Privacy Policy

Effective: 29 August 2026
Last updated: 31 August 2026

This Privacy Policy explains how Instant Strata (we, us, our) collects, holds, uses, and discloses personal information.

It is written to be consistent with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you do not agree with this policy, do not use Instant Strata.

Our Terms and Conditions govern use of the platform. Our AI Usage Policy explains how AI is used and your duty to review AI-generated content.

1. Who we are

Instant Strata is an Australian strata management platform. We are based in Australia.

For our current legal entity name, ABN, and registered office, or to contact our privacy officer, email privacy@instantstrata.com.au.

2. Whose information this covers

This policy covers personal information we handle when:

you create an Instant Strata account (managers, committee members, owners, residents, contractors, and other invited users)
you visit our website or sign-in pages
a customer stores scheme records on Instant Strata that include information about lot owners, tenants, mortgagees, contractors, and other people (scheme records)

Important: data held on behalf of clients

Most scheme records are stored on behalf of our customers (typically a strata manager and/or an owners corporation, body corporate, or strata company).

In that case:

the customer decides what to upload, who may access it, and why it is used for the scheme
we provide the software, hosting, security, and support
the customer remains responsible for complying with privacy and strata law in their dealings with lot owners and other individuals

We still take APP-level care of that information while it is on our systems. We only use it to provide the service, to keep it secure, and as otherwise described in this policy.

3. What personal information we collect

The information we collect depends on how you use Instant Strata.

3.1 Account and billing

name and email address
phone number, if you give us one
organisation and role (for example strata manager or committee member)
sign-in logs (time, device or browser type, and similar technical data)
billing details if you subscribe to a paid plan

We do not use a password. Sign-in is by email magic link and a one-time code.

3.2 Scheme records our customers store

Customers may store information needed to run a scheme, including:

strata roll details: names, lots, unit entitlements, owner and occupier contacts
tenant, mortgagee, and other interested-party contacts
meeting attendance, proxies, voting records, and minutes
levy, payment, arrears, and other financial records, including trust-related accounting data where those features are used
maintenance requests, quotes, work orders, and contractor details
insurance, dispute, by-law, and compliance records
notices, messages, and documents (which may include photos or identity documents if a customer uploads them)
access-device or key-register information where those features are used

Some of this may be sensitive in a practical sense even if it is not “sensitive information” as defined in the Privacy Act (for example hardship, dispute evidence, or mortgagee details). Customers should apply the platform’s privacy markings and access roles accordingly.

3.3 Information generated when you use the product

audit logs of who viewed, changed, approved, or sent records
support requests
AI prompts, retrieved excerpts, drafts, and approval decisions (see section 8)

3.4 Technical data

IP address, cookie or similar identifiers needed for sign-in and security
approximate location derived from IP (not precise GPS, unless a future feature asks you first)
error and performance logs

We do not collect government identifiers (such as TFN) as a product feature. Please do not upload them unless a law requires it for that record.

4. How we collect it

We collect personal information:

directly from you when you sign in, update a profile, or contact us
from the customer who invites you or who uploads scheme records
from the scheme’s own files (for example a strata roll import, meeting papers, invoices, or emails a customer stores)
automatically through logs, cookies needed for authentication, and security tools
from service providers who help us operate the platform (for example email delivery of a sign-in code)

Where we collect information from someone other than the individual (the usual case for a strata roll), we rely on the customer having a lawful basis to hold and store that information, including any notice they must give under APP 5.

If you are a lot owner and believe a manager has stored your details in Instant Strata, start with that manager or owners corporation. You can also contact us using section 14.

5. Why we collect and use it

We collect and use personal information to:

create and secure accounts
provide Instant Strata to the customer and authorised users
hold and display scheme records they are allowed to see
send transactional messages (sign-in codes, notices the customer approves, product updates that affect the service)
run AI search, lookup, fetch, and drafting features the customer turns on
require human approval before non-read-only actions
keep audit trails required for a trustworthy strata record
bill, account, and provide support
detect abuse, security incidents, and fraud
improve the reliability and clarity of the product, using aggregated or de-identified data where we can
meet our legal obligations

We do not sell personal information. We do not use scheme records for unrelated marketing.

If we need to use personal information for a new purpose that is not related to these, we will handle that as the APPs require (including seeking consent where that is the right path).

6. When we disclose it

We may disclose personal information:

to authorised users on the same scheme, according to the role and privacy settings the customer has set (for example a manager may see more than an owner)
to the customer organisation that administers the scheme
to subprocessors who host, email, monitor, or provide AI processing for us, under contracts that require them to protect the information
to professional advisers (for example lawyers or auditors) under confidentiality
if the law requires it, or to reduce serious risk to life, health, or safety
as part of a sale or restructure of Instant Strata, with protections that are reasonable in the circumstances

We do not disclose scheme records to other Instant Strata customers. Schemes are isolated from each other.

