Privacy policy

Who we are

This policy belongs to Redigi Pty Ltd, ACN 683 525 859, ABN 46 683 525 859, of PO Box 2, Brunswick South VIC 3055, Australia. In this policy, “we”, “us” and “our” mean Redigi Pty Ltd, and “you” means the person reading it.

We provide marketing and technology services to real estate offices across Australia. redigi.com.au is our own site, where an office can read about that service and get in touch, and my.redigi.com.au is the signed-in Studio where a client office and its team see and manage the work we do for them.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles, and we do not rely on the small business exemption, whatever our turnover. We also follow the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth) and the Australian Consumer Law.

What this covers, and what it does not

This policy covers redigi.com.au, whether you typed it with www or without, my.redigi.com.au, and the emails we send from them.

The people it is about are the ones who deal with the company directly: a principal or agent who enquires about the service, a client office and the people on its team, someone who signs in to the Studio, and anyone who visits these pages.

It does not cover a buyer or an enquirer who came to us through something we run for an agency. The chat and the pages at heyrova.com have their own privacy policy, and the campaign pages at suburbreports.au have theirs. Each of those documents is on the surface that collects the information, which is where you would look for it.

Two of our documents currently claim this address. The Hey Rova privacy policy, effective 27 August 2026, was written when this domain had no policy of its own, and its scope line still names redigi.com.au and my.redigi.com.au. For these two addresses, this document is the current one and it governs. We are narrowing the other one.

An agency that engages us also has a Services Agreement and a Statement of Works with us. Where those set out something specific about the information we hold for that agency, they say more than this policy does, and they are not displaced by it.

What we collect

From this site, what you send us yourself. The front page carries one form, the proposal request, and it asks four things: your office, your name, your email and an optional phone number. Sending it composes an email in your own mail program with those answers in it, so the page stores nothing; your message reaches us as ordinary email. Where any other page here carries a form, what it asks is on the page in front of you. Section 4 sets out what is loaded and logged as you read, and section 6 covers what a chat or a message collects.

When you get in touch. Your name, your email address or phone number, the office you are with, and whatever you chose to put in the message. If you would rather not tell us something, do not, and we will still answer you.

When your office becomes a client. Contact details for the people we work with there, which is a name, a work email address and a work phone number, and a note of who signs, who handles accounts and who is the day-to-day contact. The billing details needed to invoice you and collect a direct debit, and the invoices and payments themselves.

When you sign in to the Studio. The email address you sign in with, your name and the name you prefer to be called, when you first signed in, and a record of what you did in the Studio: the action, what it was done to, and when. That record is how a client office can see who on its team did what, and it is how we can answer a question about our own system honestly.

What we do not want at all. We do not seek sensitive information as the Privacy Act defines it, such as health, race or political views. Please do not send it to us.

Cookies, tracking and advertising

Where a page on redigi.com.au or in the Studio carries advertising or analytics, it records which pages you looked at and what you did on them, it sets a cookie in your browser, and it reports that to the platform running it. What each of those technologies does is in the table below, and section 11 covers where it goes. Whether you typed the address with www or without makes no difference: both serve the same pages.

This section says what happens rather than which switches are on today, because a policy pinned to this week's settings would be wrong the week we advertised. If a page is tracking you, that page will tell you, and you can email privacy@redigi.com.au to be told what is running on a particular page.

The platforms. Meta, being Facebook and Instagram, and Google. We also name TikTok, LinkedIn, Pinterest and X · not in use yet. That list is not closed. Where we advertise on a platform not named here, everything in this section and in section 5 applies to it in the same terms, and section 11 names the country it sits in.

Cloudflare hosts and delivers the site. Like any host, it records the connections that reach it, including the address you connected from, which page you asked for and when. That is ordinary server logging, kept for security and for keeping the site up, not for advertising.

The Studio keeps you signed in on your own device, because otherwise it could not know you are still you between one page and the next. That is what it is for, and it is not measurement.

The typefaces on these pages load from Google Fonts, which tells Google the address you connected from and the browser you used. It sets no cookie and it is not tracking, but it is not nothing, so we name it.

