1. Introduction
PropAlly Pty Ltd (ABN pending) ("PropAlly", "we", "us", "our") is committed to protecting the privacy of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile application, and related services (collectively, the "Service").
By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.
2. Information We Collect
2.1 Information You Provide
Account Information
Name, email address, password, and profile details when you create an account.
Property Information
Property addresses, purchase details, tenancy information, financial data, and other property-related information you enter into the Service.
Payment Information
Billing details processed through our third-party payment provider (Stripe). We do not store your full credit card details.
Communications
Messages, feedback, and support requests you send to us.
Photos & Documents
Images, inspection reports, receipts, and documents you upload to the Service.
2.2 Information Collected Automatically
Usage Data
Pages visited, features used, time spent, clicks, and interactions within the Service.
Device Information
Browser type, operating system, device identifiers, and screen resolution.
Log Data
IP address, access times, referring URLs, and error logs.
Cookies & Similar Technologies
See our Cookie Policy for details. Cookie Policy
3. How We Use Your Information
- Provide, maintain, and improve the Service
- Process transactions and manage your account
- Send transactional emails (e.g., password resets, billing confirmations)
- Send marketing communications (with your consent, which you can withdraw at any time)
- Generate insights, analytics, and reports within the Service
- Detect, prevent, and address fraud, abuse, and technical issues
- Comply with legal obligations under Australian law
4. How We Share Your Information
We do not sell your personal information. We may share your data with:
Service Providers
Third-party vendors who help us operate the Service (e.g., cloud hosting, payment processing, email delivery, analytics).
Legal Requirements
When required by law, regulation, legal process, or governmental request.
Business Transfers
In connection with a merger, acquisition, or sale of assets, your data may be transferred.
With Your Consent
When you direct us to share data (e.g., tenant portal sharing).
5. Gmail API & Google User Data
If you choose to connect your Gmail account, PropAlly uses the Gmail API to automatically import rental-related documents — such as property manager statements, council rates notices, water bills, and insurance renewals — into the correct property file in your portfolio. This section explains exactly how we handle Gmail data, and documents our compliance with the Google API Services User Data Policy, including the Limited Use requirements.
5.1 OAuth Scope and Consent
Opt-in only
Gmail access is off by default. You explicitly authorise the connection through Google's OAuth consent screen and can disconnect at any time.
Scope we request: gmail.modify
This scope lets PropAlly read incoming messages and apply labels (e.g. "PropAlly/Processed") so you can track what we have imported and avoid duplicate processing. We do not send emails on your behalf, and we do not delete or permanently modify your messages.
5.2 What Gmail Data We Access
Email metadata
Sender address, subject, received timestamp, and thread ID.
Email content
Subject line and plain-text / HTML body, parsed only to identify property context (such as the property address, amount, and date) before passing attachments to our extraction pipeline.
Attachments
PDFs and images (rental statements, invoices, bills) are downloaded so we can extract structured data via optical character recognition.
What we never access
We do not access your Google contacts, Google Drive, Google Calendar, chat messages, or any other Google service. We do not read unrelated email threads — only messages that match the senders and rules you have configured.
5.3 How We Use Gmail Data
Automatic document import
Rent receipts, council rates, water bills, strata levies, and insurance renewals are imported and matched to the correct property.
Tax-ready record keeping
Extracted amounts and dates are organised to support Australian Taxation Office (ATO) reporting and end-of-financial-year summaries.
Duplicate detection
Message IDs and labels are used so the same document is not imported twice.
User-visible features only
Gmail data is used solely to provide these features to you, the signed-in user. It is never used to build advertising profiles, to enrich data for other users, or for any purpose unrelated to the features described in this policy.
5.4 We Never Sell or Share Your Gmail Data
No sale, no trade
We do not sell, rent, trade, or transfer your Gmail data, attachments, or derived data to advertisers, data brokers, or any other third party for their own purposes.
No advertising use
Gmail data is never used to serve or personalise advertising, either on PropAlly or anywhere else.
