Privacy Policy

This Privacy Policy explains how Virtual Buyers Agent Pty Ltd (ACN 694 217 046) ("we", "us", "our") collects, uses, discloses, and protects personal information when you use virtualbuyersagent.com.au and related services. It also explains the optional analytics and advertising choices available in the product. Using necessary features is not treated as consent to optional tracking. This policy is written to match how the service works, and it is not a claim that the service complies with the law everywhere.

We collect several categories of information: (a) Account information: name, email, password (securely hashed), and profile photo when you register; (b) Investor profile: experience, main goal, target price range, deposit, finance position, property types, target locations, hold period, maximum weekly shortfall, and optional modelling defaults that you choose to provide; (c) Financial context: finance limits and assumptions you provide for transparent property modelling; (d) Property activity: properties, evidence notes, document-checklist status, tasks, reminders, workflow progress, assumptions, and decisions you record; Virtual Buyers Agent does not operate a document file vault; (e) Behavioural data: pages visited, features used, session duration, and interaction patterns; (f) Device data: browser type, operating system, IP address, and device identifiers; (g) Payment data: handled by Stripe, and we do not store full card numbers; (h) Communication data: support conversations, feedback you send us, email engagement metrics, and your notification preferences; (i) Operational and transactional events: limited server-generated records of requested account, subscription, delivery, security and technical outcomes. This processing is separate from the optional client-analytics choice described in clause 12 and is minimised to the operational or transactional purpose. (j) Help requests: when you ask a question through Help, we store your message, the topic you choose, the page and area you asked from, which property you were looking at (where there is one), and your account email address and name. We use these details to answer your question. (k) How you found us: if you answer the optional question after you sign up, the option you choose and any words you add under "Something else". If you arrived through a link a partner gave you, such as a mortgage broker, that link's short code, which identifies the partner, not you. We use these only to understand which channels bring people to Virtual Buyers Agent. A partner is told at most how many people used their link, never who, and these details are never sent to an advertising platform.

We use your information to: (a) Provide the Service: authenticate your account, organise property information, calculate transparent modelled figures, and present the guided workflow in the context of information you provide; (b) Improve the Service: analyse usage patterns to enhance features, fix bugs, and optimise performance; (c) Communicate with you: send transactional emails, product updates, and marketing communications (with your consent); (d) Process payments: process one-time purchases and refunds, manage existing subscriptions, and send invoices; (e) Ensure security: detect fraud, prevent abuse, and protect user accounts; (f) Comply with law: meet legal obligations and respond to lawful requests. Feedback and ratings you send are used only to improve the product. They are never published. We do NOT use your data for automated decision-making that has legal effects on you.

To provide property maps and location context, we send limited property location data to mapping and data services: • Property addresses and coordinates are sent to Mapbox for geocoding, address search, and map display. Address search and map images are requested by your browser, so those requests carry standard technical data such as your IP address, handled under Mapbox's own privacy policy. When we geocode an address you have saved, our servers make that request, so your IP address is not sent; • Property coordinates are sent to Mapbox for nearby places. These requests are made by our servers, not by your browser, so your IP address is not sent to Mapbox for them. • When you ask for a driving time from a property, the coordinates of the property and of the place or address you chose are sent to Mapbox for a driving estimate. These requests are made by our servers, not by your browser, so your IP address is not sent to Mapbox for them. If you type an address to measure to, finding that address is an address search made by your browser, as described above. We do not send your name, email, or account details with these location requests. Census demographics are sourced from the Australian Bureau of Statistics and the published cash rate target from the Reserve Bank of Australia, through aggregate, non-personal queries. Modelled figures in the guided workflow use transparent, rule-based calculations and stated assumptions. Map data is © OpenStreetMap contributors, licensed under the Open Database Licence (ODbL), and © Mapbox. Statistical data is sourced from the Australian Bureau of Statistics © Commonwealth of Australia, licensed under CC BY 4.0.

We share your data only as follows: (a) Service providers: trusted third parties who help us operate the Service (see the Third-party services section below); (b) Legal requirements: when required by law, court order, or government request; (c) Business transfers: in connection with a merger, acquisition, or sale of assets (you will be notified of any change in data controller); (d) With your consent: for any purpose you explicitly authorise. We NEVER sell your personal information to advertisers, data brokers, or any third party for their marketing purposes. We publish our own videos to our YouTube channel through YouTube API Services, the tools Google provides for apps to work with YouTube. We use only our company's Google account for this. It is separate from signing in to Virtual Buyers Agent with Google, which gives us no access to your YouTube account. To publish, we read and keep our channel's id, name and handle to confirm it is our channel, and we read the processing status of each video we upload. We also keep the view, like and comment counts of our own videos as daily figures, for as long as we report on those videos. We do not use YouTube API Services to access, collect or store information about you or any other YouTube user, and this connection places nothing on your device. YouTube's use is governed by the YouTube Terms of Service (opens in a new tab), and Google's handling of data by the Google Privacy Policy (opens in a new tab). Access that a Google account has given to any app can be removed on the Google security settings page (opens in a new tab). Questions about this can be sent to info@virtualbuyersagent.com.au.

We retain information only while it is needed for the purposes described in this policy, to operate requested account or subscription features, or where a lawful retention obligation applies. Different providers may apply their own retention settings to information they receive. Help requests, and messages sent through our contact form by people with an account, are kept while the account exists and are deleted with it. Contact form messages from people without an account are kept for 24 months and then deleted. These periods apply to what we store in the service. Account deletion does not remove copies of these messages, or our replies, from our support mailbox. We delete those copies when you ask us to. You can request account deletion in the product after signing in again to verify your identity. We record the request and process it within 30 days. The deletion surface shows the request status and target date, provides a retry path when attention is needed, and reports subscription-cancellation handling after a request. Some records may be retained where the law requires it; the deletion status must identify retained categories rather than claiming every record was removed. Contact the privacy officer if you need an explanation of retention that applies to your account.

