Privacy Policy - Underburbs

This Privacy Policy explains how Underburbs (“we”, “us”, or “our”) collects, uses, discloses, stores, and protects your personal information when you visit our website, sign up for an account, subscribe to a paid plan, or otherwise use our analytics service (collectively, the “Service”). We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and other applicable privacy laws.

1. About Us

Underburbs is an Australian property analytics platform operated from New South Wales, Australia. References in this policy to “Underburbs”, “we”, or “us” mean the operator of the Service.

2. Personal Information We Collect

We collect the following categories of personal information:

Account information. Email address, name (if provided), profile image (if provided), authentication identifiers, and password hashes (managed by our authentication provider, Clerk).
Subscription and billing information. Plan, subscription status, billing history metadata, and partial payment-method details (such as card brand and last four digits). Full payment-card details are collected and held by Stripe and are not stored by us.
Usage and device information. Pages viewed, features used, session duration, referring URLs, browser type, operating system, device identifiers, language, approximate location derived from IP address, time zone, and similar technical metadata.
Communications. Messages you send to support (for example via hello@underburbs.com) and your responses to surveys or feedback prompts.
Cookies and similar technologies. See our Cookie Policy for details.

We do not knowingly collect sensitive information (such as health, racial, or political information) and ask that you do not provide such information through the Service.

The Service does not collect, sell, or analyse personal information about identifiable property owners. Property sales information shown in the Service is aggregated from public government records and presented at suburb, street, or property-type level. Where the Source Data inherently contains property addresses (as in the NSW Valuer General dataset), it is displayed only to the extent reproduced from the public source.

3. How We Collect Personal Information

directly from you when you sign up, subscribe, or contact us;
automatically when you interact with the Service (cookies, server logs, product analytics);
from third parties such as Clerk (authentication) and Stripe (payments).

4. Why We Use Your Personal Information

We use personal information to:

create and manage your account and verify your identity;
provide, personalise, maintain, and improve the Service;
process Subscription payments and send billing-related communications;
send service-related notices (security alerts, billing notices, policy updates);
respond to support enquiries;
detect, investigate, and prevent fraud, abuse, or unauthorised access;
comply with legal obligations and enforce our Terms;
analyse usage patterns in aggregate to improve the Service.

We rely on the following lawful bases under the APPs and (where applicable) comparable foreign laws: performance of our contract with you, compliance with legal obligations, and our legitimate interests in operating, securing, and improving the Service in a way you would reasonably expect.

5. Marketing Communications

We may, with your consent or where otherwise permitted by law, send you product updates, tips, and offers related to the Service. You can opt out at any time using the unsubscribe link in the email or by contacting hello@underburbs.com. Service-related and transactional messages (such as billing receipts and security alerts) are not opt-out.

6. Disclosure to Third Parties

We do not sell your personal information. We disclose personal information only to the following categories of recipients:

Service providers and processors that help us operate the Service, including:
- Clerk Inc. (authentication, account management);
- Stripe, Inc. (payment processing, fraud prevention);
- Vercel, Inc. (hosting, edge delivery, request logs);
- Supabase Inc. (database hosting);
- email and analytics providers we may engage from time to time.
Professional advisers (lawyers, accountants, auditors) where reasonably necessary.
Authorities where required by law, to comply with a legal process, or to protect our rights, the Service, or the safety of others.
Successors in connection with a merger, acquisition, financing, reorganisation, or sale of assets.

Each provider is contractually obligated (or bound by their own privacy commitments) to use personal information only as necessary to provide their service.

7. Cross-Border Disclosure

Some of our service providers store or process personal information outside Australia, including in the United States (Clerk, Stripe), the European Union, and other regions where Vercel and Supabase operate infrastructure. By using the Service, you acknowledge that your personal information may be transferred to and processed in jurisdictions whose data-protection laws may differ from those of Australia. We take reasonable steps to ensure overseas recipients handle your information consistently with the APPs.

8. Data Retention

We retain personal information for as long as your Account is active or as needed to provide the Service, comply with legal obligations (such as tax and accounting requirements), resolve disputes, and enforce our agreements. When personal information is no longer required, we delete or de-identify it within a reasonable timeframe, subject to applicable law. Account data is generally deleted within thirty (30) days of a verified deletion request, except for billing records we are required to retain.

9. Security

We take reasonable technical and organisational measures to protect personal information from misuse, loss, unauthorised access, modification, or disclosure. These measures include TLS encryption in transit, encryption at rest where supported by our providers, access controls, and regular review of our security posture. No method of transmission or storage is completely secure; you provide your information at your own risk.

10. Your Rights

You have the right to:

access the personal information we hold about you;
request correction of inaccurate or incomplete information;
request deletion of your information (subject to legal retention requirements);
withdraw consent for marketing communications;
request a copy of your information in a portable format; and
lodge a complaint with us or a regulator.

To exercise any of these rights, email hello@underburbs.com. We will respond within thirty (30) days.

11. Complaints

If you have a privacy complaint, please first contact us at hello@underburbs.com and we will work in good faith to resolve it. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

12. Children

The Service is not directed to anyone under 18 and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

13. Cookies and Similar Technologies

We use cookies and similar technologies as described in our Cookie Policy. Most browsers allow you to control cookies through their settings.

14. Automated Decision-Making

We do not use your personal information for automated decision-making that produces legal or similarly significant effects on you.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice and update the “Last updated” date above. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

16. Contact

For privacy enquiries or to exercise your rights, contact hello@underburbs.com.