Privacy & Cookie Policy
Updated: 30 September 2026
This policy explains how Moyne Ross handles information when you contact us, visit this website or use our consulting services and portal. It covers personal information and explains our approach to confidential asset information. The legal provider for commissioned work is identified in your instruction; the current website operator uses ABN 18 890 160 412. Privacy enquiries can be made through our contact form.
We use the Australian Privacy Principles as a framework for handling personal information and comply with privacy laws applicable to our activities. This policy does not limit rights you have under applicable law. Homechecker has its own service-specific privacy notice; this page concerns Moyne Ross.
1. Information we collect
Depending on how you work with us, information may include:
- Contact and instruction details: name, contact information, organisation, role, client objectives, scope approvals, correspondence and relevant records of meetings.
- Asset evidence: addresses, plans, photographs, reports, leases, maintenance information, cost records and other documents provided for the instruction. Some may contain details about owners, tenants, employees or other people.
- Inspection records: observations, site notes and photographs where a site visit is commissioned. Please identify access, photography or confidentiality restrictions in advance.
- Portal information: account and authentication details, access permissions, submitted questions, generated responses, strategy versions and records needed to operate the service.
- Payment and administration: billing details, invoices and transaction references. Where Stripe processes a card payment, it handles the card information; we do not store the full card number.
- Technical information: IP address, browser and device information, security and error logs, and website analytics where enabled by your choices.
We also research public sources, including property listings, imagery, planning and public records. Public availability does not mean all information is accurate or unrestricted. We use relevant material for the instruction and distinguish reported facts from inference. Please avoid sending identity documents, sensitive personal information or unrelated correspondence unless we have specifically agreed that it is needed.
2. How information is used
We use information to respond to enquiries, understand your objectives, agree and deliver services, assess assets, develop and review strategies, operate the portal, process payments, maintain appropriate records and resolve concerns. We may also use it to meet legal obligations, protect the service and obtain professional, legal or insurance advice.
We do not treat an enquiry or a service instruction as blanket permission for unrelated marketing. Where we send optional updates or research communications, you can ask us to stop. We will explain and obtain any permission needed for materially different uses of your information.
3. AI processing
The MR engine and related features use third-party AI services to assist with research, document interpretation, assessments, drafting and interactive questions. Depending on the selected feature and agreed processing, these may include Anthropic (Claude) and Google (Gemini). Not every provider is used for every instruction. We will identify the relevant arrangements before processing private or confidential material; a provider’s technical availability does not itself authorise disclosure to it.
Information sent to an AI service can include relevant extracts or documents, images, asset details, questions, processing instructions and assessment context. Before private or confidential information is uploaded, we require appropriate express written permission and an assessment of whether the proposed use is acceptable. You must have authority to share material about other people or organisations; tell us about restrictions before uploading it.
We seek to minimise unnecessary personal information and use business or API arrangements appropriate to the information involved. Training use, retention, logging and deletion depend on the provider, product and account configuration. We do not make a general promise of zero retention or immediate deletion. We will explain relevant restrictions before using a service for confidential work. Any proposed use of identifiable client material to train or fine-tune a model requires a separate, explicit agreement.
You can ask which systems were used for your instruction and request an explanation of their role, limitations and relevant data arrangements. AI is integral to an engine-generated Capital Strategy. If you object to a proposed use, contact us before supplying the material so we can discuss whether a different scope is possible. More detail is available in Our Approach to AI.
4. Service providers and overseas processing
Information may be handled by providers supporting hosting, databases, authentication, document storage, email, payment and analytics. The platform uses services including Vercel, Supabase and Google Workspace; Stripe supports payment processing and Google Analytics supports optional website analytics. The services involved depend on the feature and engagement.
These providers and AI services may process information outside Australia, including in the United States and other locations used by their infrastructure or support teams. An Australian storage region does not necessarily mean every related processing activity remains in Australia. You can request information about the arrangements relevant to your instruction.
