Privacy Policy

Last updated July 2026 · Good Strata Pty Ltd (ABN 55 684 135 760 · ACN 684 135 760)

This policy explains how Good Strata Pty Ltd (ABN 55 684 135 760, ACN 684 135 760), a company based in Melbourne, Victoria, Australia ("Good Strata", "we", "us"), handles personal information in GoodStrata, our AI-assisted owners-corporation management platform hosted at my.goodstrata.com.au. We are committed to handling personal information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

In short: we collect the information needed to run an owners corporation: names, contact details, lot ownership, and financial records. Data for the hosted service is stored in Australia. Automated agents process operational data to do the day-to-day work, but the money is computed by deterministic, tested code, not by the AI. We use a small set of reputable providers for payments, email, hosting, and document storage, and we do not sell your personal information.

On this page

1. Information we collect
2. Why we use it
3. AI processing and money
4. Where information is stored
5. Third parties
6. Cookies and analytics
7. Security
8. How long we keep it
9. Your rights
10. Self-hosting
11. Changes to this policy
12. Contact and complaints

1. What personal information we collect

The information we hold depends on your role in an owners corporation. It may include:

• Identity and contact details: names, email addresses, phone numbers, and postal or lot addresses of owners, residents, committee members, and appointed managers.
• Ownership and lot data: which lot a person owns or occupies, lot entitlements, voting entitlements, and role within the owners corporation.
• Financial information: levies raised and paid, arrears and penalty interest, payment records and references, disbursements to contractors, and the owners corporation's fund balances and budgets. We do not store full card numbers; payment card and bank details are handled by our payment provider.
• Operational records: maintenance requests, contractor quotes and work orders, meeting notices, agendas, minutes, correspondence, and uploaded documents.
• Account and technical data: login credentials (passwords are stored hashed, never in plain text), authentication session data, and basic logs such as IP address and timestamps needed to secure and operate the service.
• The audit log: an append-only record of actions taken in the platform, attributing each action to the person, agent, or system that took it.

2. Why we collect and use it

We use personal information to:

• run the day-to-day administration of an owners corporation: issue levies, match payments, follow up arrears, triage maintenance, manage meetings and minutes, and keep records;
• authenticate you, apply role-based access so people see only what their role permits, and keep the service secure;
• process payments and disbursements through our payment provider;
• communicate with owners, residents, and committees, for example levy notices, arrears reminders, meeting notices, and service messages;
• maintain the append-only audit log so actions are accountable and checkable;
• meet legal and regulatory obligations that apply to owners corporations and to us.

We collect personal information directly from you where we can, and also from the owners corporation, its committee, or its appointed manager who invite you or enter records on the corporation's behalf, which is how strata administration ordinarily works.

3. How AI agents process your information, and how the money is protected

GoodStrata uses automated software agents to perform routine operational work: drafting notices and minutes, triaging maintenance reports, preparing arrears follow-ups, and assembling decisions for a person to approve. To do this, agents process the operational data described above.

Crucially, the money is computed by deterministic, tested code, not by the AI. Levy apportionment, penalty interest, payment matching, fund splits, and vote weighting are calculated by ordinary code, and the AI does not determine financial figures. Agents assist and draft; people make the decisions that spend money or commit the building; and every action is written to the audit log. Depending on the deployment, the model that powers the agents may run locally, or through Anthropic's hosted Claude API (United States) as the primary model provider, with OpenRouter as a fallback if configured. These providers see only the operational data an agent needs for its task: for example, a levy-reminder draft may include an owner's name, email address, and arrears figures, and the AI meeting chair processes a portion of the live meeting transcript. We do not use your personal information to train third-party AI models, and providers are engaged under confidentiality and security terms appropriate to that processing.

4. Where your information is stored

Data for the hosted service is stored in Australia. Our database and application data are hosted on Supabase infrastructure in the Sydney region, and document and file storage uses Amazon S3. Keeping the primary data store in Australia is a deliberate choice for an Australian strata product.

5. Third parties we share information with

We use a small set of reputable service providers to run the platform, and we share only the information each needs to perform its function:

We may also disclose information where required or authorised by law, to protect our legal rights, or in connection with a sale or restructure of the business (in which case it stays subject to protections consistent with this policy). We do not sell your personal information, and we do not disclose it for third-party advertising. As the table above shows, some providers, Anthropic and OpenRouter, Daily.co, and Google, are based in the United States and process information outside Australia; where that occurs, we take reasonable steps to ensure the information is handled consistently with the APPs.

6. Cookies and analytics

Our marketing site (goodstrata.com.au, including this page) uses Google Tag Manager to load basic web analytics, which may set cookies or similar technologies in your browser to measure how visitors use the site. The hosted application (my.goodstrata.com.au) does not run third-party analytics or advertising trackers; it uses only the session cookie needed to keep you signed in. You can control cookies through your browser settings. Blocking analytics cookies does not affect your ability to use the hosted application.

7. How we keep it secure

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These include encryption in transit, role-based access controls so people see only what their role permits, hashed password storage, and the append-only audit log. No system is perfectly secure, but we work to protect your information and to respond appropriately if something goes wrong, including meeting our obligations under the Notifiable Data Breaches scheme where they apply.

8. How long we keep it

We keep personal information for as long as needed to provide the service and to meet the legal record-keeping obligations that apply to owners corporations. Financial records, including levy notices, receipts, and their supporting documents, are retained for seven years from the date they are created, matching the retention period owners corporations must meet under the Owners Corporations Act. Once that period passes, a scheduled process deletes the stored file and removes identifying details from the record. Because the audit log is append-only, entries in it are retained as part of the corporation's permanent record, and other operational records (such as messages, meeting transcripts, and AI-agent logs) are retained for as long as your account is active. Where we are not obliged to retain other information and it is no longer required, we take reasonable steps to delete or de-identify it.

9. Your rights: access and correction

You may ask to access the personal information we hold about you, and to have it corrected if it is inaccurate, out of date, incomplete, or misleading. Much of your own data is also visible to you directly in the platform: for example, an owner can see their own lot's statements. To make a request, contact us using the details below. We will respond within a reasonable time and, in most cases, without charge; if we cannot give access or make a correction, we will explain why. Some corrections in a strata context are made through the owners corporation or its committee, and we will help route your request appropriately.

10. Self-hosting

GoodStrata's source code is open source under the Apache-2.0 licence, and an owners corporation or operator can run its own copy on its own infrastructure. If you use a self-hosted deployment, that deployment's operator, not Good Strata, is responsible for how personal information is handled there. This policy describes the hosted service we operate at my.goodstrata.com.au.

11. Changes to this policy

We may update this policy from time to time. When we make a material change, we will update the "last updated" date above and, where appropriate, notify you through the platform or by email.

12. Contact and complaints

For privacy questions, access or correction requests, or to make a complaint about how we have handled your personal information, contact Good Strata Pty Ltd via goodstrata.com.au or through our repository at github.com/goodstrata/goodstrata. We will acknowledge your complaint and aim to resolve it promptly. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.