Privacy Policy

1. Scope and operator

This draft describes the current RateABroker development version. It does not describe planned broker logins, public reviews, automated marketing or broker lead delivery, which are not active.

Platform

RateABroker

Legal operator

To be confirmed

ABN

To be confirmed

Business address

To be confirmed

Privacy and legal contact

To be confirmed before public launch

The operator’s legal identity, privacy contact and business address remain to be confirmed. This policy does not claim that RateABroker has been assessed as compliant with the Privacy Act 1988 (Cth) or that an exemption applies. Applicable obligations and final operational arrangements will be assessed before public launch.

2. Information we collect

When you submit a test enquiry or register broker listing interest, the platform stores:

• Your name, email address and phone number.
• The selected broker category and the message you enter, which may include a business name, location and specialities.
• The selected sample broker’s identifier, if relevant.
• A generated request identifier, submission time and the terms and privacy versions acknowledged with your submission. Separate temporary keyed identifiers are used to limit repeated submissions, login attempts and authenticator verification attempts. These may derive from a network address, an operator email address or an operator account identifier.

Forms collect this information directly from you. Please share only details needed for the request. Do not provide identity documents, tax file numbers, account credentials, medical information or other sensitive information. There is no document upload feature.

The hosting and database providers may also process technical information such as IP addresses, device and browser information, access times, security logs and any access-protection cookies under their own policies. The application does not implement a separate advertising or analytics tracker. When enabled, Cloudflare Turnstile processes technical browser and interaction information to verify form submissions and operator sign-ins. Server-side verification checks the returned action and approved hostname before proceeding.

3. Why we collect it

Test enquiries are collected to test the enquiry workflow and maintain a record for the platform owner’s review. Broker-interest details are collected to maintain a launch-interest list and consider future onboarding. Request identifiers support record association. Temporary keyed identifiers support limits of five submissions per minute and 30 per hour per network address, plus separate limits for operator login and authenticator attempts.

The current application does not send automated emails, market to you, run credit checks, assess finance eligibility or make automated suitability decisions. A submission does not enrol you in marketing. New uses, including direct marketing or broker routing, will need appropriate notices and choices before activation.

Providing form details is optional, but the form cannot save a request without its required fields. You can browse without providing form details, subject to any hosting access protection enabled by the operator.

4. Access and disclosure

Submitted information is stored for administration by approved platform operators. The admin workspace lets them review requests and record a status and internal notes. The last update time and updating operator’s account identifier are stored with each edited request. A separate audit trail records inbox reads, request creation and request changes, including operator identifiers, times, status changes and whether notes changed. Audit entries do not duplicate message text or internal note contents. Supabase Authentication processes operator account and sign-in information. Service providers supporting hosting, database operation and technical support may process information as needed to provide those services.

The preview does not publish submitted details, sell them or send them to sample brokers. It does not route a single enquiry to multiple brokers. Future broker introductions will explain who will receive your details and seek an appropriate instruction before sharing.

Information may also be disclosed where required or authorised by law. Broader disclosure arrangements will be documented if the service changes.

5. Storage and overseas processing

This version is prepared for Vercel hosting and a separate Supabase database for submitted records. Forms remain disabled until storage is configured and explicitly enabled. Records from the earlier ChatGPT Sites preview are not automatically transferred. These providers’ infrastructure and support arrangements may involve processing outside Australia. The application has not verified all storage locations, overseas recipients or countries involved.

Before public launch, provider arrangements and any overseas disclosures must be confirmed, including likely recipient countries where practicable and any required privacy safeguards. This draft does not promise Australian-only storage.

For the providers’ own practices, see the Vercel Privacy Policy and Supabase Privacy Policy.

6. Cookies and browser storage

Your shortlist is stored in your browser’s local storage under “rab-shortlist” as sample broker identifiers. It is specific to that browser and is not a shared account shortlist. Remove each broker from the shortlist or clear this site’s browser data to reset it.

If deployment access protection is enabled, the hosting provider may use cookies for access control and security. Approved operators sign in to the admin workspace through Supabase Authentication and verify an authenticator code before accessing enquiry records. The platform uses essential, HTTP-only session cookies for that access; in production they are sent over HTTPS. Blocking these cookies prevents admin sign-in. Public enquiries do not require an account. Blocking essential hosting cookies may also prevent access to a protected deployment.

The page loads typography from Google Fonts. Your browser connects to Google’s font services, which may receive technical request information such as your IP address and browser information. See Google’s Privacy Policy for its handling of that information. When Turnstile is configured, the browser connects to Cloudflare for essential bot verification; see Cloudflare’s Privacy Policy. There are no application-level advertising cookies or analytics integrations currently installed.

7. Security and retention

Public form submissions do not require a platform account. Inputs and acknowledgement of the current policies are checked on the server. Database keys stay server-side. Request records require an approved admin identity and a multi-factor-authenticated session, enforced by both the server and database access policies. Database-backed limits reduce repeated submissions and authentication attempts. These measures reduce some risks; no online system can guarantee complete security.

For request records, a fixed retention schedule, backup lifecycle, deletion process and incident-response procedure have not yet been finalised. Submitted records remain stored until removed by the operator or the supporting service. Request records are not automatically deleted after a stated period. Audit records currently have no automatic expiry. Separate rate-limit buckets contain a keyed digest, count and creation time; buckets older than 24 hours are removed when a subsequent submission is processed. The application does not store raw network addresses in these buckets. Do not use this preview to store important or sensitive documents.

Before public launch, the operator will set appropriate retention and disposal arrangements and procedures for handling security incidents and any required notifications.

8. Access, correction and choices

You can ask the operator to locate information associated with your submission, provide access, correct inaccurate details or consider a deletion request. During this preview, use the contact channel through which you received access. Include the submission type and approximate date; do not send identity documents unless a secure and proportionate verification process has been agreed.

The operator may need to verify your authority before releasing or changing records. Requests will be considered under any applicable legal obligations; deletion may be subject to lawful retention needs. No self-service access or deletion tool is currently available.

Do not submit another person’s information without their authority. You can choose not to submit a form, and you can clear the locally stored shortlist using your browser settings.

9. Privacy enquiries and complaints

The dedicated privacy contact is to be confirmed before public launch. For now, contact the platform owner through your existing contact channel, describe your concern and say what outcome you are seeking.

A documented complaint-response timeframe will be set before public launch. If you are not satisfied with the response, you may seek guidance from the Office of the Australian Information Commissioner. Whether the OAIC can investigate depends on the circumstances and its jurisdiction.

10. Policy updates

This page will be revised when operator details or service practices change. The version and update date appear at the top. New features involving personal information will require updated notices before their activation. The privacy version acknowledged by each new form submission is recorded with that request.