BidChat Privacy Policy
Summary
- BidChat is a tool for Australian mortgage brokers. We collect only what we need to run your account: your email, name, aggregator and licence role, plus billing status and basic usage data.
- Please do not put your clients’ personal information into BidChat. It is designed to work without it, and we have automatic safeguards to remove or block it.
- Your data is hosted in Microsoft Azure Australia East (Sydney). AI processing happens in Azure OpenAI in Australia East. Your content is not used to train AI models. Microsoft may keep AI prompts and outputs for up to 30 days solely for abuse monitoring.
- We keep data for short periods: uploaded files are deleted straight after text extraction, extracted product data after 24 hours, deals after 45 days, and feedback reports after 90 days. Deleting your account removes your data from BidChat, except billing records we and Stripe must keep by law (generally up to 7 years) and provider-held data that expires on its normal timeframe (e.g. AI abuse monitoring, up to 30 days; database backups, up to 7 days).
- Some service providers (our email provider and our payment provider) may handle your information overseas.
- We do not sell your information, and we do not use advertising or tracking cookies.
1. About this policy
1.1This policy explains how Dynasty Financial Pty Ltd (ABN 27 612 146 862) trading as BidChat (“we”, “us”, “our”) collects, uses, discloses and protects personal information when you use BidChat at bidchat.com.au.
1.2In this policy, “personal information” has the meaning given in the Privacy Act 1988 (Cth): information or an opinion about an identified individual, or an individual who is reasonably identifiable.
1.3As a small business, we are not currently required to comply with the Australian Privacy Principles (APPs) in the Privacy Act. However, as good practice, we handle personal information in line with the APPs, as described in this policy.
1.4This policy should be read with our Terms of Use.
2. What personal information we collect
2.1 Information about you (the broker)
| Type | Examples | When |
|---|---|---|
| Account details | Email address, name, aggregator, licence role (credit representative, ACL holder, or director of an ACL-holding entity) | When you register and update your profile |
| Eligibility details | Credit representative or ACL number, if we ask you to confirm eligibility | If requested |
| Login and session data | One-time login codes (stored only in a secure, time-limited form), session records, date and time of login, IP address, browser/device type | Each time you log in and use BidChat |
| Billing information | Subscription plan and status, Stripe customer reference, payment status, invoices, top-up purchases. Your card details are collected and held by Stripe, not us. | When you subscribe or pay |
| Usage information | Number of deals used, fair-use counters (messages and uploads per deal), features used, safeguard triggers (e.g. a blocked upload) | As you use BidChat |
| Preferences | Writing tone and voice settings you choose | When you set them |
| Deal content | The de-identified scenario information you enter, extracted lender product data, and the text BidChat generates for you | When you work on a deal |
| Feedback and support | Feedback reports you submit (which may include deal content you choose to include) and emails you send us | When you contact us or send feedback |
2.2 Sensitive information
2.2.1We do not ask for sensitive information (such as health information or racial or ethnic origin) and you should not provide it.
3. How we collect personal information
3.1We collect personal information directly from you when you register, use BidChat, pay, or contact us. We also collect some information automatically (such as session and usage data), and receive payment status information from Stripe.
3.2If you do not provide the information we ask for at registration, we cannot give you an account. Because we need to confirm you are a licensed broker and bill you, it is not practicable for you to use BidChat anonymously or under a pseudonym (APP 2), although you can contact us with general questions without identifying yourself.
4. Your clients’ information – please don’t give it to us
4.1BidChat is designed so that you do not need to enter any personal information about your clients. You may refer to a client by their first name only. Please do not enter a client’s full name (first name and surname) or any other details that could identify them. Our Terms of Use prohibit you from entering client full names, contact details, addresses, identification or account numbers (including TFNs and Medicare numbers), dates of birth, credit reports, or client documents.
4.2As a backstop, BidChat has automated safeguards:
- uploads are limited to lender product comparisons, and other documents are rejected;
- uploaded files are deleted immediately after text extraction;
- full names (first name and surname), contact details and addresses are automatically redacted from extracted text;
- content matching patterns for account numbers, tax file numbers, Medicare numbers and dates of birth is blocked; and
- extracted product data is deleted after 24 hours.
4.3These safeguards cannot catch everything. If client personal information is entered despite these measures, we will treat it as personal information under this policy, it will be deleted under our normal retention periods (or sooner if we become aware of it), and we will not use it for any other purpose. If you realise you have entered client personal information, please delete the deal straight away or contact us.
