Privacy Policy

RapidSiteplan (rapidsiteplan.au), last updated 2 November 2026

This policy is section 8 of our Terms of Service, shown here on its own.

8. Privacy

This is the privacy policy of RapidSitePlan (ABN 72 389 512 376), and we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

What we collect and why: your account email and name, and the business details you add, such as your phone, ABN and logo; the addresses, measurements, sketches and plans you create or upload (needed to provide the service); payment records (Stripe takes the payment, and we never see or store card numbers); the Terms you accept or the confidentiality agreement you sign; and usage records (sign-in time, IP address and the country it comes from, browser and device string, browser errors on signed-in pages, plans generated, exports) used for support, security, fraud prevention and billing; how you reached us (the page you first landed on, the site that sent you and any code or link you used), kept in your browser from your first visit and saved with your account when you create one, so we can see which pages and links bring people in; and messages you send us through our contact and support forms, which we keep so we can act on them and keep a record of the request. We collect it from you, except where this policy names another source: a sign-in through Google or Apple, a people book entry another user makes, and a business address read from that business's own website.

Pre-Purchase Site Reports (proposed, for owner and lawyer review): when you buy a report, the address you searched, the report and the purchase are kept with your account so you can open it again. The free search is counted against your IP address and your account for a few days to limit automated use, and what it found for an address is kept without your name.

Cookies, local storage and analytics: essential cookies and local storage keep you signed in and hold your plan. RapidSiteplan itself does this with your browser's local storage and sets no cookies of its own; the payment page (Stripe) and the person check (Cloudflare) may set their own security cookies when you reach them. While you are signed out, our public pages also run Google Analytics and Microsoft Clarity. They record the pages read, where people click and scroll, and where visits come from, and Clarity keeps recordings of visits that we can play back. Clarity masks what you type into a form. Both set their own cookies and hold that data outside Australia, in the United States. Neither runs while you are signed in, or in the RapidSiteplan app on a phone or tablet. To switch both off, untick Analytics in the cookie notice (Cookie preferences, at the foot of every public page) or in Settings, Security, Cookie preferences; the choice is kept in that browser. When you pay, our server tells Google Analytics the amount, the currency and the product, and nothing that names you, whatever the switch says. If analytics was on when you signed up, that report carries the Google Analytics id your browser had then, so we can see which visits lead to a sale; otherwise it carries a code made from your account that does not name you. No advertising, and we do not sell or trade personal information.

Emails: we send the account and billing emails you need and, now and then, product news. New accounts get news only when the box for it is ticked at sign-up. If you sign up for the monthly email on a guide or the About page without an account, we keep your email address, the page you signed up on, and when you asked and confirmed, and we send nothing but the confirmation link until you open it. Every news email and every referral email has a one-click unsubscribe that works at once, or write to info@rapidsiteplan.au. We keep a copy of every email we send in our own mailbox.

Writing to businesses: we write to trade businesses about RapidSiteplan only where the Spam Act 2003 allows it, at the contact address a business publishes on its own website for its work and about that work, or at an address it gave us itself. We read those addresses from the businesses' own websites and do not buy lists. Each email names us with our ABN, says where we found the address and carries a one-click unsubscribe, and we may send the same message once through the contact form on the business's website. We keep the business's name, website and address, the emails we sent, which links in them were clicked, and the replies, which our system reads from our mailbox. A business we wrote to stays on our list, marked, so it is not written to twice. An unsubscribe stays on record, so that address is not written to again.

Sharing a plan: when you share a plan, the link is view-only: anyone holding it can look at and download that plan but cannot change anything or reach your account. The link stays live until you remove the plan, which disables it.

Your people book: the business details you enter for the certifiers, engineers, geotechnical consultants and town planners you work with (company, contact name, mobile, email, ABN, fees and the councils they serve) are held by RapidSiteplan and shown only to you and, for an organisation, its administrators. RapidSiteplan may contact those businesses about working with us, except those in an organisation's people book (section 11 of the Terms). You confirm you may share their business details with us. If your business is in the people book of a RapidSiteplan user and you want your details removed, or do not want to hear from us, email info@rapidsiteplan.au.

Corrections that teach our tracing: when you correct a roof line or an outline that RapidSiteplan traced or drew for you, we keep a small record of the change: the shape before and after, the source and capture date of the map picture, the area it covered, the state, council and lot reference, and the kind of structure. It holds no names, emails or photos. We use these records, and the plans and measurements you make, only to run, measure and improve our own tools, such as automatic tracing and drawing help, so they draw closer to what a person would. They are never sold or shared. They are erased with your account. Section 11 of the Terms sets a stricter rule for organisation accounts. To have the corrections from your account deleted, email info@rapidsiteplan.au.

Signs of automated access: to protect the service, we record signs of automated access, such as a browser that reports it is driven by automation software or a request to an address our app never calls, with the network address, browser details, page and time, against the account that was signed in, if any. Nothing is blocked or slowed by this record.

