can show how each figure was produced, then deleted. When you delete your account, our records’ links between them and you or your payments are removed straight away. An address check still contains the address that was checked, so it describes a property even though it no longer points to you.
  • Payment records (what was bought, when, the amount and any refund, with Stripe’s references): kept while your account exists, because your balance of searches is worked out from them, and for tax and consumer-law purposes. When you delete your account they’re unlinked from it: our purchase records are deleted seven years after the payment, and the entries in our running count of searches added and used stay, so the totals still add up; the entry for your free searches still carries the closed-account record’s internal number. Stripe keeps its own record of each payment (including the email you paid with and our internal reference) under its privacy policy, as payment providers must, so the payment references we keep can still be matched to that record.
  • Abuse prevention: the hash of your email address is kept so free searches can only be claimed once; network and email-domain counts are deleted after 30 days.
  • Sign-in sessions: each ends 30 days after you signed in (sooner if you sign out), and its record (the time, IP address and browser) is deleted a day after it ends.
  • Rate-limit and sign-in counters: deleted two days after they were last used (those keyed by hashes, within a few hours).
  • The hashes that count each day’s people (above): deleted once the day is two days old; only the day’s totals are kept.
  • Free rent increase checks: deleted after 24 months.
  • Response packs: each version is kept for six years from when it was made (with the order and its email hash), so we can show how each figure was produced, then deleted by the same retention job. A checkout that closed without payment is deleted 90 days after it closed. The name, address and edits saved in your browser last 30 days from when they were first saved: our pages delete them after that (when a page of this site opens, and every few minutes while one is open), and when you sign out of an account in that browser or clear them from the pack page. If no page of this site is open after the 30 days, they stay in the browser until one is.
  • Address passes: each address check is kept for six years from when it was made (with the order and its email hash), so we can show how each finding was produced, then deleted by the same retention job. A checkout that closed without payment is deleted 90 days after it closed.
  • Email to us: kept in our mailbox while we need it to answer you and keep a record of what was said. Resend keeps received mail for a limited period under its own policy.
  • Page visits: shown to us for 12 months; Vercel keeps them under its own privacy policy. The hash that tells visits apart is discarded after 24 hours.
  • Server logs: kept by Vercel for a limited period under its own policy.
  • Backups: our database host keeps backups for a short period, so a deleted record can remain in a backup until it is replaced.

Security

Data is encrypted in transit. Our database and application run in Sydney (our hosting, email and payment providers process data as described above), and access to it is limited to the application and to us as its administrators. Sign-in codes are stored hashed and expire after five minutes.

Your choices and rights

You can see your reports and delete your account from the account page at any time. To delete it, you’re asked to sign in again if you last signed in more than 15 minutes ago, and a payment that is still clearing must clear. To ask for access to or correction of your information, email privacy@keyfacts.au. We aim to respond within 30 days. If you’re not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Changes

We’ll post any change to this policy here with its effective date. Something new we collect, such as for a new feature, is described here before we start collecting it, and applies only from then. A change to how we use or share information we already hold is posted at least 30 days before it takes effect.