4.4You are responsible for your own privacy obligations to your clients, including under the Privacy Act and your licensee’s policies.
5. Why we collect, use and hold personal information
We use personal information to:
- create and manage your account, verify your eligibility, and log you in (including sending one-time login codes and enforcing one active session per account);
- provide BidChat’s features, including generating draft text for your deals;
- process payments, manage your subscription, deal allowance and top-ups, and send receipts and billing notices;
- send service emails, such as deal deletion reminders (around day 38), changes to our terms or this policy, and security notices;
- apply fair-use limits and safeguards, detect and prevent misuse, fraud, account sharing and security threats;
- respond to your questions, support requests and feedback, and fix problems;
- improve BidChat, using aggregated usage information and feedback reports (we do not use your deal content to train AI models);
- send you product updates if you have agreed to receive them (see section 12); and
- comply with our legal obligations (for example, tax record keeping) and enforce our terms.
5.1We will only use or disclose personal information for another purpose if you consent, if it is a related purpose you would reasonably expect, or if otherwise permitted or required by law.
6. Where your information is stored
6.1BidChat’s application, database and file processing are hosted on Microsoft Azure in the Australia East region (Sydney, NSW).
7. How we use artificial intelligence
7.1BidChat uses Azure OpenAI Service, deployed in Microsoft Azure Australia East, to generate draft text. When you work on a deal, the relevant (redacted) deal content is sent to the AI model in Australia East for processing and the result is returned to BidChat.
7.2Your prompts and outputs are not used to train or improve AI models, whether by us, Microsoft or OpenAI.
7.3Abuse monitoring. Microsoft may retain prompts and outputs for up to 30 days, solely to detect and prevent abuse of the AI service (for example, content that breaches Microsoft’s acceptable use rules). This data is held within Microsoft’s Australian data centres (Australia East region processing), may be reviewed by authorised Microsoft personnel only if flagged for potential abuse, and is then deleted. It is not used for any other purpose.
7.4AI-generated drafts can contain errors. You must review every draft (see our Terms of Use).
7.5BidChat does not use AI or any automated process to make decisions about you or your clients that significantly affect anyone’s rights or interests. Automated checks are used to reject non-comparison uploads, block certain patterns and apply fair-use limits; you can contact us if you think one of these has been applied in error.
8. Who we disclose personal information to
8.1We do not sell or rent personal information, and we do not share it with advertisers, aggregators, licensees or ASIC (unless required by law – see 8.3).
8.2We disclose personal information to service providers who help us run BidChat, only as needed for them to provide their services to us:
| Provider | What they do | Information involved | Location |
|---|---|---|---|
| Microsoft (Azure) | Cloud hosting, database, storage | All data held in BidChat | Australia East (Sydney) |
| Microsoft (Azure OpenAI Service) | AI processing to generate drafts | Redacted deal content and generated text. May be retained for up to 30 days solely for abuse monitoring; not used for training | Australia East (Sydney) |
| Postmark (ActiveCampaign) | Sending emails (login codes, reminders, notices) | Your email address, name (if included) and email content | May be processed overseas, including the United States |
| Stripe | Payment processing, subscriptions, billing portal, invoices | Name, email, card and payment details (card details are collected directly by Stripe), transaction history | Australia and overseas, including the United States |
8.3We may also disclose personal information: where required or authorised by law (for example, to a court, regulator or law enforcement body); to our professional advisers (such as lawyers and accountants) on a confidential basis; to protect the rights, safety or property of anyone; or to a purchaser or successor if the BidChat business is sold or transferred (including to a related entity), in which case we will tell you.
9. Overseas disclosure
9.1Our hosting and AI processing are in Australia. However, some of our service providers may store or access personal information outside Australia:
- Postmark processes your email address and the content of emails we send you (such as login codes and reminders) and may do so outside Australia, including in the United States.
- Stripe processes payment and billing information and may do so outside Australia, including in the United States. Your card data is held by Stripe, not by us.
9.2We take reasonable steps to ensure overseas recipients handle personal information consistently with the APPs, including by choosing reputable providers whose contractual terms include privacy and security commitments.
