Propsights Privacy Policy

Propsights is provided by Axio360 Ventures Australia Pty Ltd (ACN 698 584 851), the contracting entity for all Propsights customers. In this policy, "Propsights", "we", "us" and "our" mean Axio360 Ventures Australia Pty Ltd. The Propsights software, brand and other intellectual property are owned by Axio360 Ventures LLC, a Wyoming limited liability company, and licensed to us.

Axio360 Ventures Australia Pty Ltd is responsible for your personal information wherever you live. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we honour the rights that United States privacy laws, and the laws of other locations where we serve users, give you (Sections 10 and 11).

This policy covers the Propsights website, web and mobile apps, AI assistant, connected integrations, and our sales, support and marketing contact with you. It applies to property owners, their team members, agents and property managers, maintenance suppliers, tenants whose details are added to the service, and anyone who contacts us.

Propsights is built for property records. It is not a health, banking or credit-reporting service, and it is not designed to receive those kinds of information.

We collect only what we need to run the features you use. What that includes depends on how you use Propsights.

Information about other people. Only add someone else's details where you are entitled to and it is needed to manage the property. Where practical, let them know their information is held in Propsights and point them to this policy.

Information we do not want. Please do not upload government identifiers (such as tax file numbers or Social Security numbers), full bank or card numbers, health or medical information, or children's information unless genuinely needed for a property record. Redact them from documents where you can.

You can use Propsights without giving us every type of information, but some features will not work without it. You may interact with our website anonymously or under a pseudonym where that is practical; an account requires your real contact details.

We use personal information to provide Propsights and for directly related purposes you would reasonably expect:

• Record: organise records, documents and emails against each property; turn emails into records and tasks when you ask us to.
• Research: add context to your records, surface issues and urgency, and prepare plain-English summaries and portfolio reports.
• Remind: send reminders, alerts and notifications you have set up or that relate to your properties.
• Collaborate: let you share selected records with your team, agents and suppliers, and record approvals and decisions.
• Run the service: create and secure accounts, process payments, provide support, diagnose problems, prevent fraud and misuse, and improve how the product works using aggregated or de-identified usage data.
• Communicate: respond to enquiries and send service notices. We send marketing only where the law allows, and every marketing email has an unsubscribe link.
• Comply with law: meet legal, tax, accounting and regulatory obligations and respond to valid legal requests.

We do not use your property records, documents or AI conversations to build advertising profiles. Improving the product means analysing how features are used, not training AI models on your content.

Automated outputs. Our AI summaries, alerts and reports help you decide; they do not make decisions about you that have legal or similarly significant effects. They are not legal, financial, tax or valuation advice, so check anything important before you rely on it.

Legal bases (where required). Where the law of your location requires a legal basis, we rely on performing our contract with you, our legitimate interests in running and securing the service, your consent (for example, connecting Google Drive or receiving marketing), and compliance with legal obligations.

No user data is used to train any AI model. This covers your account details, property records, documents, photos, emails, messages, prompts and AI responses, including anything processed for us by AI providers.

When you use an AI feature, the relevant prompt and property context are sent to our AI provider (currently OpenAI) solely to generate your response. Using your information to answer your question is not the same as training a model on it. Our agreements and account settings with AI providers prohibit them from using your data for training.

We may change the AI models, model versions or AI providers we use as the technology improves. Every provider we use must meet the same commitments in this section: no training on your data and no retention. New AI providers are announced on our Subprocessors and Data Locations page (Section 7).

Our AI provider does not retain your data. Prompts and property context are processed only to generate a response and are not stored by the provider. All your information is held in Propsights' own databases, where you control it.

AI outputs can be wrong or incomplete. Review them before acting, and tell us if a response contains something it should not.

Connecting Google Drive is optional, and we access only the folders you explicitly select. We do not access, read or process content in folders you have not selected, and nested folders or shortcuts never extend access beyond your selection. Adding a folder always requires a new, explicit choice by you.

Content from selected folders is used only to provide the Propsights features you request, and it is covered by our no-model-training commitment. We store the authorisation tokens needed to keep the connection working.

Google API Limited Use. Propsights' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not allow humans to read it except with your permission, for security purposes, to comply with law, or in aggregated, anonymised form for internal operations.

Google Calendar sync. Connecting Google Calendar is optional and off by default. You explicitly choose to connect your Google account, and Google shows you the permissions being requested before any access is granted. When connected, we may request permission to manage events on Google calendars owned by your Google account, and we use that permission only to create, update and delete calendar events corresponding to Propsights items you have set up for calendar synchronisation, such as tasks, reminders and inspections. Events are synchronised with the authenticated user's primary Google Calendar. We do not list, import, display, analyse or otherwise process pre-existing or unrelated events from your Google Calendar.

What we store for calendar sync. To provide and maintain Google Calendar synchronisation, we may store the email address of the connected Google account (so you can see which account is connected), encrypted OAuth access and refresh tokens, token expiry and connection-status information, Google Calendar event identifiers and synchronisation status, and references linking synchronised events to the corresponding Propsights items. OAuth credentials are stored securely and are used only to provide and maintain the calendar integration.