The email addresses on these pages are scrambled in the page source by Cloudflare, so that address harvesters cannot read them, and a small script from this same domain unscrambles them for you. It exists to protect the addresses, not to watch you.

How to turn any of it off. Block cookies in your browser, or use a tracker blocker. Use the advertising controls inside your own account on any platform named above. You can stop email tracking by viewing emails with images blocked.

What unsubscribing does not reach. Unsubscribing stops our emails and takes you out of any audience we built from a list of our own. It does not pull you out of an audience a platform assembled from browser events, because that audience is a set of browsers and carries no email address to match you against. Email us as section 15 describes, and use your own account's advertising controls, which reach the half we cannot.

Advanced Matching

This gets its own section, because it is genuinely not obvious and most policies bury it.

What happens. Where we send advertising events to a platform named in section 4, we may include your email address, phone number, name or location, put through a one-way process called hashing. The platform hashes the details it already holds the same way and compares the two. If they match, the platform knows the person who took the action is one of its users.

Being straight with you about what that means. Hashing means we are not handing over your email address as text, and a hash cannot practically be turned back into it. But hashing is not anonymity. The whole purpose is that the platform identifies you. It remains your personal information, and sending it remains a disclosure. Anyone who tells you hashed data is anonymous is being loose with the word.

Uploading a list is its own disclosure. Where we build a custom or lookalike audience by giving a platform a list, that list is hashed first, and sending it overseas is a cross-border disclosure under Australian Privacy Principle 8 in its own right, separate from anything a pixel sends. Section 11 names the countries.

Why we do it. So advertising can be measured accurately, and so a budget is not spent showing advertising to the wrong people.

How to stop it. Opt out of marketing with us, and use the advertising controls inside your own account on the platform. Either works on its own, and the clause above says which half each of them reaches.

Chat and messaging

Where we run chat or messaging on our own pages, on the Studio, or on our own social accounts, this is what happens. It covers a chat window on a page, a direct message or comment reply on Facebook, Instagram or LinkedIn, a click-to-message advertisement, SMS, and any messaging platform we add later.

What a conversation collects. What you write, the buttons you tap, the time, the page or advertisement that brought you, any contact details you give us, and the identifier the messaging platform gives you. On Facebook and Instagram that identifier is a Page-scoped ID, a code that identifies you to that page and to us without being your account name.

Where the message goes. The platform carrying it holds it, because it carries it. We store the conversation in our own database in Sydney, and where a model drafts a reply the content of your message is sent to Anthropic in the United States. Under our agreement with them, business data sent through their interface is not used to train their models.

ManyChat, while it lasts. Some conversations still pass through a third-party chat platform called ManyChat, which we are replacing with our own system. While they do, your messages and subscriber record are handled in ManyChat's systems in Germany. When a conversation moves across, that stops.

Ongoing messaging, and the consent position. After you message us, the platform allows us a limited period to reply. To message you after that window we need you to opt in, and we will ask plainly rather than assume. That opt-in is recorded with the evidence of how you gave it, it is a real choice, and you can withdraw it at any time by replying stop, by telling us in the conversation, or by emailing privacy@redigi.com.au.

Comments. Where you comment on one of our posts or advertisements, we may reply publicly under the comment and privately in a message. We do not delete or hide your comment.

If software is answering you, you will be told, and you can ask for a person at any point. Conversations are kept as section 12 sets out.

Why we use it

To answer you. If you enquire, we use what you sent to reply, to talk to you about your office, and to prepare anything you asked for.

To run the service for a client. To set the office up, to do the work, to support the people using the Studio, and to tell a client what their campaigns did.

To run the business. To invoice, to collect payment, to keep our accounts and to meet our obligations under Australian tax law.

To improve what we do. What we learn from running the service is a pattern rather than a person, and no individual travels inside it.

One client's information never reaches another. Contacts, records and audiences held for one office are never pooled with another's, never carried across when a client relationship ends, and never sold. There is no shared pot behind the scenes.

