Privacy policy

What we collect

• Village data from publicly available state retirement village registers and operator submissions.
• Operator account data when an operator signs up: email, business name, ABN (optional).
• Resident and family inquiry data when someone submits a tour request, info pack request, or AI agent conversation: name, email, phone (optional), move-in timeframe, accommodation preference, notes.
• Anonymous usage analytics — pages viewed, basic device info — for product improvement.

How we use it

• Village data: published on the directory and exposed via our API and MCP server so AI assistants can answer resident and family questions accurately.
• Operator data: account management, billing (via Stripe), dashboard access.
• Inquiries: forwarded to the village the person contacted. We do not sell inquiry data, do not use it for advertising, and do not share it with third parties beyond the operator and standard transactional services (Resend for email, Supabase for storage, Stripe for billing).

How we protect it

Data is stored in Supabase (Postgres) with row-level security. Operator authentication uses one-time magic links — no passwords stored. Card details are never seen or stored by us; Stripe handles them directly.

How long we keep it

Inquiries are retained for 24 months from submission, then automatically de-identified — name, email, phone, and free-text notes are wiped, and only statistical fields (intent, move-in timeframe, accommodation preference) remain. The cleanup runs weekly. You can also delete your inquiries on demand at /leads/delete.

Operator account data is retained while the account is active and for 90 days after deletion (to support reactivation), then permanently removed.

Village data sourced from public registers is refreshed regularly; no retention limit applies.

Your rights (Australian Privacy Principles)

• Request a copy of any personal data we hold about you.
• Request correction of incorrect data.
• Delete your inquiries — self-serve at /leads/delete. Enter your email; we send a one-click confirmation link; on click your inquiries are anonymised in our store.
• Opt out of any non-transactional emails.

For everything else email privacy@over55s.au.

Note on inquiries already forwarded.When you submit an inquiry, we forward your details to the operator of the village you contacted. Once that email is delivered, the village holds its own copy on its own systems. Anonymising the inquiry on our side doesn't reach into the village's inbox — for that you'll need to contact the village directly.

Cookies + local storage

We use minimal cookies: a session cookie for operator sign-in (Supabase), and basic functional cookies for the lead form. We do not use third-party tracking cookies.

AI training

Village data is intentionally crawled by AI engines (ChatGPT, Claude, Perplexity, Gemini, Apple Intelligence) — being cited is the entire point of the directory. Inquiry data is never sent to third-party AI training pipelines.