We use technical and organisational safeguards designed for the service, including encrypted network connections, managed authentication, access controls, and operational monitoring. Our hosting and service providers maintain their own security programmes. No online service can guarantee absolute security. If a data breach occurs, we will assess it and make notifications where required by applicable law.

Core account data is hosted using Supabase infrastructure in the Sydney region. Other providers named in this policy may process information outside Australia, including through global delivery networks. Overseas recipients may be subject to different privacy laws. Provider locations and contractual safeguards can change, so this disclosure and the supporting vendor review require ongoing operator and legal review.

You can ask us to provide access to personal information we hold about you, correct inaccurate information, explain our handling, or process an account-deletion request subject to lawful retention. You can also ask us to provide your information in a portable format. You can unsubscribe from marketing communications and change optional analytics or advertising choices separately. You may also make a privacy complaint to us and, where applicable, contact the Office of the Australian Information Commissioner (OAIC). Access and portability requests are handled by email or through Help. Two controls in your dashboard let you download some of your information. "Export your properties" gives you a CSV of your active properties, with their addresses, figures, stages and notes. "Download your email and notification settings" returns your current marketing-email consent, a history of changes to that consent (when you opted in or out, and how), and the recent notifications shown in your account. Neither is a complete copy of the information we hold about you. Contact info@virtualbuyersagent.com.au to make a request. The rights and response periods that apply depend on the relevant law; nothing in this summary limits a right provided by law.

Virtual Buyers Agent is not intended for users under 18 years of age. We do not knowingly seek personal information from children. If you believe a child has provided us with personal information, contact info@virtualbuyersagent.com.au so we can investigate and take the steps required by applicable law.

With your consent, we may send you product updates, educational property content, promotional offers, or subscription information. You can opt-out at any time by: • Clicking "unsubscribe" in any marketing email; • Updating preferences in your account dashboard; • Contacting support at info@virtualbuyersagent.com.au. We process unsubscribe requests through the available email and account controls. Transactional emails (receipts, security alerts, account updates) are not affected by marketing opt-outs.

We use cookies and similar technologies for authentication, requested product features, analytics, advertising measurement, and payment processing. Necessary services remain available to operate sign-in and requested features. For a known country outside the EEA, United Kingdom and Switzerland, Product analytics and Advertising measurement are both on by default until you opt out. For detected EEA, UK and Swiss users, and when country cannot be determined, both stay off until you choose them. Each category is saved as a separate choice, so turning one off never changes the other, and a Global Privacy Control signal keeps Advertising measurement off regardless of the regional default. Privacy choices, linked in the footer of every page on this site and in Settings > Preferences when you are signed in, lets you reject or change optional categories on this device. When Advertising measurement is allowed, we may also set a first-party cookie, vba_first_touch, for up to 90 days. It records the campaign details in the link you arrived from and the website that referred you, so a later sign-up can be credited to the right campaign. We remove it if you withdraw the choice or a Global Privacy Control signal is on. The Meta, TikTok and Reddit pixels may also set their own cookies on our site while Advertising measurement is allowed. Withdrawing the choice stops them loading; cookies they already set stay until they expire or you clear them. Your decision is stored on this device under vba:client-consent:v1, with a matching first-party cookie, vba_consent, that lets our servers honour the same choice. For complete details, see our Cookie Policy. When you sign up by email with Advertising measurement allowed, we also keep with your account the Meta click identifier from the ad you followed (taken from that ad’s link or Meta’s _fbc cookie) and Meta’s browser identifier (the _fbp cookie). That lets us match your sign-up, and later steps such as completing your investor profile or making a purchase, to that ad, even if you confirm your email in a different browser. We use the click identifier for up to 7 days after the click and the browser identifier for up to 90 days. Withdrawing Advertising measurement stops this use. To help manage our advertising, we use Meta audience matching to identify registered and paid accounts and exclude them from relevant Facebook and Instagram ads. For new Australian registrations shown the sign-up disclosure, this setting is on by default. You can opt out at any time in Settings > Preferences. When Advertising measurement is also allowed, our server sends Meta a SHA-256 hash of your confirmed email address with the sign-up, investor profile, saved property and subscription events we report, so Meta can match them to the ads you saw. Turning matching off stops that too. We do not automatically enrol older accounts that were not shown this disclosure. An earlier account-matching opt-out is kept, and an earlier advertising measurement opt-out prevents the Australian default from enabling matching. Outside Australia, or when the country is unknown, matching stays off unless you choose it. Analytics and marketing email choices do not enable account matching. A Global Privacy Control signal blocks new additions. When you turn matching off, we stop new additions and arrange removal from these audiences. Meta processes audience changes, so switching off does not mean immediate removal or erasure by Meta. We keep the hashed membership details needed to complete and verify removal.

We may update this Privacy Policy to reflect changes in our practices, providers, or legal obligations. The “Last updated” date at the top identifies the latest operative revision. We will provide any additional notice or obtain a new choice where applicable law requires it.

For privacy-related inquiries, requests, or complaints: Privacy Officer, Virtual Buyers Agent Pty Ltd Email: info@virtualbuyersagent.com.au For general support: info@virtualbuyersagent.com.au We will handle requests within the period required by applicable law. If you are not satisfied with our response, you may be able to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.