7. Overseas disclosure

Some of our subprocessors are located outside Australia, or may process data outside Australia. That currently includes providers of:

cloud hosting and database services
email delivery
application monitoring
AI processing (for example reasoning, embeddings, and document text extraction)

Those providers may be in the United States, the European Union, the United Kingdom, or other countries.

When we disclose personal information overseas, we take reasonable steps so that the recipient handles it in a way that is consistent with the APPs, as required by APP 8. That typically includes contractual clauses and choosing established providers.

AI processing. If you (or a user on your account) enter a prompt or ask Instant Strata to search, summarise, or draft from scheme records, relevant excerpts and the prompt may be sent to an AI provider to generate a response. Do not put information into a prompt that you are not allowed to share with those processors.

We do not permit those providers to use identifiable customer scheme records to train their public models.

8. Artificial intelligence and human review

Instant Strata uses AI to help with search, lookup, fetch, summaries, extraction, and drafts. See the AI Usage Policy for the full rules.

AI output can be wrong. The account holder must make sure users review AI-generated content and are comfortable with it before relying on it, sending it, filing it, or saving it.
We require a human to approve before any action that is not a simple search, lookup, or fetch (for example sending a notice, changing a record, or authorising a payment).
Prompts, retrieved text, drafts, and the fact of an approval or rejection may be stored as part of the scheme’s audit trail.

AI features are not a substitute for legal or professional advice, and they are not a committee resolution. AI is there to help. It does not replace the user.

9. How we hold and protect information

We hold personal information in electronic systems. Safeguards include:

access limited by login and scheme role
encryption in transit
private document storage with short-lived download links rather than public files
audit logging of sensitive access
row-level isolation between schemes in the database
staff access only where needed for support or operations

No method of storage is perfectly secure. You must also protect your email account, because that is how you sign in.

If we suffer an eligible data breach under the Notifiable Data Breaches scheme, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as the law requires. Where the incident concerns scheme records we hold on behalf of a customer, we will also coordinate with that customer so individuals are told in a clear way.

10. How long we keep it

We keep personal information only as long as we need it for the purposes above, or as required by law.

As a guide:

account data: while the account is open, then a short period afterwards unless we must keep it longer
scheme records: for the life of the customer’s subscription, then according to the export or deletion process below
audit and security logs: for a period that is reasonable for security and dispute handling
billing records: as tax law requires (often five or seven years)

Strata legislation may require an owners corporation or manager to keep certain records for a set period. Instant Strata is a tool for those records; it does not reduce those duties. Customers should export anything they must retain before closing an account.

When information is no longer needed, we take reasonable steps to destroy or de-identify it.

11. Access, correction, and deletion

Under APP 12 and APP 13, you may ask us for access to the personal information we hold about you, and to correct it if it is wrong.

If your information sits in a scheme record, the fastest path is usually the strata manager or committee that administers that scheme. They control the roll and day-to-day corrections.
If your information is your Instant Strata login, email privacy@instantstrata.com.au.

We will respond within a reasonable period (usually within 30 days). We may refuse in the limited situations the Privacy Act allows, and we will tell you why and how to complain.

You may also ask us to delete personal information we hold. We will do so where we can, unless we need to keep it for a legal obligation, a dispute, or the integrity of a scheme record we still host for a customer.

12. Cookies and similar technology

We use cookies and similar technology that are needed to:

keep you signed in
protect the service (for example CSRF and session security)
remember basic UI preferences

We do not use third-party advertising cookies on the product. You can block cookies in your browser, but sign-in may not work.

13. Children

Instant Strata is built for adult users who administer or live in strata schemes. We do not knowingly create accounts for children under 18. If you believe we have collected information from a child, contact us and we will take appropriate steps.

14. Complaints

If you have a privacy complaint:

Email privacy@instantstrata.com.au with enough detail for us to investigate.
We will acknowledge your complaint and aim to resolve it within 30 days.
If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.

If your concern is really about how a strata manager or owners corporation is using your details, you may also have rights under the strata legislation in your state or territory, and you may wish to raise it with them first.

15. Changes to this policy

We may update this Privacy Policy. The current version is always at /legal/privacy.

If we make a material change, we will update the “Last updated” date and give reasonable notice (for example by email or an in-product message) where it is practical to do so.

16. Contact

Privacy officer, Instant Strata
Email: privacy@instantstrata.com.au
Platform: app.instantstrata.com.au