Privacy policy

The details you enter on the form (the owners' names, the property's address, purchase and settlement details, notes) and the documents and photos you upload to have your depreciation schedule prepared. We collect them to prepare your schedule, and use the costs your documents state, without your details, to check and improve our estimates (see below).

Photos are resized in your browser, which also removes their location and camera data. Documents are sent to our AI assessment provider using endpoints that do not retain or train on the data, and deleted from it as soon as your report is made. Copies that are not used (for example, if you leave the page) are deleted automatically within a few hours.

When your report is prepared, the property's address alone (never the owners' names, your other answers or your documents) is looked up in a property data service to find the property's public record: what it was advertised with (bedrooms, bathrooms, car spaces, the type of dwelling, the land's size), the dates it was sold or advertised for sale or rent, and the council's valuations of its land. It fills in only what your documents and answers leave unsaid, and is checked against them: where it shows the property sold or advertised for rent before you bought it, and the form says it was new, your report may ask for that to be checked. We keep its dates and land valuations with your report's assessment; a lookup that finds nothing, or fails, leaves your report without them.

As you add documents to the form, before you send it, they are also read to fill in the form's details for you (the owners' names and shares, the property's address and type, the purchase price and dates, the year built and floor areas; whether it was bought new is only suggested). Your browser sends their text (for a PDF, its first 30 pages; for a spreadsheet or Word document, the text it was converted to) or, for a scanned PDF with no text, pictures of its first three pages, to our server, which passes them to a smaller AI model (from the same provider, on the same endpoints that do not retain or train on the data) and returns the details it finds to the form. We do not keep that text or those pictures, or log them; we record only what the reading cost. Nothing is filled into a box you have typed in, or a choice you have changed or clicked into and left, and each filled detail says which document it came from so you can check it. If you remove a document, what it filled, or helped to fill (a floor area added up from its garage area, co-owners' shares filled beside the names it gave), is taken back from the boxes you have not touched since; where your documents gave different values for a box and removing one leaves a single value, that box is filled with it, with its note. Photos are not sent for this.

We do not keep your documents. We keep the finished report (the PDF and the workbook) and a record of how it was prepared, encrypted, so it can be downloaded again by you or our staff.

While the form is being sent, your browser keeps a random key for that sending and the references to the documents already uploaded in this tab's session storage, so that if the page is reloaded before we answer, it can ask us whether your report started without starting a second one. It does not keep your answers (the owners' names, the property's address or anything else you typed), the documents' names, the documents or your access code there: those stay only in the open page. It is removed once we answer whether the report started or refuse what was sent, or when you press Forget it. It is kept for this tab only, and is not offered after 7 days (a browser that restores a closed tab may restore it with the tab until then). It is sent only to us, when you press Check it.

Where your documents state what something cost (a quantity surveyor's report, a building contract, an invoice), we keep those figures with the few facts needed to compare them with our own estimate of the same thing: the state, the year built, the type of dwelling, its floor area and construction, and the kind of item, its age and condition. We keep no names, addresses or documents with them. We use them only to measure and correct the accuracy of our cost estimates; they are not shared, and they are not used to train the AI provider's models.

They are linked to your report so that our staff can check them, and the link is removed if your report is deleted. With them we keep a scrambled form of the property's address that cannot be turned back into it without our secret key, so that we can tell how many different properties a correction rests on; it stays, with the figures, when your report is deleted.

Your first visit sets one cookie: a random identifier that says nothing about you. We use it to try changes to our pages and keep only those that help people get their schedule. With it we record which version of a page you were shown and when you take each step towards a report (following a link to the form, and which of our buttons it was, such as the one in the page's header; starting the form; clicking our email address to ask for an access code; starting a report), and, if you were shown a version under test, whether starting a report failed and which way (what was sent was refused, a limit was reached, or our service was unavailable or failed), never what you sent or the message you saw, and the hour of each, never the minute. Our server stores the identifier only in a scrambled form that cannot be turned back into it, never with your name, your address or your report. On a day with few reports, the hour a report was started could still be matched to that report, so we use these records only to count how many people take each step, never to look at any one person, and delete them within 90 days.

No third party receives any of it: the site has no analytics, advertising or tracking services. The records are deleted after 90 days, and once a test is decided only its totals are kept, with your identifier in its scrambled form and the hour it was first shown the test (of several tests decided, the latest such hour), not which test or version, deleted 90 days after that hour. Our staff are not counted. The cookie lasts 90 days; you can delete or block it, and the site works the same without it.

If you pause the moving list of items on the home page, your browser remembers that in its local storage, so the list stays still when you come back. It holds only that the list is paused, stays in your browser and is never sent to us. It is removed when you set the list moving again or clear this site's data; with storage blocked, the pause lasts until you leave the page.

Our server sees the internet (IP) address each request comes from. To stop the form, uploads, sign-in and the counting above from being used too often from one place, it counts the requests from each address for up to an hour (new visitors to our tests, for a day). It keeps those counts only under a scrambled form of the address (and, for attempts to sign in, of the email entered) that cannot be turned back into it without our secret key, and deletes them after two days. We do not keep your address with your form, your report or the records of how the site is used.

The staff area is different. Every attempt to sign in to it that is checked, and what our staff do there (such as opening, downloading, changing or deleting a report, and changes to accounts), is written to a security log with the time, the account, the email entered to sign in and the IP address as it is, so that misuse of an account can be found and traced. Attempts refused for coming too often from one address are written too, but once an hour for each address and without the email entered; and when wrong passwords lock an account, that is written once with the account and the address of the attempt that locked it. The log is used only for the security of the service and is kept without a set time limit.

Our staff, to prepare and support your report. We do not sell or share your information, except with the service providers that host the service (our hosting and database providers, in Australia or overseas, under their own security commitments), the AI assessment provider and the property data service described above (which is sent the property's address alone), the email delivery service described below, or where the law requires it.

Invitations to a firm's account, requests to a tax agent to sign off a report, and the notice to the firm's staff that a report was signed off are emailed through an email delivery service, in Australia or overseas, which is given each email's contents, including the recipient's name and email address, the link and, for a sign-off request and its notice, the report's reference, the property's address and, where the email gives it, the name of the person who asked or of the agent who signed.

You can ask for a copy of your report or for your report and its record to be deleted at any time by emailing support@ezydepreciation.com. We handle personal information in line with the Australian Privacy Principles.

Questions or complaints about privacy: support@ezydepreciation.com.