Privacy Policy

Last updated: October 8, 2026

TrackMyPlace ("we", "our", "us") operates the TrackMyPlace platform at trackmyplace.com. We are committed to protecting your privacy. This policy explains how we collect, use, store, and safeguard your information when you use our real estate campaign management platform.

1. Information We Collect

We collect the following types of information:

• Account information: Your name, email address, and profile details provided during registration or via Google Sign-In.
• Platform data: Listings, client details, campaign stages, notes, documents, and other data you enter into TrackMyPlace.
• Usage data: Pages visited, features used, browser type, IP address, and device information.
• Google account data: If you choose to connect your Google account for integrations, we access specific Google data as described in Section 9 below.
• Microsoft account data: If you choose to connect your Microsoft 365 or Outlook account for integrations, we access specific Microsoft data as described in Section 9A below.

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the TrackMyPlace platform.
• Authenticate your identity and manage your account.
• Send transactional emails (e.g. password resets, notifications you have enabled).
• Provide Google- and Microsoft-integrated features you have explicitly enabled (email, calendar, contacts, and for Google, drive).
• Monitor and prevent fraud, abuse, or security incidents.

We do not sell, rent, or trade your personal information to third parties.

3. Legal Basis for Processing

We process your personal data based on:

• Contract performance: To provide the services you signed up for.
• Consent: When you connect third-party services such as Google or Microsoft.
• Legitimate interests: To improve our platform and ensure its security.

4. Data Storage and Security

Your data is stored securely using industry-standard encryption. We use Supabase for authentication and data storage, which provides enterprise-grade security including encryption at rest and in transit (TLS 1.2+). Google and Microsoft OAuth tokens are encrypted using AES-256 before being stored in our database.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. If you delete your account, your account will enter a 14-day grace period during which you may restore it. If you do not restore your account during that period, we will delete or anonymise your personal data from active systems, except where we are required or permitted by law to retain limited records. Google and Microsoft OAuth tokens are deleted immediately when you disconnect the relevant account.

We also keep an internal audit log of mutating actions (such as creating, updating, or deleting a listing, document, or conversation) so we can investigate security incidents and respond to data-access requests. Audit log entries are retained for 13 months from the date of the action and are then automatically purged by a nightly job. You can request a copy of the audit log entries associated with your account at any time via the Export My Data tool in Settings.

6. Cookies

We use cookies and similar technologies in three categories: strictly necessary (to maintain your session and core platform functionality), analytics (aggregate usage and performance metrics - off by default), and marketing (currently inactive). Non-essential cookies are only set after you give consent via the cookie banner shown on your first visit. You can change your choice at any time from the banner or from Settings → Account. See our Cookies Policy for the full list of cookies, vendors, and retention periods.

7. Sub-processors and Cross-Border Disclosure

To operate TrackMyPlace, we engage the sub-processors listed below. Some of these recipients are located outside Australia. Before disclosing your personal information overseas we take reasonable steps as required by Australian Privacy Principle 8 (cross-border disclosure of personal information), including reviewing each vendor's privacy and security terms, entering into appropriate contractual protections where available (such as data processing terms or equivalent privacy and security commitments), and choosing recipients with safeguards consistent with the Australian Privacy Principles. The list below sets out the recipients, the purpose of disclosure, and the country in which processing occurs.

Each sub-processor has its own privacy policy. We encourage you to review them, and we will update this list when we add, remove, or replace a sub-processor.

8. Your Rights

You have the right to:

• Access your personal data and request a copy.
• Correct inaccurate or incomplete data.
• Delete your account and personal data.
• Revoke consent for Google integrations at any time by disconnecting your Google account in Settings or via your Google Account permissions, and for Microsoft integrations by disconnecting your Microsoft account in Settings and removing TrackMyPlace from your Microsoft account as described in Section 9A.4.
• Export your data in a machine-readable format.