Where applicable privacy law requires safeguards for overseas disclosure, we take the steps required by that law. A client’s agreement to use AI does not by itself remove our responsibilities for selecting providers, handling information or assessing overseas processing. We will update this notice and inform affected clients before a material change to confidential-data processing, obtaining renewed permission where necessary.
5. Confidentiality, sharing and research
Asset records and client discussions may be commercially confidential even when they contain no personal information. We use that material for the agreed instruction and related administration, subject to your confidentiality restrictions and lawful disclosure requirements. We may share relevant information with authorised client users, agreed specialists, service providers and our professional advisers on an appropriate basis.
Information may also be disclosed where required or permitted by law, to address a dispute or insurance matter, or to meet an applicable professional obligation. We do not sell personal information or make one client’s identifiable confidential asset records available to another client.
Research and benchmarking may use public information, separately authorised material or information that has been effectively de-identified and can lawfully be used for that purpose. Removing a name or address alone may be insufficient. Any identifiable client case study or publication of confidential findings requires permission. An instruction does not automatically authorise publication of your strategy or unrestricted use of your documents for model development. Tell us about restrictions on derived information so they can be addressed before work starts.
6. Chat, working reports and professional records
Portal questions and the relevant assessment context are sent to the AI service handling that feature. Library Chat conversations are held in the working session rather than provided as a permanent conversation archive. Do not rely on the chat interface as the sole record of advice or decisions. Provider retention and technical logging are separate from what remains visible in your browser.
Strategy versions, issued deliverables, relevant decisions and any material deliberately saved into the engagement record may be retained. Some working features store preferences or drafts locally in your browser. Downloaded reports and copies saved by you remain under your control. Ask us to record a material conclusion in the professional deliverable or instruction where appropriate.
7. Security, retention and deletion
We use access controls and appropriate technical and organisational measures to protect information. Access should be limited to people and services that need it for the relevant purpose. No system can guarantee absolute security. Please protect your credentials, use authorised sharing arrangements and tell us promptly if you suspect an information-security incident.
Engagement records are normally retained for seven years after the relevant work ends, and longer where reasonably required for legal, professional, insurance or dispute purposes. This includes correspondence forming part of the advice record. Temporary working material and technical data may have shorter retention periods. Provider-held copies, backups and records subject to a legal hold can follow different schedules.
You may request deletion. We will explain what can be deleted, what must be retained and why, including any practical limits affecting backups or third-party systems. We will not promise a deletion outcome that we cannot verify. If a suspected breach occurs, we will investigate, take appropriate containment and remedial action, and make notifications required by applicable law.
8. Access, correction and privacy concerns
To request access, correction, deletion or information about our practices, use our contact form and mark the enquiry “Privacy”. We may need to verify your identity or authority. If a request cannot be met in full, we will explain the reason and any available review or complaint options. Withdrawing permission may affect services that depend on the processing; we will discuss the consequences rather than treating withdrawal as erasing records already lawfully required.
We aim to acknowledge privacy complaints within five business days and respond substantively within thirty days, keeping you informed if further time is needed. You may contact the Office of the Australian Information Commissioner about matters within its jurisdiction, or another regulator where applicable.
9. Cookies and browser storage
The website and portal use cookies or similar storage for functions such as authentication, security, consent choices and interface preferences. Payment providers may use technologies needed for transaction security. Optional website analytics uses Google Analytics to help us understand visits and improve the site.
Use Cookie Settings to review the website’s optional cookie choices. You can also use your browser settings to manage cookies and local storage. Blocking essential storage may affect sign-in or other requested features. Changing a choice does not automatically erase information already collected.
Retention varies between session storage, persistent preferences, analytics settings and provider security records. Contact us for details of the configuration relevant to your use. Third-party websites reached through links have their own privacy and cookie arrangements.
10. Changes to this policy
We will update this page when our services or information-handling arrangements change. Material changes affecting existing clients will be communicated appropriately, with any necessary permission obtained before the new use begins. A revised privacy notice does not retrospectively authorise a new use of confidential material.