Purpose limitation and AI. Information received through the Google Calendar integration is used only to provide and maintain the calendar synchronisation you requested. It is not sold and is not used for advertising, retargeting, credit assessment, lending or data-broker activities. It is not transferred to OpenAI or any other AI provider, and it is not used to develop, train, test or improve AI or machine-learning models. Our separate AI-powered features do not receive Google Calendar data.

Microsoft email sync. Connecting a Microsoft 365 or Outlook mailbox is optional. When you connect one, we use the Microsoft Graph API, with the permissions you approve, to read your emails and identify those relevant to your properties. We keep only emails about:

• income and expenses for your properties, such as rent statements, invoices, receipts and bills
• your property agents and property managers
• your mortgage brokers, including their news and messages
• banking news and interest-rate changes

Relevant emails and their attachments are sorted against the right property and stored in Propsights for you to review. All other emails are discarded: they are processed only briefly to check relevance, and their content is not stored. Sorting uses our AI provider (Section 4), and no email content is used to train any model. We request read-only access and do not send, delete or change emails in your mailbox.

Emails you keep may contain personal information about senders, such as agents, brokers and suppliers. We handle it under this policy, and only for your property records. You can also forward individual emails to Propsights instead of connecting a mailbox.

Microsoft Outlook Calendar sync. Connecting a Microsoft calendar is optional. Calendar information obtained through the Microsoft Outlook Calendar integration is used only to provide the calendar synchronisation you requested, and our use of Microsoft Graph API data is subject to the Microsoft API Terms of Use and applicable Microsoft data-handling requirements.

Disconnecting. You can disconnect an integration in Propsights or revoke access in your Google or Microsoft account at any time. This stops future access and, for calendar connections, deletes the stored OAuth access and refresh credentials in line with our retention practices (Section 8). Copies already imported into Propsights stay until you delete them, and deleting them in Propsights does not delete the originals in Google Drive or your mailbox. Calendar events already created in your Google or Outlook calendar may remain there unless you remove them through the synchronisation or in the external calendar.

We do not sell personal information, and we do not share it for cross-context behavioural or targeted advertising. We disclose it only in these situations:

• People you share with. When you share a property record, task, message, quote or document with a team member, agent, property manager or supplier, they can see what you shared. Share only what they need. They may keep their own copy, which your deletion will not remove.
• Service providers. Our subprocessors (Section 7) process information on our behalf under contracts that limit use to providing services to us.
• Integrations you choose. When you connect a third-party service, information flows as you authorise.
• Professional advisers. Lawyers, accountants and auditors, under confidentiality obligations.
• Legal requirements. Where required by law, court order or a valid request from a government authority, or where needed to protect someone's safety, our rights or the security of the service.
• Business transfers. If Propsights or its assets are sold, merged or restructured, your information may transfer to the new owner. We will email you at least 30 days before the transfer, and the new owner must honour this policy, including our commitments on AI training, data location and deletion. If you object, you can delete your data or close your account before the transfer takes effect.
• With your consent. Any other disclosure only with your permission.

We use a small number of service providers (subprocessors) to run Propsights. The table below lists them as at the date of this policy. The current list, including each provider's purpose and processing location, is always available on our Subprocessors and Data Locations page.

We update the Subprocessors and Data Locations page at least 14 days before a new subprocessor starts processing your information, and you can subscribe there to receive updates by email. In an emergency, such as a security issue or service failure, we may replace a provider straight away and update the page as soon as practicable. Every subprocessor must protect your information to the standards in this policy.

Where your data is stored. Your data is stored in the AWS region for your country:

• Australian customers: AWS Australia. Your records, documents, synced emails and backups stay in Australia.
• United States customers: AWS United States. Your records, documents, synced emails and backups stay in the United States.
• Customers in other countries: AWS United States, unless we agree otherwise with you.

Some processing happens outside your storage region. AI requests are processed by our AI provider (currently OpenAI, in the United States) and are not retained there. Our team, based in Australia, may access account data to provide support or keep the service secure, under strict access controls.

For Australian customers: your data is stored in Australia. The only routine overseas disclosure is to our AI provider (currently OpenAI, in the United States), to generate AI responses and sort emails, without retention. If a new provider would process your information in another country, that country will be shown on the Subprocessors and Data Locations page before processing starts. Before any overseas disclosure, we take reasonable steps under APP 8 to ensure the recipient handles your information consistently with the Australian Privacy Principles, including through contractual protections, and we remain accountable for it.

For United States customers: your data is stored and processed in the United States. Support access by our Australian team is limited to what is needed to help you and keep the service secure.

For customers in other regions with data-transfer rules (such as the EU or UK), we use appropriate safeguards, such as standard contractual clauses, where required.

You control deletion. You can delete individual records, documents and AI conversations, or close your account and delete all of its data, from inside Propsights.

