Privacy Policy

1. About this policy

This Privacy Policy explains how Struqt (“Struqt”, “we”, “us” or “our”) collects, uses, holds, discloses and protects your personal information when you use our website, applications, reports and related services (the “Service”).

We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We have designed this policy to comply with those principles as a matter of best practice.

By using the Service you accept the practices described in this policy. If you do not agree, please do not use the Service.

2. Personal information we collect

We collect the minimum personal information needed to operate the Service. The categories below describe what may be collected, depending on how you use Struqt.

2.1 Account information

Email address, name, and an irreversibly hashed password (we never store your password in plain text). If you don’t give us your name when you create your account, we use the billing name you entered at checkout. You can change it on your Account page.
If you sign in with a third-party identity provider (Google or Microsoft), we receive your email address, name and a provider-specific identifier. We do not receive your password from the provider.
We do not store your profile picture.Microsoft’s and Google’s sign-in screens describe their standard “basic profile” permission as covering your name, picture and username . That wording is set by them and cannot be changed by us, and it is the smallest permission that still tells us your name. Struqt does not ask either provider for your photo, does not use one anywhere in the product, and discards it if one is sent.
Account creation date, email verification status, and authentication events.
Optional onboarding preferences you provide, such as the Australian states/territories you wish to focus on and your stated reason for using Struqt (for example, “I am exploring a renovation”).

2.2 Subscription and billing information

Subscription plan, status, plan-change history, and any team membership where applicable.
Billing identifiers issued by our third-party payment processor. We do not see or store your full card number, CVC or bank account details — these are handled directly by the payment processor under PCI-DSS controls.
Tax-relevant information such as country and, where you supply them at checkout, a business name and ABN, retained for GST and record-keeping obligations and so we know which business we are dealing with.

2.3 Property search and report data

Property addresses you search and the geographic coordinates returned by our geocoding providers.
Reports you generate or save, including the address, the underlying planning attributes, and any inputs you provide (for example, financial assumptions you set within a feasibility scenario).
Saved searches, shortlists, and any free-text notes or labels you add to them.
Support requests and feedback you submit about a report, including any screenshot or attachment you choose to send.

Addresses can constitute personal information when linked to an identifiable individual. You are responsible for ensuring you have appropriate authority to enter any address into the Service.

2.4 Technical and usage information

IP address, user-agent string, approximate timezone, and basic device metadata transmitted by your browser. Where we send analytics events to a third-party processor, the IP is dropped before storage.
Server logs of requests you make to the Service, including timestamps, endpoints accessed, and the status of those requests. These logs are used for security, abuse prevention, rate limiting and debugging.
Product analytics events (page views, button clicks, feature usage, error counts) sent to a product-analytics processor so we can measure reliability and improve the Service. Sensitive query parameters such as latitude, longitude and addresses are redacted before any event is sent. Analytics is always on (see section 12.2); a Do Not Track signal is honoured.
Session replays (a reconstruction of how a page was scrolled and clicked during a visit) sent to the same product-analytics processor so we can find and fix confusing or broken flows. Everything you type and every property address shown on screen is masked in your browser before anything is transmitted, and masked content never leaves your device. Replay is always on, with the same Do Not Track exception.
Error and performance telemetry sent to an error-monitoring processor so we can detect and fix faults. We never include your name, email address or IP address in error reports.
Marketing-attribution measurement (such as ad-network conversion tracking). This is on by default for visitors in Australia and off by default in the EEA, United Kingdom and Switzerland; you can opt out at any time at /settings/privacy.
Cookies and equivalent browser storage. See section 12 for the categories we use and how to manage them.

2.5 Communications

Email correspondence you send us (for example, support enquiries) and our replies.
Records of transactional and service emails we send to you, such as verification, password reset, billing and account notices.

We do not require you to provide sensitive information (as defined in the Privacy Act, including health, racial, religious or biometric information). Please do not submit such information to Struqt.

3. How we collect personal information

We collect personal information:

Directly from you when you register, sign in, configure your account, search for a property, save a report, contact us or respond to a survey;
Automatically when you interact with the Service (technical and usage information described above);
From third-party identity providers when you choose to authenticate using them; and
From our payment processor when you subscribe, change plan, or update billing details.

Where it is reasonable and practicable to do so, we collect personal information directly from you. If we collect personal information about you from a third party, we will, unless an exception applies, take reasonable steps to ensure you are or have been made aware of the matters listed in APP 5.

