KRAYN Privacy Policy

1. Who we are

KRAYN Pty Ltd (ABN 95 696 422 009), Melbourne, Victoria ("KRAYN", "we") operates krayn.au and the Site Intelligence service. We handle personal information in line with the Australian Privacy Principles. This policy explains what we collect, why, and your rights. Contact: krayn@krayn.au.

2. What we collect

Account details: name and email address, and organisation name on multi-seat plans. Payment: processed by Stripe — we receive transaction records but never your full card number. Service use: the property addresses you query, the plan/intent you select, the reports generated for you, and your questions to KAI (the assistant). Technical: log and device data, and cookies (section 8). Files you choose to upload. Some parts of the service accept a file from you: a photograph of the site when you request a report, and a document — such as a contract of sale or a vendor's disclosure pack — when you ask us to cross-check it against the record. Uploading either is optional, and a report can be produced without them. We do not store these files at all. They are held in memory only for as long as it takes to read them, and are never written to our disk, our database or our logs. What we keep is the result: the features visible in a photograph, or the structured comparison between a document's statements and the record. Because we never store the file, there is nothing for us to delete later. You should not upload a document containing information you do not want read. We do not ask for, and you should not submit, sensitive information (such as health information) in free-text fields.

A note specific to this product: the addresses you search can reveal your property interests. We treat your query history as personal information and protect it accordingly.

3. Why we collect it

To deliver the service (generate the reports you request and maintain your report history); to bill you; to support you; to secure and debug the service; to improve the product using aggregated, de-identified usage patterns; and to send service messages. We may email existing customers about the product; every such email includes an unsubscribe link, and unsubscribing takes effect immediately. We do not sell personal information.

4. Who we share it with

Service providers who process data for us: Stripe (payments); our cloud hosting provider Linode (Akamai Connected Cloud), in its Sydney, Australia region; and Anthropic, which provides the AI language models behind KAI and report generation, and whose commercial terms state that it does not train its models on customer content submitted through its services; Google, whose services help us understand how the site is used and measure our advertising (Google Analytics and Google Ads, including remarketing) — the cookies involved are listed in section 8 and are set only with your consent; and Twilio SendGrid, which delivers our email (your name and email address). Where you upload a photograph, the image itself is sent to Anthropic to identify the features visible in it. Where you upload a document, the text is extracted on our own servers in Australia, and only that extracted text — never the file — is sent to Anthropic to compare its statements against the record. Anthropic's published terms state that it does not train its models on customer content submitted through its services, and that it deletes inputs and outputs within 30 days of receipt, except where content is flagged by its safety systems, in which case it may be retained for up to two years. No report contents, uploaded files, or the addresses you assess are shared with advertising platforms. Each provider is bound to use the data only to provide its service. We disclose information if the law requires it, and would tell you unless prohibited. Property queries are sent to government data services as coordinates and parcel identifiers, not tied to your identity.

5. Overseas disclosure

Some providers process data outside Australia — Stripe, Google, Twilio SendGrid and Anthropic process data in the United States, while our hosting and our database are in Australia, where the reports and query history we hold for you are stored. Where they do, we take reasonable steps, consistent with Australian Privacy Principle 8, to ensure your information is handled in line with this policy.

6. Security

Data is encrypted in transit; access is restricted to those who need it; payment card data never touches our servers. No system is perfectly secure. If a data breach likely to result in serious harm occurs, we will notify affected users and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

7. Retention

Account and report data are kept while your account is active so your report history remains available to you. If you close your account, the identifying details on your account record — your name, email address, phone number and organisation — are overwritten immediately. Your reports and your KAI conversations are not deleted at that point: they are currently retained indefinitely, and nothing automatically deletes them. Transaction and tax records are kept for at least five years, as required by Australian tax law, along with information we must retain to meet other legal obligations. If you want your reports or conversations removed, email us at krayn@krayn.au and we will delete them.

8. Cookies

We use cookies necessary for the service (sign-in and session) and, only after you accept them, cookies from Google Analytics and Google Ads (_ga and _ga_7FXR9ZZKRL for analytics, _gcl_au for advertising measurement, and Google advertising cookies set on doubleclick.net). If you decline, none of those are set. Your choice itself is remembered in your browser’s local storage, not in a cookie. A first-party cookie records an advertising click identifier only if you arrive from one of our ads. You can control cookies in your browser; necessary cookies are required for sign-in.

9. Access, correction and complaints

You may ask for a copy of your personal information, ask us to correct it, ask us to stop using it for a particular purpose, or ask us to delete your account, by emailing krayn@krayn.au. We respond within 30 days. If you believe we have mishandled your information, contact us first and we will try to put it right. You may also complain to the Office of the Australian Information Commissioner (oaic.gov.au).

10. Children

The service is not directed at people under 18, and we do not knowingly collect personal information from them.

11. Business transfers

If the business or its assets are transferred, personal information may transfer with it, subject to this policy.

12. Changes

We will post changes to this policy here with a new effective date, and notify account holders of material changes by email.