When the app fails: we keep a short record of the error and the last steps taken in the app (which buttons were pressed and which screens were open, never what was typed) for thirty days to fix the fault.

Automated decisions: none of our software makes a decision with a legal or similarly significant effect on you by itself. The figures a plan reads, such as setbacks, site cover, the wind class and the bushfire level, are indications for you and your certifier, and a person at RapidSiteplan decides refunds, account closures and partner applications.

Who handles your information for us: a small number of service providers, each under contract, run parts of RapidSiteplan for us.

• Supabase: our database, sign-in and file storage, which hold your account, plans and uploads (hosted in Sydney, Australia).
• Netlify: serves our pages from its worldwide network, from the place nearest you, and runs our server functions in the United States. It sees your internet address and the country it comes from.
• Stripe: takes payments, runs subscriptions and keeps its own payment records.
• Our email host: sends and receives our email (DreamIT Host, an Australian provider).
• Google: when you choose Sign in with Google, Google confirms who you are and passes us your name and email. Google also runs Google Analytics on our public pages and holds our inbox at Gmail, where the mail sent to our addresses and a copy of each email we send arrive.
• Apple: confirms who you are in the same way when you choose Sign in with Apple, where we offer it.
• Microsoft: runs Clarity on our public pages.
• Cloudflare: the check on our sign-up, sign-in and other forms that tells people from bots. It sees your internet address and browser details, and may set its own cookie.

Supabase holds our database, files and plans in Sydney, Australia, and DreamIT Host sends and receives our email in Australia. Netlify serves our pages from its worldwide network and runs our server functions in the United States. Stripe, Google, Microsoft and Cloudflare process data in the United States and the other countries where they run their services, and Stripe also in the country where a payment settles. We take reasonable steps to make sure each handles it consistently with the APPs.

Map pictures and property data come from government mapping services, Esri and, where your organisation connects one, its own aerial imagery provider. Some map pictures load straight into your browser, so those servers see your internet address and the map area, as any website would; our server asks for the rest. None of them gets your name or email. The administrators of an organisation see the usage of that organisation and its clients. RapidSiteplan can see across the service to run and support it, and each time we open the screens of an account to help, the look is logged. We disclose personal information otherwise only where the law requires it.

How we protect it: encrypted connections only, database rules that keep each account and organisation to its own data, two-step sign-in for anyone who turns it on, and access limited to the people who need it to run the service. When we no longer need personal information, we delete it or take the name and email off it, on the timetable below.

Data breaches: we follow the Notifiable Data Breaches scheme under the Privacy Act — if a breach likely to result in serious harm occurs, we will notify affected account holders and the OAIC promptly, with what happened, what information was involved and what we are doing about it.

How long we keep it:

• Your account: your details, plans, uploads, sign-in history and messages, while the account is open. A plan you bought stays at least six months from its purchase, as section 7 sets out, unless you remove it or delete your account first.
• A deleted account: erased 14 days after you delete it, as set out under Deleting your account below.
• Invoices, payment records and signed agreements: seven years, as tax and contract law need, with your name and email taken off them when your account is erased.
• Records of the app failing: 30 days.
• Businesses we have not written to: removed from our list after 12 months.
• Our emails to businesses: the emails and form messages we sent, the clicks on their links and the replies, removed after 24 months.
• Unsubscribes and deletions: an unsubscribe stays on record so we do not write to that address again; once you delete what we hold, only a one-way code made from the address stays, for the same reason.
• Analytics: kept by Google and Microsoft for the periods their services set.

See, download or delete what we hold: with an account, open Settings, Security, Your data, where View my data shows everything we hold about your account and Download my data gives it to you as a file, at any time. Anyone, with an account or without, can use Your information: type your email address, and if we hold anything under it, our system sends a one-time link to that address straight away. The link works for an hour and opens a page with everything held under that address, a download of it, and two buttons: one stops all email to the address, the other deletes what we hold. The system answers by itself, without waiting for us. You can also write to info@rapidsiteplan.au, and we answer within 30 days. Deleting cannot shorten the records we must keep for payment, tax, agreement or dispute purposes, and an account itself is deleted under Settings, Security, as set out below.

Correction and complaints: to correct your details, change them in Settings, or write to info@rapidsiteplan.au from the address concerned and we correct them, or tell you why not, within 30 days. If you believe we have mishandled your information, complain to us first at info@rapidsiteplan.au; if it is not resolved, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Deleting your account: in the RapidSiteplan app or on the website, go to Settings, Security, Delete my account. The account closes at once and any subscription stops renewing. After 14 days we erase your details, your own plans and uploads, your sign-in history and the help threads you started. Plans made for an organisation stay with it, and what you wrote in other people's jobs and threads stays there with your name taken off. Invoices, payment records and signed agreements are kept for 7 years, as tax and contract law need, with your name and email taken off them. Cannot sign in? Email info@rapidsiteplan.au from the address on your account and we close it for you.