Privacy policy

Keyday ("we", "us") is Ting-Yu Lo, trading as Keyday Australia (ABN 80 599 113 213), based in Victoria, Australia. We operate keyday.com.au and the Keyday CRM, and we are bound by the Australian Privacy Principles in the Privacy Act 1988 (Cth).

We do not rely on the small business exemption. Because we pass enquiries to agents as part of our service, we treat ourselves as covered by the Act.

If you are looking for an agent. Your name, email, phone number, the suburb and type of property you are interested in, whether you are buying, selling or leasing, and anything else you choose to tell us in an enquiry. We collect this so we can match you with a suitable agent and pass your enquiry to them.

If you are an agent. Your name, business contact details, licence and agency details, the suburbs and service lines you cover, and your billing details if you subscribe. We collect this to run your account and to show your profile to people searching.

Information agents put into the CRM. Agents store details of their own clients in Keyday, including contact details, property requirements and message history. We hold that on the agent's behalf. See "Information agents upload" below.

Technical information. Standard server logs, and the cookies needed to keep you signed in. We do not use advertising cookies or third-party trackers.

The agent you are matched with. This is the point of the service. When you submit an enquiry, the agent you are matched with receives your name, contact details and what you told us. They become responsible for how they use it from that point, under their own privacy obligations.

We do not sell personal information. We do not pass your details to multiple agencies, and we do not share them with data brokers or advertisers.

Our service providers. We use third parties to run Keyday. Each only receives what it needs:

• Supabase - database and authentication
• Vercel - website and application hosting
• Anthropic - the AI assistant that helps agents draft replies
• Twilio - SMS, where an agent has connected it
• Resend - transactional and notification email
• Stripe - subscription payments from agents. Card details go to Stripe directly and are never stored by us

We also disclose information where we are required to by law.

Our database and application are hosted in Australia (Sydney).

Some of the service providers listed above process information overseas, including in the United States. By using Keyday you consent to that disclosure. We take reasonable steps to ensure each provider handles personal information consistently with the Australian Privacy Principles, but we cannot control an overseas provider in the same way an Australian one can be controlled.

Agents can import their existing contacts into Keyday, including by CSV. Those people have usually never dealt with Keyday directly.

When an agent uploads contacts, the agent is responsible for having a lawful basis to do so, and warrants that to us in our terms. We hold that information on the agent's behalf and do not use it for our own purposes, do not use it to market to those people, and do not share it with other agents.

If you believe an agent has uploaded your details without a proper basis, contact us and we will act on it.

Agents can send you SMS and email through Keyday about your enquiry. Every commercial message includes a way to opt out, and opting out is enforced by the platform - once you opt out, our systems block further messages to you from that agent regardless of what the agent does.

Reply STOP to any SMS, or use the unsubscribe link in any email. We action opt-outs immediately and in any case within five working days, as required by the Spam Act 2003 (Cth).

We keep enquiry information for as long as needed to provide the service and to meet our legal obligations, and then delete or de-identify it.

Deleted records are held in a recoverable state for 30 days so mistakes can be undone, then permanently removed. If you ask us to delete your information we will do so unless we are required to keep it by law.

We protect personal information with:

• Encryption in transit (HTTPS) and at rest
• Separation between agents - one agent cannot see another agent's contacts or leads
• Database-level access rules in addition to application checks
• Rate limiting on sign-in to resist password guessing
• Private file storage that is not publicly reachable

No system is perfectly secure. If something goes wrong, see the next section.

We have a process for assessing suspected data breaches. If a breach is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and we will do so as soon as practicable.

You can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. Email us and we will respond within 30 days. There is no charge.

If you have a Keyday account you can view and correct most of your information yourself by signing in.

If you think we have mishandled your personal information, contact us first and we will investigate and respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Email privacy@keyday.com.au.

Our terms of service cover the rest of the relationship.

If we change this policy we will update the date at the top. If the change is significant we will tell account holders directly.