Privacy policy

Vestrata is a venture of Hillbrook Projects Pty Ltd (ACN 152 218 304), based in Melbourne, Victoria. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

What we collect

We collect only what we need to run the platform and respond to you:

• Enquiry details you give us on our access request form: name, work email, company, role, portfolio size, phone number and any message.
• Account details if you register: name, email, phone number and a hashed password. We never store passwords in plain text.
• Property and document records you or your builder, owner or manager upload, which may include contact details for tenants, contractors and other parties.
• Technical data such as IP address, browser type and pages visited, collected through Cloudflare and analytics tooling.

Why we collect it

• To respond to your enquiry and assess whether Vestrata suits your portfolio.
• To create and secure your account and control who can see which records.
• To provide the property record, compliance, maintenance and reporting features you use.
• To meet our legal and record-keeping obligations.

Who we disclose it to

We do not sell personal information. We disclose it only to service providers who help us operate the platform (hosting, email delivery, analytics), to parties you have explicitly granted scoped access to a property record, and where we are required to by law.

Where it is held

Records are held in Cloudflare infrastructure. Some service providers may process data outside Australia. We take reasonable steps to ensure any overseas recipient handles your information consistently with the APPs.

Security

Access is role-scoped and least-privilege. Data is encrypted in transit. We keep an audit trail of changes to property records. No system is perfectly secure, and we will notify you and the OAIC as required if an eligible data breach occurs.

Retention

A property record is designed to be permanent, because that is the point of the product. Your personal information attached to that record is retained while it is needed for the purposes above or as required by law, and is de-identified or deleted when it is not.

Cookies and analytics

We use strictly necessary cookies for authentication, and analytics tooling to understand how the site is used. You can block cookies in your browser, though parts of the platform will stop working.

Accessing or correcting your information

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or complain about how we have handled it. Email tristan@hillbrookprojects.com.au. We will respond within 30 days. If you are not satisfied with our response you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

We will update this page if our practices change, and revise the date at the top.