Privacy policy

1. Who we are

bdrck is operated by [OPERATING ENTITY] (ABN [ABN]), of [POSTAL ADDRESS], Queensland, Australia. In this policy, “we”, “us” and “our” mean [OPERATING ENTITY]; “you” means anyone who uses bdrck, including people who have only joined the waitlist. You can reach us at privacy@bdrck.com.au.

2. A note on the small business exemption

Businesses with turnover under $3 million a year are, in most cases, exempt from the Australian Privacy Principles under the Privacy Act 1988. [OPERATING ENTITY] may fall under that exemption at this stage. We have written and followed this policy regardless, because you should be able to rely on the same standard either way. If our turnover grows past the threshold, or the exemption otherwise stops applying, nothing here needs to change — we are already doing it.

3. What we collect, and why

We collect three kinds of information: what you give us to create an account, what the product produces as you use it, and a small amount of technical detail every web server records.

3.1 Account information

• Email address — to create your account, sign you in, and send you service email such as confirmations and password resets.
• Name and company — optional, shown on your account and, if you choose to add them, on the reports you generate.
• Invite code — recorded against your account during the invite-only beta.
• Consent record — the version of these terms you accepted and the date and time you accepted it, so we can show you accepted the version in force at the time.
• Waitlist details — if you join the waitlist before you have an account, we hold the email, name, company, role and note you give us, only to invite you when a place opens up.

3.2 Usage information

• Addresses you search and the parcel, planning and overlay data we return for them.
• Projects and their inputs — every assumption you enter or change (purchase price, build cost, sale price, financing terms and the rest), and the results we compute from them.
• Run counts — how many site lookups, deep dives and reports you generate, so the plan’s daily cap can be enforced and shown to you.
• Feedback you choose to send us through the in-app feedback form, together with the page you sent it from.

3.3 Technical information

• IP address and user agent, recorded in server logs by Cloudflare (our hosting provider) for every request, the same way almost every web server on the internet does.
• Cookies — a single cookie that keeps you signed in for your session. See section 13.

4. What we do not collect

bdrck is free during the beta, so we do not collect any payment details. Once a paid plan launches, card and billing details will be collected and held by our payment provider, not by us — we will never see or store your full card number. We do not collect government identifiers, health information, or anything else outside what section 3 lists.

5. How we use your information

• To run the service: create your account, sign you in, save your projects, generate your reports, and enforce the plan you're on.
• To contact you about the service — confirmations, security notices, and (only if you ask for it) product updates.
• To keep the service secure and stop abuse of the beta invite system.
• In aggregate, to understand how the product is used and where it should improve. We do not build advertising profiles and we do not sell data — see section 7.
• To meet our legal obligations, including under the Notifiable Data Breaches scheme described in section 11.

6. Where your information is stored

Your account and project data sit in a Cloudflare D1 database. We ask Cloudflare to keep it in its Oceania region, the one closest to Queensland; Cloudflare treats that as a preference and does not guarantee it. The app itself runs on Cloudflare’s network, which has points of presence around the world so pages load quickly wherever you are, and the code that reads and writes your data is placed near the database and the Queensland Government services the product queries.

7. Who we share it with

We use the processors below to run bdrck. Each one only sees what it needs to do its job, and none of them may use your information for their own purposes.

• Cloudflare — hosts the application, runs the server code, and holds the database your account, sign-in sessions and projects are kept in. It also sends our service email (address confirmations and password resets), for which it handles your email address and the content of that email.

We do not sell your information, and we do not share it for advertising. We would only share it more widely if the law required it, or to protect our rights or the safety of our users — and even then, only what is necessary.

8. How long we keep it

• Account and project data — kept for as long as your account exists.
• Account deletion — your data is deleted from the live database within 30 days of you deleting your account, and rolls off our backups within a further 30 days.
• Server logs (IP address, user agent) — kept for 30 days, then discarded.

9. Keeping it secure

• Every connection to the service uses TLS encryption — there is no unencrypted path.
• The database disks are encrypted at rest.
• Every read and write of account or project data goes through one data-access layer that filters by the signed-in account, and automated tests check that one account cannot reach another's rows.
• Passwords are never stored. We keep a salted, deliberately slow hash (PBKDF2), not the password itself, and sign-in sessions are stored as hashes too.
• Server-side secret keys never reach a browser, and every part of the system uses the least access it needs to do its job.

10. Access, correction, export and deletion

You can see and update your name and company at any time from your account page. From the same page you can export everything we hold about you as a JSON file, and delete your account outright — which starts the deletion described in section 8. If you would rather do any of this by email, write to privacy@bdrck.com.au and we will action it.

11. If something goes wrong

The Privacy Act 1988 includes a Notifiable Data Breaches scheme. If we become aware of a data breach that is likely to cause you serious harm, we will notify the Office of the Australian Information Commissioner and tell you what happened, what information was involved, and what we are doing about it — as the scheme requires.

12. Complaints

If you think we have mishandled your information, tell us first at privacy@bdrck.com.au — we would rather fix it directly than have you escalate it. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au.

13. Cookies

bdrck sets one cookie: a session cookie created by our sign-in system, so you stay logged in as you move around the app. It carries no tracking or advertising purpose and is not shared with anyone. We do not currently run any analytics or advertising cookies. If that changes, this policy will say so, plainly, before it happens.

14. Changes to this policy

We may update this policy as the product changes. The version date at the top of this page always reflects the current version. If a change is material, we will make that clear on this page and, if you have an account, tell you directly.

15. Contact us

For anything in this policy: [OPERATING ENTITY], [POSTAL ADDRESS], Queensland, Australia, privacy@bdrck.com.au.