4. How we use personal information

We use personal information for the following primary purposes:

Providing the Service: creating and authenticating your account, generating, saving and displaying feasibility reports, running searches, and delivering the features available on your subscription plan.
Billing and account management: processing subscriptions, applying credits or trials, issuing receipts, and communicating about your plan.
Security and abuse prevention: authenticating sessions, applying rate limits, detecting fraudulent or abusive behaviour, investigating incidents, and protecting our infrastructure and content.
Service operation and improvement: monitoring uptime and performance, debugging issues, validating data quality, and improving features. We use aggregated and de-identified data for product analytics and do not use your personal information to build advertising profiles about you.
Showing recent activity on our homepage: our homepage may name some suburbs where someone checked an address in the last 30 days, as the suburb, state and postcode only. We never show an address, nothing appears until at least 24 hours after a check, and we never name a suburb with fewer than 1,000 residents.
Communicating with you: sending transactional messages (verification, password reset, receipts, expiry notices, service announcements) and responding to your enquiries.
Product news by email: sending occasional product news on the basis of your subscription, or your explicit opt-in where you gave one; a pay-as-you-go purchase alone is not enough (section 5A). You can unsubscribe at any time with the one-click link in any such email or by contacting us. Transactional and service-related emails are not marketing and continue while you maintain an account.
Legal and compliance: meeting record-keeping, tax and other legal obligations, and responding to lawful requests by public authorities.

5. Automated processing and AI

Struqt produces planning feasibility outputs using rules-based algorithms applied to government open data and our proprietary architect-authored content. These outputs are general informational guidance, are not binding decisions, and do not solely or substantially determine any matter that has a legal or similarly significant effect on you.

We do not use your personal information to train generative AI models. Where any machine-learning component is used internally (for example, for data validation), it does not make decisions about individual users.

If we materially change how automated processing is used in a way that engages APP 1.7 (effective from 10 December 2026), we will update this policy before that change takes effect.

5A. Direct marketing

If you hold a Struqt subscription, we may email you product news on the basis of your customer relationship with Struqt: what has changed in the reports you run, covering only the states you have saved reports in, at most once a month. If you bought a single pay-as-you-go report, we send product news only if you opted in explicitly. We skip an issue for anyone who has had another marketing email from us in the previous 30 days. Every such email carries a one-click unsubscribe that needs no login; we honour it within five business days and add your address to a suppression list so you do not hear from us again. We add an address to the same list if a message to it is reported as spam or bounces permanently. You can also opt in explicitly when you create or claim an account, which we record with the date, the screen and the wording you saw.

To stop product news at any time, use the unsubscribe link in any marketing email we send you, or email the address in section 14. We do not send marketing by SMS, and we never pass your address to anyone else for their marketing.

Transactional and service emails (receipts, security codes, notices about reports you own, and important account or service notices) are not marketing and continue while you hold an account.

6. When we share personal information

We do not sell personal information. We disclose personal information only to the limited categories below, and only to the extent necessary for the purposes for which it was collected.

6.1 Service providers

We use a small number of vetted service providers to operate Struqt. Each is bound by contractual confidentiality and data protection obligations and may only use your information to provide the relevant service to us. The categories of providers we use are:

Payment processing and subscription management: currently Stripe Payments Australia Pty Ltd, which stores cardholder data under PCI-DSS controls. We do not see or store your full card details. Stripe is named here because the Stripe-branded checkout is visible to you when you subscribe.
Identity provider for optional sign-in when you choose to use it.
Product analytics processor: measures how the Service is used so we can improve it. Always on. We do not send it your name or email; your activity is linked to your account identifier while you are signed in. Hosted in the United States.
Error and performance monitoring processor: detects and reports faults so we can fix them. We never send your name, email or IP address to this provider. Hosted in the United States.
Marketing-attribution and advertising measurement: on by default for Australian visitors (opt out at any time at /settings/privacy); off by default in the EEA, United Kingdom and Switzerland.
Address geocoding: converts addresses you search to map coordinates. Hosted in Australia.
Map tile and base-map provider. Hosted in Switzerland.
Transactional email delivery: sends verification, password reset, receipts and service notices. Hosted in the United States.
Support chat assistance: when you interact with our in-product help chat, the conversation is processed by a third-party AI provider in the United States to help answer questions about your account, subscription, billing, and how to use the product. The chat is not used for planning interpretation. We share the messages you send, your plan and a few account flags. When you ask about one of your own saved reports, we also share the parts of that report needed to answer, including its address.
Staff messaging: when you subscribe, run a report, rate a report or contact us, a notification goes to our team's private channels so the right person can act on it. It can carry your name, email, plan, the property address and what you wrote to us. Hosted in the United States.
Cloud and infrastructure hosting for the Service itself, primarily within Australia.
Professional advisers (legal, accounting) on a need-to-know basis.