Marketing, and how to stop it

If you enquire, or if your office is a client, we may send you things about our own service. That is business-to-business marketing to a person at a real estate office, and it is the only marketing this policy is about.

Every message identifies who sent it and carries a working unsubscribe. You can also simply reply with the word unsubscribe.

One step, and it holds. Unsubscribing stops it permanently. You only have to say it once, and you do not have to say it again for each later send, because every send checks first.

We keep a minimal record of that unsubscribe permanently, because forgetting it would mean contacting you again after you told us not to. That retention protects you rather than us.

Unsubscribing does not close your account or delete what we hold. Those are section 15. If you want all of it, ask for all of it and we will do all of it. Section 4 says what unsubscribing does not reach on the advertising side.

Software, and what it does not decide

We use software and artificial intelligence in our work, and we would rather tell you plainly than leave you guessing. What follows is read from our own register of where software acts, so it changes when the work does.

The information these systems use. What you write in the conversation, the buttons you tap, the listing you ask about and the conversation so far. What you engaged with, the property you showed interest in, and your contact details in a scrambled form so a platform can match them. What you asked for, how far through the conversation you went, and how you engaged. What you engage with, the property you show interest in, how you responded to an advertisement, and what you tell the chat about your own home. Property and market data, and personal information only where a property is tied to you as its owner.

What the software decides on its own, with no person in the loop at the moment it happens:

• The reply you get in chat. You are talking to software, answering from the listing's own facts, until a person steps in. You can ask for a person at any time.
• Which advertising audience you fall into, based on what you have engaged with. It never changes a price you are offered or whether you can get a service.
• The order enquiries are put in, so an agent sees the most urgent first. The agent decides who to contact and when.

Where software does part of the work and a person decides:

• Whether you are marked as someone who may be thinking of selling, from what you engage with or tell the chat. A person then decides whether and how to get in touch.
• A price guide about a property, produced from market data. A person reviews it before it is published, and it is an input to your thinking and an agent's, never a decision made about you. We treat it as in scope because a figure about a home is one people act on.

Where software acts but decides nothing about you. Listing marketing and the welcome line on a listing's chat, written by software from the listing's own facts. Campaign posts wait for a person to press go. The chat's welcome line goes live straight away and a person corrects it afterwards. None of it is a decision about you.

What is not automated at all. No computer decides whether you can buy or rent a property, what price you are offered, or whether an agent will deal with you. Those are decisions people make.

Who else sees it

We disclose personal information to:

• The real estate agency you enquired with. This is the point of the enquiry.
• Advertising and messaging platforms, being Google, ManyChat, Meta today, with LinkedIn, Pinterest, TikTok, WhatsApp (through Meta), X named though not in use yet.
• Technology suppliers who run parts of the machinery under contract. Named, because a list of categories tells you nothing: ActiveCampaign (Redigi's own emails to clients), Anthropic (The models behind listing copy and the listing chat, and the Claude tools our team works with), ClickSend Pty Ltd (Lead alert texts to agents; not in use yet), Cloudflare (Hosts the sites and the studio, and answers DNS), Cyba Studio Pty Ltd (Contracted builders and client servicing, as Redigi's processor), GitHub (The code, and the pipeline that puts things live), GoCardless (Direct debit collection for Redigi's own billing), Google Gemini (Images, video and creative writing from non-personal inputs), Google Workspace (Gmail, Drive, Sheets and Meet: our inboxes, files and meeting notes), Make (Automations between systems; the Seller Finder capture), Resend (Sends every email, including agents' own replies), Stripe (Card payments for Redigi's own billing), Supabase (The base, the system of record, hosted in Sydney), Xero (The books; the invoice sync).
• Professional advisers such as accountants and lawyers, where needed.
• Anyone we must tell by law, or to protect someone's safety.

We do not sell your personal information, and we do not share one client's information with another.

Outsourcing does not move our responsibility. If a supplier we chose mishandles your information, that remains our problem to answer for.

If our business is ever sold or merges, information may transfer with it. Whoever took it on would be bound by this policy, or would have to tell you before anything changed.

