Privacy policy

Pitt Street ("we", "us") respects your privacy. This policy explains how we handle personal information, consistent with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy applies to:

• visitors to our website pittstreet.au;
• people who book or attend a scoping call or product demonstration;
• people who take part in a pilot;
• authorised users of the platform ("Seat Holders") and contacts at our client organisations; and
• individuals whose personal information appears in material our clients upload to the platform.

We apply this policy whether or not we fall within the Privacy Act's small business exemption.

We collect only what we reasonably need to run the website, scoping calls, pilots and the platform.

Context

Information we collect

Booking a scoping call or demo

Name, work email, phone, job title, organisation, asset classes or segments of interest, portfolio size range, and anything you tell us in the booking form or call

Pilots

The above, plus pilot participants' names, roles and contact details, pilot objectives, feedback and usage data

Platform seats

Login credentials, user ID, role and permissions, seat allocation, activity and audit logs, queries and prompts, outputs saved, support requests

Billing

Billing contact, invoicing address, ABN and payment records (card details are held by our payment provider, not by us)

Website visits

IP address, device and browser type, pages viewed, referring site and cookie identifiers (see section 8)

Client-uploaded material

Documents and data clients load into the platform, such as leases, tenancy schedules, valuations, loan files and operator reports, which may name tenants, borrowers, guarantors, residents or staff

Marketing

Your subscription status and how you interact with our emails

Sensitive information. We do not seek sensitive information (such as health, racial or ethnic origin, or criminal record information). Clients must not upload it unless it is necessary for their use of the platform and they hold any required consent. Healthcare and aged care property clients should remove or de-identify resident and patient information before uploading.

Anonymity. You can browse our website and ask general questions without identifying yourself. We need your name and contact details to book a call, run a pilot or provide a seat.

We collect personal information directly from you wherever we can: through booking forms, calls, emails, pilot workshops and your use of the platform.

We also collect it from:

• your employer or organisation, when it purchases seats or nominates pilot participants;
• our clients, when they upload material to the platform;
• scheduling, analytics and CRM tools we use (see section 6); and
• public sources such as company websites, ASIC records and professional networking profiles, for business-to-business outreach.

If we receive unsolicited personal information we could not lawfully have collected, we will destroy or de-identify it where lawful and reasonable.

We use personal information for the primary purpose it was collected for, and for related purposes you would reasonably expect:

• scheduling and running scoping calls, demos and pilots;
• setting up, securing and administering seats and accounts;
• providing platform features, including analysis of client-uploaded material;
• support, training and service communications;
• invoicing and collecting fees;
• improving and securing the platform, including monitoring for misuse;
• complying with law and responding to lawful requests; and
• sending marketing about Pitt Street.

We do not sell personal information. We do not use client-uploaded material to train general-purpose AI models, and we do not allow our AI providers to do so (see section 5).

Direct marketing. We send business-to-business marketing (such as product updates, insights and event invitations) in line with APP 7 and the Spam Act 2003 (Cth). Every commercial email identifies us and includes a working unsubscribe link, and we action unsubscribe requests within 5 business days. Opting out of marketing does not stop essential service messages to Seat Holders.

Pitt Street uses artificial intelligence, including large language models from third-party providers, to read, summarise, extract and analyse information in client material.

• Personal information in client material is processed only to deliver the platform to that client.
• Our AI providers act on our instructions under contracts that prohibit them from using client data to train their models and require them to protect it.
• Outputs are decision-support. The platform does not itself make decisions that significantly affect an individual's rights or interests. Those decisions remain with our clients and their people.

We disclose personal information only for the purposes in section 4, to:

• cloud hosting, storage and database providers;
• AI model providers;
• scheduling, video-conferencing, email, CRM and analytics providers;
• payment, accounting and billing providers;
• professional advisers (lawyers, accountants, auditors, insurers);
• a buyer or investor in connection with a sale or restructure of our business, under confidentiality; and
• regulators, courts and law enforcement where required or authorised by law.

Overseas disclosure. Our primary data hosting is in Australia. Some service providers, including AI model providers, may process or store data outside Australia, including in the United States and the European Union. Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the APPs.

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

These include encryption in transit and at rest, role-based access controls, single sign-on and multi-factor authentication, logical separation of each client's data, access logging, staff confidentiality obligations and vendor security reviews.

Retention. We keep personal information only as long as needed for the purposes in section 4 or as required by law. Client-uploaded material is deleted or returned within 90 days after a subscription or pilot ends, unless the client asks otherwise or the law requires us to keep it. We then destroy or de-identify it.

Data breaches. If we have an eligible data breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme. Where the breach involves client-uploaded material, we will notify the client promptly so we can coordinate the response.

Our website and platform use cookies and similar technologies to keep you signed in, remember preferences, secure the service and understand how the site is used.

• Essential cookies are needed for sign-in and security and cannot be switched off.
• Analytics cookies such as Google Analytics help us understand traffic. You can decline them through your browser settings.
• Marketing pixels. We do not use advertising or retargeting pixels.

Access and correction. You can ask for access to the personal information we hold about you, or ask us to correct it (APPs 12 and 13). We will respond within 30 days and will not charge for the request. If we refuse, we will explain why in writing and how to complain. If your information is in material a client uploaded, we may refer you to that client and assist them in responding.

Contact
Email: hello@pittstreet.au

We may update this policy from time to time. We will post the new version here with its effective date.