Privacy policy

Keyday ("we", "us") is operated by Keyday Australia (ABN 80 599 113 213), based in Victoria, Australia. We operate keyday.com.au and the Keyday CRM, and we are bound by the Australian Privacy Principles in the Privacy Act 1988 (Cth).

We do not rely on the small business exemption. Because we pass enquiries to agents as part of our service, we treat ourselves as covered by the Act.

If you are looking for an agent. Your name, email, phone number, the suburb and type of property you are interested in, whether you are buying, selling or leasing, and anything else you choose to tell us in an enquiry. We collect this so we can match you with a suitable agent and pass your enquiry to them.

If you are an agent. Your name, business contact details, licence and agency details, the suburbs and service lines you cover, and your billing details if you subscribe. We collect this to run your account and to show your profile to people searching.

What the questions collect. When you look for an agent we ask, and store: what you are trying to do (buy, sell, lease or finance) and your situation within that; the suburb and how far around it you would look; a price range; the kind of property; your timeframe; how you prefer to be contacted; what matters to you in an agent; whether you have done this before; and, on the buying and finance paths, your deposit position and whether finance is sorted. If you ask us to, we also record that you want to speak to a mortgage broker. Some paths ask which language you would prefer to be served in - you never have to answer that one, and we use it only to match you.

Information agents put into the CRM. Agents store details of their own clients in Keyday, including contact details, property requirements and message history. We hold that on the agent's behalf. See "Information agents upload" below.

Technical information. Standard server logs, and the cookies needed to keep you signed in.

Measurement. We use PostHog (European Union) to count how the site is used - which pages are opened and how far people get through the questions. It is configured not to receive your name, phone number or email address, and it is not used for advertising. We do not run advertising cookies or an advertising pixel. If that changes we will say so here first, and ask before setting one.

The agent you are matched with. This is the point of the service. When you submit an enquiry, the agent you are matched with receives your name, contact details and what you told us. They become responsible for how they use it from that point, under their own privacy obligations.

We do not sell personal information. We do not pass your details to multiple agencies, and we do not share them with data brokers or advertisers.

Our service providers. We use third parties to run Keyday. Each only receives what it needs:

• Supabase - database and authentication (Australia, Sydney)
• Vercel - website and application hosting (United States)
• Anthropic - the AI assistant that helps agents draft replies. The content of the messages it drafts from is processed by Anthropic (United States)
• Twilio - SMS sending and receiving (United States)
• Cloudflare - bot protection on our public forms (United States)
• Resend - transactional and notification email (United States)
• Sentry - error diagnostics, so we can see when something breaks. It receives the page or route that failed and the error itself, deliberately stripped of message content, phone numbers and email addresses (United States)
• PostHog - product measurement, as described above (European Union)
• An agent's own systems. Where an agent has connected their own CRM, we send that agent the enquiry details they would receive anyway. They choose the destination, and it may be overseas
• Google and Apple - only if you choose to sign in with one of them. We receive your name, email address and an account identifier. We never receive your password, and we do not read your calendar or contacts (United States)
• Meta and Google advertising - only for agents who connect their own lead forms. When someone fills in that agent's form on Facebook, Instagram or Google, those platforms send us the answers so they reach the agent's inbox. It lands only in that agent's workspace (United States)
• Stripe - subscription payments from agents (United States). Card details go to Stripe directly and are never stored by us

We also disclose information where we are required to by law.

We produce statistics about property demand - for example, how many people enquired about buying in a suburb in a month, and the price ranges they were looking in. We may publish or licence those statistics.

These are aggregates only, and they are built so that no individual can be identified from them. They contain no names, no contact details and no free text, and we suppress any figure that would rest on fewer than ten people. Your own enquiry is never sold, shared or licensed to anyone - the only party we pass it to is the agent or broker you asked us to introduce you to.

Our database and application are hosted in Australia (Sydney).

Some of the service providers listed above process information overseas, including in the United States. By using Keyday you consent to that disclosure. We take reasonable steps to ensure each provider handles personal information consistently with the Australian Privacy Principles, but we cannot control an overseas provider in the same way an Australian one can be controlled.

Agents can import their existing contacts into Keyday, including by CSV. Those people have usually never dealt with Keyday directly.

When an agent uploads contacts, the agent is responsible for having a lawful basis to do so, and warrants that to us in our terms. We hold that information on the agent's behalf and do not use it for our own purposes, do not use it to market to those people, and do not share it with other agents.

If you believe an agent has uploaded your details without a proper basis, contact us and we will act on it.

Agents can send you SMS and email through Keyday about your enquiry. Every commercial message includes a way to opt out, and opting out is enforced by the platform - once you opt out, our systems block further messages to you from that agent regardless of what the agent does.

Reply STOP to any SMS, or use the unsubscribe link in any email. We action opt-outs immediately and in any case within five working days, as required by the Spam Act 2003 (Cth).

We keep enquiry information for as long as needed to provide the service and to meet our legal obligations, and then delete or de-identify it.

Deleted records are held in a recoverable state so mistakes can be undone. If you ask us to delete your information we will do so within a reasonable time unless we are required to keep it by law, and we will confirm when it is done.

We protect personal information with:

• Encryption in transit (HTTPS) and at rest
• Separation between agents - one agent cannot see another agent's contacts or leads
• Access scoped in application code on every read and write, with database-level policies as a backstop
• Rate limiting on sign-in to resist password guessing
• Private file storage that is not publicly reachable

No system is perfectly secure. If something goes wrong, see the next section.

We have a written process for assessing suspected data breaches, and we act on it the day we become aware of one. If a breach is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and we will do so as soon as practicable.

You can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. Email us and we will respond within 30 days. There is no charge.

If you have a Keyday account you can view and correct most of your information yourself by signing in.

If you think we have mishandled your personal information, contact us first and we will investigate and respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Email privacy@keyday.com.au.

Our terms of service cover the rest of the relationship.

If we change this policy we will update the date at the top. If the change is significant we will tell account holders directly.