• While your account is active, we keep your records so the service can work, until you delete them.
• When you delete something from your profile, it is permanently deleted from our databases.
• When you cancel your account, you have 90 days to export your data. After 90 days, all of the account's data is permanently deleted from our databases. You can ask us to delete it sooner.
• Backups: we back up data daily, and each backup is kept for 30 days before it is automatically deleted. Deleted data therefore disappears from backups within 30 days. You can ask us to remove it from backups sooner by emailing admin@axio360ventures.io.
• What we must keep: our own billing and transaction records with you, for 7 years, to meet Australian and US tax and corporate record-keeping laws; records of privacy requests and how we handled them, for 24 months; and the email addresses of people who have unsubscribed, so we can honour their choice. We may also keep information where needed to resolve a dispute, enforce our terms or comply with a legal hold.
• Your own records: Propsights is not your record-keeper for tax purposes. Export anything you need to keep, such as rental income and expense records, before you delete it or before your 90-day export window ends.
• Shared records: deleting your copy does not delete copies other participants hold, or originals in Google Drive or your mailbox.

Because our AI provider does not retain your data, deleting it in Propsights removes it from every live system we use. We keep only de-identified, aggregated usage statistics that cannot identify you.

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. These include encryption of your data in transit and at rest (including backups), access controls limited by role and need, restricted staff access, and contractual obligations on our providers. No system is completely secure, so keep your password private and tell us straight away if you suspect your account has been compromised.

Data breaches. If a breach is likely to cause serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and notify affected US residents and regulators as state breach-notification laws require.

Health information. Propsights is designed for property records, not health information. It is not intended for use by healthcare providers or health plans to store patient information, and we do not enter into business associate agreements. Please do not upload medical records or other health information. If you upload some by mistake, delete it from your profile; to remove any copy left in backups, email us. Email sync is designed to discard emails that are mainly about someone's health. If your health information appears in someone else's Propsights records (for example, as a tenant), email us and we will arrange its removal.

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you can:

• Access the personal information we hold about you (APP 12).
• Correct information that is inaccurate, out of date, incomplete, irrelevant or misleading (APP 13).
• Opt out of direct marketing at any time, using the unsubscribe link or by emailing us (APP 7).
• Deal with us anonymously or by pseudonym where practical, such as general enquiries.
• Complain about how we have handled your information.

Most access and deletion you can do yourself in the app. For anything else, email admin@axio360ventures.io. We will verify your identity and respond within 30 days. Access is free; if a request is unusually large we may charge a reasonable cost, and tell you first. If we refuse a request, we will explain why in writing and how to complain.

Complaints. Email us with the details. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC).

We extend the following rights to all US users, whether or not your state's privacy law applies to us. Residents of California, Virginia, Colorado, Connecticut, Texas, Oregon and other states with comprehensive privacy laws may have these rights by law:

• Know and access the categories and specific pieces of personal information we hold, and get a portable copy.
• Correct inaccurate information.
• Delete your information, subject to legal exceptions.
• Opt out of sale, targeted advertising and profiling with legal or similarly significant effects. We do none of these, so there is nothing to opt out of; we also honour Global Privacy Control (GPC) browser signals.
• Limit use of sensitive information. We use account login credentials only to provide the service, and do not use sensitive information to infer characteristics about you.
• Non-discrimination. We will not treat you differently for exercising your rights.

How to make a request. Email admin@axio360ventures.io with "Privacy request" in the subject. We will verify your identity by matching information we already hold, and respond within 45 days (extendable once by 45 days with notice). An authorised agent may act for you with your signed permission. If we deny your request, you may appeal by replying to our decision; we will respond to appeals within 60 days and, if you remain unhappy, you can contact your state Attorney General.

California notice at collection. In the past 12 months we collected the categories in Section 2: identifiers, customer records, commercial information (subscriptions), internet activity, approximate geolocation, professional information, and account login credentials (sensitive personal information). We collect them for the purposes in Section 3, disclose them for business purposes only to the recipients in Sections 6 and 7, and keep them as set out in Section 8. We have not sold or shared personal information, and we do not knowingly sell or share the information of consumers under 16.

We use essential cookies to keep you signed in and secure the service. Any analytics we use measure how the product is used so we can improve it; we do not use advertising or cross-site tracking cookies. You can block cookies in your browser, but essential features may stop working. We will list the analytics tools we use here before enabling them.

Propsights is for adults managing property. It is not directed to anyone under 18, and we do not knowingly collect personal information from children under 13 (or under 16 in jurisdictions with a higher age). If you believe a child has given us information, contact us and we will delete it.

We will update this policy as Propsights grows. The date at the top shows the latest version. For material changes, we will notify you by email at least 30 days before they take effect.

For privacy questions, data requests or complaints, email admin@axio360ventures.io. Please don't include unnecessary sensitive information in your message. For sales and general support, email info@propsights.io.

Axio360 Ventures Australia Pty Ltd (ACN 698 584 851), 180 George Street, Sydney NSW 2000, Australia.

Nothing in this policy limits rights you have under the law of your location.