We routinely review these providers and the data they handle, and we apply the principle of least privilege. A current list of the specific sub-processors handling personal information is available on request. Email [email protected] and we will respond within a reasonable time. If we add or materially change a sub- processor that handles personal information we will update the categories above and the list available on request.

6.2 Within a team or shared account

If your account is part of a team or shared subscription, the team owner or administrator may have visibility of account-level activity (for example, seat usage or saved reports created within the team workspace). Avoid placing information in a shared workspace that you do not want other members of that workspace to see.

6.3 Legal and safety

We may disclose personal information where we are required or authorised to do so by law, where it is necessary to investigate or prevent fraud, abuse or security incidents, or to establish, exercise or defend legal claims.

6.4 Business transfers

If Struqt is involved in a merger, acquisition, financing or sale of assets, your information may be transferred as part of that transaction, subject to commitments consistent with this policy. We will notify you of any such change.

7. Overseas disclosures

Some of our service providers store or process personal information outside Australia. The current countries of disclosure and the categories of provider operating from each are:

United States: product analytics, error and performance monitoring, optional sign-in identity provider, transactional email, the support chat's AI provider, staff messaging, and (unless you opt out, see section 12.3) marketing-attribution measurement.
Switzerland: map tile and base-map provider.

The specific sub-processors we use in each country are available on request. Email [email protected].

Before disclosing personal information to an overseas recipient we take reasonable steps to ensure the recipient handles that information consistently with the Australian Privacy Principles, including through written contractual protections, technical controls (such as IP anonymisation and PII scrubbing), and configuration choices that minimise the personal information sent.

By using the Service, you acknowledge that your personal information may be stored and processed overseas for the purposes described in this policy.

8. How we store and secure your information

Personal information is stored on infrastructure operated on our behalf and protected by a combination of administrative, technical and physical safeguards, including encryption in transit (TLS), encryption at rest for primary data stores, access controls, secure key management, network isolation, hardened authentication, and audit logging.

Despite our efforts, no method of transmission or storage is completely secure. You also play a role in keeping your account safe: choose a strong, unique password, keep your sign-in details confidential, and notify us immediately if you suspect unauthorised access. We may require multi-factor authentication for some accounts (for example, for paid plans, or where your account is not federated through a third-party identity provider). When multi-factor authentication is required, you must enrol before continuing to access the Service. We may also require step-up verification for sensitive actions such as billing changes.

We comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act. If we become aware of an eligible data breach involving your personal information that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by law.

9. How long we keep your information

We retain personal information only for as long as necessary for the purposes described in this policy or as required by law. Indicative retention periods include:

Account data: for as long as your account is active.
Saved reports, searches and shortlists: for as long as your account is active. You can delete individual items at any time.
Address geocoding cache: a cached address-to-coordinate mapping may be retained without user attribution to improve response times for repeat lookups.
Billing records: retained for at least seven (7) years to meet Australian taxation and record-keeping obligations.
Server and security logs: typically retained for up to 13 months, then deleted or aggregated.
Authentication and security event logs: retained for ninety (90) days for fraud prevention and forensic purposes; IP addresses and user-agent strings are then removed, while the event itself (without network metadata) may be retained for longer-term aggregate analysis.
Marketing preferences: retained on a suppression list after unsubscribe so we can honour your choice.

When you close your account, we will delete or de-identify your personal information within a reasonable period, except where we are required or permitted to retain it (for example, billing records, fraud prevention records, or information necessary to establish, exercise or defend legal claims).

10. Your rights and choices

Under the Australian Privacy Principles, you have the right to:

Access the personal information we hold about you;
Correct personal information that is inaccurate, out of date, incomplete, irrelevant or misleading;
Unsubscribe from marketing emails (one click, no login — see section 5A);
Request deletion of your account and associated personal information, subject to our retention obligations;
Make a complaint about how we have handled your personal information.

You can manage most of these directly from your account settings. For anything you cannot self-serve, contact us at the address in section 14 below. We do not charge for access or correction requests. We will respond to your request within a reasonable time and, where access is requested, ordinarily within 30 days.

If we cannot agree on the outcome of your complaint, you can escalate it to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.

11. Children

Struqt is intended for use by adults (18+) and is not directed to children. We do not knowingly collect personal information from a child. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

12. Cookies and similar technologies

We use cookies and equivalent browser storage in three categories: strictly necessary (always on), analytics (always on) and marketing measurement (on by default in Australia, opt out at any time from /settings/privacy).

12.1 Strictly necessary (always on)

Required to operate the Service. Without these the Service will not function. These are always active and cannot be disabled while you use the Service.