Links to other places. These pages link to places we do not run, including LinkedIn and the Australian Business Register. Once you follow a link you are on their territory and their privacy practices apply, not ours.

Sending information overseas

Our database is hosted in Sydney, Australia, so what we hold about you sits in Australia.

Some of the suppliers above are overseas, so depending on how you dealt with us, information can be handled in these places.

Before we send personal information overseas we take reasonable steps to see that it is handled consistently with the Australian Privacy Principles.

Giving a platform a list is a disclosure in its own right. Where we upload a custom or lookalike audience, that hashed list leaves Australia to the platform's own country in this table, separately from anything a pixel or an API sends. Australian Privacy Principle 8 applies to it, and section 5 says why hashing does not make it something else.

A platform marked "not in use yet" is one we name but have not run for anybody. Where we advertise on a platform not named above, it is subject to the same steps, and this table is updated with the country it sits in.

How long we keep it

We keep personal information only while we need it, then destroy it or strip it of anything that identifies you.

That last one is the exception worth explaining. If you unsubscribe we keep a minimal record of it forever, because forgetting that you opted out would mean contacting you again after you told us not to. That retention protects you rather than us.

An enquiry that never becomes anything has no period of its own in the table above, and we would rather say that than invent one. The rule that applies to it is the one the Privacy Act sets: we destroy it or strip it of anything identifying once we no longer need it, and you can ask us to do that at any time under section 15.

Keeping it safe

We protect your information with access controls, encryption in transit, credentials held in a secure vault rather than in code, and access limited to the people who need it.

Signing in to the Studio is by invitation, and what a person can see there is set by the office they belong to.

No system is perfectly secure. If a data breach happens that is likely to cause you serious harm, we will assess it promptly and notify you and the Office of the Australian Information Commissioner as the law requires.

Your rights

You may:

• Ask what we hold about you, and get a copy.
• Correct it if it is wrong or out of date.
• Stop the emails at any time, in one step.
• Ask us to delete it, as described in section 15.
• Ask how we got it, if you did not give it to us directly.
• Complain, as described in section 16.

Email privacy@redigi.com.au. We will respond within 30 days and we will not charge you to ask.

We may need to check it is really you before we act. That is not obstruction, it is the point: handing someone's information to a stranger who claimed to be them, or deleting it on a stranger's say-so, would be the worse failure. We will ask for the least we can get away with.

Someone else can act for you, an accountant or a solicitor for instance, and we will ask for proof you authorised them.

These rights are not absolute, and occasionally the law lets us decline part of a request. If that happens we will tell you which part and why, rather than going quiet.

Asking never counts against you. We will not treat you differently, or stop working with you, because you exercised any of these rights.

Deleting your information

You can ask us to delete the personal information we hold about you at any time. You do not need to give a reason and it costs nothing.

Email privacy@redigi.com.au from the address you used. We will confirm within 30 days what we deleted, and what, if anything, we had to keep and why.

We may need to keep a small amount. The record that you unsubscribed, so we do not contact you again, and the financial records Australian tax law requires us to hold for seven years if your office is one we have invoiced. We will tell you if either applies to you.

Deleting your information sets out the same route step by step.

Complaints

Tell us first. Email privacy@redigi.com.au and we will acknowledge within 5 business days and respond within 30 days.

Coming to us first is offered, not required. If you are not satisfied, or if you would rather not come to us at all, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992. Complaints about spam or telemarketing go to the Australian Communications and Media Authority at acma.gov.au.

Changes

We may update this policy as the service changes or the law does. The current version always sits at this address with the date it took effect. If a change materially affects you, we will do more than quietly update the page.

Contact us

Redigi Pty Ltd
ACN 683 525 859  ·  ABN 46 683 525 859
PO Box 2, Brunswick South VIC 3055, Australia
privacy@redigi.com.au
1300 287 682

That address reaches a person, for anything about this policy, your information or your privacy. If you would rather write to somebody by name, pamela@redigi.com.au reaches the same people.