To exercise any of these rights, contact us at privacy@trackmyplace.com.

9. Google API Services - User Data Policy

TrackMyPlace offers optional Google integrations that require access to your Google account data. This section describes what data we access, why, and how we handle it.

9.1 Data We Access

When you connect your Google account, we request access to the following scopes:

• Gmail (read and manage): We read your email messages to display relevant client communications within your TrackMyPlace campaign, and we may mark messages as read/unread, archive them, or apply labels when you take those actions inside TrackMyPlace. We do not permanently delete your emails.
• Gmail (send): We send emails on your behalf when you compose and send messages through the TrackMyPlace platform. Emails are only sent when you explicitly initiate the action.
• Google Calendar: We read and create calendar events to help you manage property inspections, client meetings, and settlement dates.
• Google Contacts (read-only): We read your contacts to help you quickly add clients to your campaign. We do not modify your contacts.
• Google Drive: We access files you specifically select or create through TrackMyPlace for document management (e.g. contracts, listing agreements).
• Email address: We use your Google email address to identify your account.

9.2 How We Use Google Data

Google user data is used solely to provide the features described above within TrackMyPlace. Specifically:

• We do not use Google user data for advertising or marketing purposes.
• We do not sell, rent, or share Google user data with third parties.
• We do not use Google user data to train machine learning or AI models.
• We do not use Google user data for any purpose other than providing and improving the specific features you have enabled.

9.3 Storage and Protection of Google Data

• Google OAuth tokens (access and refresh tokens) are encrypted using AES-256 encryption before being stored in our database.
• Google user data is transmitted exclusively over HTTPS/TLS.
• Access to Google data is restricted to the authenticated user and, where a message has been shared to a deal, the members of their team.
• We do not store copies of your contacts, calendar events, or Google Drive file contents - these are accessed in real time.
• Email is the one exception: when an email message is linked to a deal - either manually by you, or automatically if you enable auto-linking - we store a snapshot of that message (including its body) so that other members of your team can read the shared client communication. Linked-email snapshots are deleted when the deal or your account is deleted.

9.4 Revoking Access

You can disconnect your Google account at any time from the Settings page in TrackMyPlace. When you disconnect:

• Your Google OAuth tokens are immediately deleted from our database.
• We will no longer have access to your Google account data.
• You can also revoke access directly from your Google Account permissions page.

9.5 Google API Services Limited Use Disclosure

TrackMyPlace's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9A. Microsoft 365 (Outlook) Integration

TrackMyPlace offers an optional Microsoft integration that requires access to your Microsoft 365 or Outlook account data through Microsoft Graph. This section describes what data we access, why, and how we handle it.

9A.1 Data We Access

When you connect your Microsoft account, we request access to the following permissions:

• Account identity (sign-in and profile): We receive your name, email address, and the identifiers of your Microsoft account and its organisation, which we use to identify the connected account. We also request ongoing access so the connection keeps working without you signing in again each hour.
• Outlook mail (read and manage): We read your email messages to display relevant client communications within your TrackMyPlace campaign, and we may mark messages as read/unread, move them, or apply categories when you take those actions inside TrackMyPlace. We do not permanently delete your emails.
• Outlook mail (send): We send emails on your behalf when you compose and send messages through the TrackMyPlace platform. Emails are only sent when you explicitly initiate the action.
• Outlook Calendar: We read and create calendar events to help you manage property inspections, client meetings, and settlement dates.
• Outlook Contacts (read-only): We read your contacts to suggest recipients when you compose an email. We do not modify your contacts.
• Mailbox settings: We read and maintain the Outlook categories used to organise messages inside TrackMyPlace, and read your mailbox time zone so that calendar events are created at the correct local time.

We do not currently request access to your OneDrive files. If we add a OneDrive feature in future, we will ask for your consent again before accessing them.