Signing in: keep you signed in, protect our forms against cross-site request forgery, carry a Google or Microsoft sign-in through to completion, and remember which page to return you to afterwards. The sign-in cookie lasts as long as your plan’s session length; the others last until you close your browser or, for a Google or Microsoft sign-in, at most fifteen minutes.
Two-step sign-in: short-lived cookies that carry a passkey challenge or confirm you have just completed your second step. If you choose to trust a browser, a cookie lets it skip the second step for up to 30 days. It holds a random value, and we keep only a scrambled (hashed) copy of it.
Purchases: when you pay, cookies bring you back to the page you came from and, if you paid before creating an account, link the payment to the account you then create. Most last a day; the one set when you open the link in your receipt email lasts 30 days, as the link does. They hold no card details.
PDF downloads: a cookie that lasts at most five minutes tells the page your PDF has finished downloading, and the page deletes it as soon as it has read it.
Network security: our network provider sets cookies that tell people apart from automated traffic and protect the Service from attacks.
Stripe fraud-prevention cookies set by js.stripe.com when you reach the checkout or billing portal, used by Stripe to detect fraudulent payments. Necessary for payments to work.
Short-lived browser storage that keeps a sign-in or checkout step working across a reload or a second tab, for example which page to return you to after you pay, or that you have just signed out.
Consent state stored under localStorage key struqt-consent-v1 so we remember your marketing-measurement choice on this browser, together with a Do Not Track signal or an analytics opt-out you made before 10 October 2026, both of which we continue to honour.

12.2 Analytics (always on)

We measure page views, clicks, feature usage and performance, and we record session replays with all typed input and all property addresses masked in your browser before anything is sent. This is always on. It is not used to build an advertising profile. Browsers sending a Do Not Track signal are not measured, and if you turned analytics off before 10 October 2026 that choice still stands on that browser and account.

Product analytics: captures page views, button clicks, and feature usage, in your browser and on our servers. The processor is configured to discard your IP address. A first-party cookie and a localStorage entry hold a random identifier for this browser, the current visit, your account identifier while you are signed in, the address of the first page you opened here (which can include a property address you searched) and the site that sent you, so anonymous events can be stitched into one journey. They never hold your name or email. We keep the parts of our pages that show a property address out of click tracking, and remove the addresses we recognise from page addresses and clicked text before any event is sent. Hosted in the United States.
Session replay: reconstructs page scrolling and clicks so we can fix confusing or broken flows. All typed input and all property addresses shown on screen are masked in your browser before transmission; masked content never reaches the processor. Always on, with the same Do Not Track exception as above. Hosted in the United States.
Error and performance monitoring: captures error details and a small sample of performance traces. We configure this processor to not receive your IP, name or email. Hosted in the United States.

12.3 Marketing measurement (on by default in Australia; opt out at any time)

Used to measure the effectiveness of our marketing (for example, whether an ad click led to a purchase). For visitors in Australia this is on by default and you can opt out at any time with the toggle at /settings/privacy. For visitors in the EEA, United Kingdom and Switzerland it is off by default and activates only if you opt in. Browsers sending a Do Not Track signal are opted out automatically. This category never includes the property addresses you search (they are stripped before any page information reaches the ad network). It does not control marketing emails, which are covered in section 5A.

Ad-network conversion tracking: loaded unless you have opted out (Australia), or only once you opt in (EEA, United Kingdom, Switzerland). Lets us measure which marketing campaigns led to a sign-up or subscription. Hosted in the United States.
Acquisition attribution: when you first visit the Service we may store the campaign parameters (such as utm_source, utm_medium and click identifiers) from the URL into localStorage so that, if you sign up, we can attribute the sign-up to its source. We treat this data as marketing measurement.
Sign-up measurement: when you pay and then create your account, a cookie that lasts ten minutes carries your email address and a reference to the payment to the sign-in page. That page uses them to fill in your email and to count the sign-up. The cookie is set whatever you have chosen; whether the sign-up is reported to the ad network follows your choice above. Scripts on the page cannot read the cookie, and it keeps both out of the page address.

Most browsers let you block or delete cookies, and many devices offer system-level controls. Blocking strictly necessary cookies will prevent you from signing in or using parts of the Service. Enabling your browser’s “Do Not Track” signal opts you out of analytics and marketing measurement on Struqt.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will notify you by email and/or by a prominent notice in the Service before the changes take effect. The “Last updated” date at the top reflects the current version. Continuing to use the Service after the effective date of an update constitutes acceptance of the updated policy.

14. Contact us

If you have a privacy question, would like to exercise a right, or wish to make a complaint, please contact our privacy officer:

Email: [email protected]
General enquiries: [email protected]

Please include enough detail for us to identify your account and the matter you are raising. We will acknowledge your enquiry and respond within a reasonable time. If you require a postal address for service of legal process, contact us at the email above and we will provide one.