No AI/ML training on your content
We do not use your Gmail messages, attachments, or extracted content to develop, improve, or train generalised or third-party AI / machine-learning models.
No human access, with narrow exceptions
PropAlly staff do not read your raw Gmail messages. The only exceptions are: (a) with your explicit consent (for example, a support request where you ask us to investigate a specific message); (b) where necessary for security, fraud, or abuse investigations; (c) to comply with applicable law; or (d) where the data has been de-identified or aggregated.
Limited sub-processors
We use Microsoft Azure (storage and compute), Azure AI Document Intelligence (OCR), and Azure OpenAI (structured field extraction) as sub-processors to deliver the feature. These providers operate under data processing agreements that prohibit them from using your data for their own purposes or for model training.
5.5 Storage, Location, and Retention
Raw email content
Processed in-memory during extraction and not persisted. Once structured data has been extracted, the raw message body is discarded.
Attachments
Stored encrypted at rest in Australian-region cloud storage so you can review the original document.
Extracted fields
Structured values (amount, date, ABN, category, property link) are stored in your account for as long as it remains active, and for up to 7 years afterwards where required by Australian tax record-keeping obligations.
OAuth tokens
Access and refresh tokens are encrypted at rest and used only to fetch new messages on your behalf.
5.6 Revoking Access and Requesting Deletion
Disconnect inside PropAlly
Go to Settings → Email Connections → Disconnect. This immediately revokes our OAuth tokens with Google, stops Gmail watch notifications, and clears stored credentials from our systems.
Revoke directly from your Google Account
You can also remove PropAlly's access at any time from your Google Account security settings. myaccount.google.com/permissions
Delete imported data
Email support@propally.com.au to request deletion of imported attachments and extracted fields associated with your Gmail connection. We action verified requests within 30 days, subject to statutory record-keeping obligations we are unable to override.
Delete your whole account
Deleting your PropAlly account also revokes any Gmail connections and removes imported Gmail-derived data in line with our standard retention policy (Section 7).
5.7 Google API Services User Data Policy — Limited Use
Limited Use compliance
PropAlly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Read the policy
The full Google API Services User Data Policy is available at: developers.google.com/terms/api-services-user-data-policy
6. Data Storage & Security
Your data is stored on secure servers located in Australia and/or the United States. We implement industry-standard security measures including encryption in transit (TLS), encryption at rest, and access controls. However, no method of electronic transmission or storage is 100% secure.
7. Data Retention & Account Deletion
We retain your personal information for as long as your account is active or as needed to provide the Service. After account deletion, we may retain certain data for up to 90 days for backup and legal compliance purposes, after which it will be permanently deleted.
7.1 How to Delete Your Account
In the mobile app
Open Profile → Account → Delete account. Confirms with your password and triggers the deletion flow.
In the web app
Open Settings → Account → Delete account. Confirms with your password and triggers the deletion flow.
By email
If you cannot access your account, email support@propally.com.au from the address on file. We action verified requests within 30 days.
What happens
We revoke any third-party connections (Gmail, calendars, payment methods), immediately deactivate the account, and permanently delete your data after the 90-day grace period (which exists only to support undo / recovery requests).
Statutory retention
Where Australian law requires us to retain certain records (e.g. tax record-keeping under the ITAA 1997, financial transaction logs under AML/CTF rules), we retain only the minimum dataset required by that law and only for as long as the law requires.
8. Your Rights
Under the Australian Privacy Act 1988 and applicable laws, you have the right to:
- Access and obtain a copy of your personal information
- Correct inaccurate or incomplete information
- Request deletion of your personal information
- Withdraw consent for marketing communications
- Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)
To exercise these rights, contact us at support@propally.com.au.
9. Third-Party Links
The Service may contain links to third-party websites or services. We are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you access.
10. Children's Privacy
The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.
12. Contact Us
If you have questions about this Privacy Policy, please contact us:
📧 support@propally.com.au
📍 Brisbane, Queensland, Australia