10. How long we keep information
| Information | How long we keep it |
|---|---|
| Uploaded files (lender product comparisons) | Deleted immediately after text extraction |
| Extracted product data from uploads | Deleted 24 hours after extraction |
| Deals (including your inputs and generated text, which is kept with the deal) | Automatically and permanently deleted 45 days after the deal is created. We email a reminder around day 38. You can delete a deal sooner at any time. |
| Feedback reports | Deleted after 90 days |
| Technical logs (which do not contain chat content) | Up to 30 days |
| AI prompts and outputs held by Microsoft for abuse monitoring | Up to 30 days, then deleted by Microsoft (Australia East; not used for training) |
| Login codes and sessions | Login codes expire shortly after issue; sessions end on logout, a new login elsewhere, or after 30 days of inactivity |
| Database backups | Retained for 7 days, then overwritten. Data you or we delete (including deals and account data) may remain in backups for up to 7 days after deletion. |
| Account details and preferences | Until you delete your account or we close it (including after 60 days’ suspension for non-payment) |
| Billing and transaction records (held by us and Stripe) | As long as required by law – generally 5 years under tax law and up to 7 years under corporations law – including after your account is deleted |
| Account deletion | Deleting your account permanently removes your account, deals and preferences from BidChat. Billing records are kept as described above, and data already held in backups (up to 7 days) or by providers (such as AI abuse-monitoring data and logs, up to 30 days) expires on the timeframes above. |
10.1When information is no longer needed, we delete it or permanently de-identify it. Deleted data may persist in our encrypted database backups for up to 7 days before the backups are overwritten; we do not restore deleted data from backups except to recover from a system failure, and any restored data is deleted again on its normal schedule. You cannot recover deleted deals, so please copy any text you need into your own records.
11. How we protect personal information
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure, including:
- hosting in Microsoft Azure Australia East, with data encrypted in transit (HTTPS/TLS) and at rest;
- passwordless login using one-time email codes, one active session per account, and secure, HttpOnly session cookies stored only in hashed form on our side;
- multi-factor authentication and restricted access for administrator accounts;
- data minimisation by design: discouraging client personal information, automatic redaction and pattern blocking, immediate deletion of uploaded files, and short retention periods;
- minimal logging, with no chat content written to logs;
- card details handled by Stripe, a PCI DSS-compliant provider, so we never see or store full card numbers;
- restricting access to personal information to what is needed to run and support BidChat; and
- keeping software and dependencies up to date and monitoring for errors and unusual activity.
11.1No system is completely secure. Please keep your email account secure, because it controls access to BidChat.
12. Cookies and similar technologies
12.1BidChat uses only essential cookies needed to keep you logged in and keep the service secure (a session cookie). We do not use advertising cookies, cross-site tracking, or third-party analytics that profile you.
12.2When you pay, Stripe’s checkout and billing portal pages may set their own cookies for fraud prevention and security. These are governed by Stripe’s privacy policy.
12.3If you block cookies in your browser, you will not be able to log in.
13. Emails and marketing
13.1We send service emails (login codes, deal deletion reminders, billing and security notices, and changes to our terms or this policy) as part of providing BidChat.
13.2We will only send product news or marketing emails if you have agreed, and every such email will include a way to unsubscribe. We comply with the Spam Act 2003 (Cth).
14. Data breaches
14.1If we suspect a data breach involving personal information, we will act promptly to contain and assess it. If a breach is likely to result in serious harm to anyone, we will notify affected users as soon as practicable, explain what happened and what information was involved, and tell them what steps they can take to protect themselves.
14.2Our response plan includes: containing the breach; assessing it as quickly as possible; notifying affected users of serious breaches; working with our service providers; and reviewing what happened to prevent it happening again.
15. Accessing and correcting your information
15.1You can view and update most of your account details in BidChat. You can also ask us for access to, or correction of, the personal information we hold about you by emailing hello@bidchat.com.au.
15.2We will respond within a reasonable time (usually within 30 days). We do not charge for making a request. If we refuse access or correction, we will tell you why in writing and how to raise a complaint.
15.3Because of our short retention periods, we may no longer hold information you ask about (for example, a deal older than 45 days).
16. Complaints
16.1If you have a concern or complaint about how we have handled your personal information, please email hello@bidchat.com.au with details. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
16.2If you are not satisfied with our response, you can find information about privacy rights from the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, phone 1300 363 992.
17. Changes to this policy
17.1We may update this policy from time to time. We will post the updated policy on our website with a new “last updated” date and, for significant changes, notify you by email or in BidChat before the change takes effect.
18. Contact us
Privacy Officer, BidChat
Dynasty Financial Pty Ltd (ABN 27 612 146 862) trading as BidChat
Email: hello@bidchat.com.au
Website: bidchat.com.au