9A.2 How We Use Microsoft Data

Microsoft user data is used solely to provide the features described above within TrackMyPlace. Specifically:

• We do not use Microsoft user data for advertising or marketing purposes.
• We do not sell, rent, or share Microsoft user data with third parties.
• We do not use Microsoft user data to train machine learning or AI models.
• We do not use Microsoft user data for any purpose other than providing and improving the specific features you have enabled.

9A.3 Storage and Protection of Microsoft Data

• Microsoft OAuth tokens (access and refresh tokens) are encrypted using AES-256 encryption before being stored in our database.
• Microsoft user data is transmitted exclusively over HTTPS/TLS.
• Access to Microsoft data is restricted to the authenticated user and, where a message has been shared to a deal, the members of their team.
• We do not store copies of your contacts or calendar events - these are accessed in real time.
• Email is the one exception: when an email message is linked to a deal - either manually by you, or automatically if you enable auto-linking - we store a snapshot of that message (including its body) so that other members of your team can read the shared client communication. Linked-email snapshots are deleted when the deal or your account is deleted.

9A.4 Revoking Access

You can disconnect your Microsoft account at any time from the Settings page in TrackMyPlace. When you disconnect:

• Your Microsoft OAuth tokens are immediately deleted from our database, and we will no longer have access to your Microsoft account data.
• Microsoft does not provide a way for us to withdraw the permission you granted on your behalf, so that permission remains listed on your Microsoft account until you remove it. To remove it, open My Apps (work or school accounts) or your Microsoft account's app permissions page (personal accounts) and remove TrackMyPlace. If your organisation's administrator granted access on behalf of your organisation, they can remove it for everyone.

10. AI Features (Anthropic Claude)

TrackMyPlace offers optional AI features - an assistant, message drafting, deal and client summaries, text-document analysis, and a weekly agency digest narrative - powered by Anthropic's Claude models via the Anthropic API. AI features are disabled by default at the platform level and only operate once we have enabled them for your plan.

• What is sent: When you invoke an AI feature, we send Anthropic only the text needed to answer the request - the message you type; when a deal or client is in scope, its property address, stage, listing details (price, bedrooms, bathrooms, land size), notes, task titles, recent activity and record dates, and the client's first name; and, for document analysis, the document's file name, category, and extracted text. If you save an AI profile in Settings (about, focus, tone, specialties), it is included as you wrote it to personalise responses. The weekly agency digest sends aggregate performance numbers and team names only.
• What is never sent: Client email addresses and phone numbers are never included in AI requests: the client record's contact fields are excluded outright, and email/phone patterns are redacted from deal free text (notes, task titles, activity) and from extracted document text before every request. Document files and images are never sent - document analysis accepts text-based files only. Text you type into an AI feature and the AI profile you save are sent as written, so avoid including details there that you do not want processed.
• No training: Anthropic does not use data submitted through its commercial API to train its models.
• Retention and location: Anthropic processes this data in the United States as our sub-processor and handles retention in accordance with its commercial terms and Data Processing Addendum.
• Our records: We store token counts and usage metadata for quota and billing purposes. We do not store your AI prompts or responses.

11. Children's Privacy

TrackMyPlace is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by posting a notice on the platform or sending you an email. Your continued use of TrackMyPlace after changes are posted constitutes acceptance of the updated policy.

13. Data Breach Response

We maintain an internal Notifiable Data Breaches (NDB) response runbook and a breach register in line with Part IIIC of the Privacy Act 1988 (Cth). If we suspect an eligible data breach may have occurred, we will assess the incident as soon as practicable and, in any event, within 30 days. Where a breach is likely to result in serious harm we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable. Our designated Privacy Officer is the accountable person for this process; you can reach the Privacy Officer at privacy@trackmyplace.com. You can also lodge a complaint with the OAIC at oaic.gov.au or by calling 1300 363 992.

14. Contact Us

If you have questions about this privacy policy or how we handle your data, please contact our Privacy Officer at:

privacy@trackmyplace.com