1. Who we are
KRAYN Pty Ltd (ABN 95 696 422 009), Melbourne, Victoria ("KRAYN", "we") operates krayn.au and the Site Intelligence service. We handle personal information in line with the Australian Privacy Principles. This policy explains what we collect, why, and your rights. Contact: krayn@krayn.au.
2. What we collect
Account details: name and email address, and organisation name on multi-seat plans. If you buy a single report without signing in, we create an account for you from the email address you give at payment, so that the report and its tax invoice are kept for you. We email you a link to sign in to it; you do not have to use it, and you can ask us to close the account at any time (section 9). Payment: processed by Stripe — we receive transaction records but never your full card number. Service use: the property addresses you query, the plan/intent you select, the reports generated for you, and your questions to KAI (the assistant). Technical: log and device data, and cookies (section 8). Files you choose to upload. Some parts of the service accept a file from you: a photograph of the site when you request a report, and a document — such as a contract of sale or a vendor's disclosure pack — when you ask us to cross-check it against the record. Uploading either is optional, and a report can be produced without them. We do not store these files at all. They are held in memory only for as long as it takes to read them, and are never written to our disk, our database or our logs. What we keep is the result: the features visible in a photograph, or the structured comparison between a document's statements and the record. Because we never store the file, there is nothing for us to delete later. You should not upload a document containing information you do not want read. We do not ask for, and you should not submit, sensitive information (such as health information) in free-text fields.
A note specific to this product: the addresses you search can reveal your property interests. We treat your query history as personal information and protect it accordingly.
3. Why we collect it
To deliver the service (generate the reports you request and maintain your report history); to bill you; to support you; to secure and debug the service; to improve the product using aggregated, de-identified usage patterns; and to send service messages. We may email existing customers about the product; every such email includes an unsubscribe link, and unsubscribing takes effect immediately. We do not sell personal information.
4. Who we share it with
Service providers who process data for us: Stripe (payments); our cloud hosting provider Linode (Akamai Connected Cloud), in its Sydney, Australia region; and Anthropic, which provides the AI language models behind KAI and report generation, and whose commercial terms state that it does not train its models on customer content submitted through its services; Google, whose services help us understand how the site is used and measure our advertising (Google Analytics and Google Ads, including remarketing) — the cookies involved are listed in section 8 and are set only with your consent; and Twilio SendGrid, which delivers our email (your name and email address). Where you upload a photograph, the image itself is sent to Anthropic to identify the features visible in it. Where you upload a document, the text is extracted on our own servers in Australia, and only that extracted text — never the file — is sent to Anthropic to compare its statements against the record. Anthropic's published terms state that it does not train its models on customer content submitted through its services, and that it deletes inputs and outputs within 30 days of receipt, except where content is flagged by its safety systems, in which case it may be retained for up to two years. No report contents, uploaded files, or the addresses you assess are shared with advertising platforms. Each provider is bound to use the data only to provide its service. We disclose information if the law requires it, and would tell you unless prohibited. Property queries are sent to government data services as coordinates and parcel identifiers, not tied to your identity.
5. Overseas disclosure
Some providers process data outside Australia — Stripe, Google, Twilio SendGrid and Anthropic process data in the United States, while our hosting and our database are in Australia, where the reports and query history we hold for you are stored. Where they do, we take reasonable steps, consistent with Australian Privacy Principle 8, to ensure your information is handled in line with this policy.
6. Security
Data is encrypted in transit; access is restricted to those who need it; payment card data never touches our servers. No system is perfectly secure. If a data breach likely to result in serious harm occurs, we will notify affected users and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
7. Retention
Account and report data are kept while your account is active so your report history remains available to you. If you close your account, the identifying details on your account record — your name, email address, phone number and organisation — are overwritten immediately. Your reports and your KAI conversations are not deleted at that point: they are currently retained indefinitely, and nothing automatically deletes them. Transaction and tax records are kept for at least five years, as required by Australian tax law, along with information we must retain to meet other legal obligations. If you want your reports or conversations removed, email us at krayn@krayn.au and we will delete them.
8. Cookies
We use cookies necessary for the service (sign-in and session) and, only after you accept them, cookies from Google Analytics and Google Ads (_ga and _ga_7FXR9ZZKRL for analytics, _gcl_au for advertising measurement, and Google advertising cookies set on doubleclick.net). If you decline, none of those are set. Your choice itself is remembered in your browser’s local storage, not in a cookie. If you arrive from one of our ads, or from a link of ours that carries campaign tags, and you accept cookies, three first-party cookies are set: krayn_gclid, the advertising click identifier from the ad; krayn_aid, a random identifier that names no person; and krayn_ft, the campaign tags on that link (never an address), the kind of page you landed on and the time. They last 90 days, so that we can tell which campaign led to a purchase. If you decline, or do not choose, none is set. If you buy a report after arriving from one of our ads, or from a link of ours that carries campaign tags, we record those tags with your order on our own servers, whether or not you accepted cookies: the campaign tags on that link (never an address) and, unless you declined cookies, the advertising click identifier from the ad (gclid from Google, fbclid from Meta). Nothing is stored on your device for this, and we do not send what we record this way to Google or Meta. If you accepted cookies, Google Analytics also receives the Google click identifier with your purchase. We use it only to tell which campaign led to a purchase. We delete the click identifier after 90 days and the campaign tags after 24 months. You can control cookies in your browser; necessary cookies are required for sign-in.
9. Access, correction and complaints
You may ask for a copy of your personal information, ask us to correct it, ask us to stop using it for a particular purpose, or ask us to delete your account, by emailing krayn@krayn.au. We respond within 30 days. If you believe we have mishandled your information, contact us first and we will try to put it right. You may also complain to the Office of the Australian Information Commissioner (oaic.gov.au).
10. Children
The service is not directed at people under 18, and we do not knowingly collect personal information from them.
11. Business transfers
If the business or its assets are transferred, personal information may transfer with it, subject to this policy.
12. Changes
We will post changes to this policy here with a new effective date, and notify account holders of material changes by email.