Privacy Policy

How Briesa collects, uses, stores and protects personal information, in line with the Australian Privacy Principles.

What we collect and why

Effective 19 October 2026

What Briesa learns about the people who use it, where that comes from, what it is used for, and what the assistant is sent.

Privacy at a glance

Who we are
Briesa (ABN 68 461 702 776).
The law we follow
The Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles.
What we collect
Account and licence details, the records your agency keeps, sign-in and usage information, and what you send us.
Card details
Entered on and held by Stripe. We never see a card number.
Who we share with
Supabase, Vercel, Anthropic, Stripe and Resend, under terms that bind them; Meta counts visits to the website from its ads. We do not sell personal information.
Where it is kept
The database and hosting are in Sydney; the model, payment, email and advertising providers are in the United States. Each is on the Subprocessors page.
Your rights
Ask to see what we hold and to correct it. We answer within 30 days, and there is no charge to ask.
If something is wrong
Tell us first; we acknowledge within 5 business days. If our answer does not resolve it, you can complain to the OAIC.
Contact us about privacy

Under review. This version is awaiting review by a NSW solicitor. Until that review is complete it is published so that it says, today, what Briesa does.

About this policy

Briesa (ABN 68 461 702 776, "Briesa", "we", "us") provides a compliance platform for real-estate agencies in New South Wales. This policy explains how we collect, hold, use and disclose personal information, how you can access or correct it, and how to make a complaint. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we apply the standards in this policy whether or not the Act strictly applies to us.

It applies to visitors to our website, people who contact us or book a demo, agency customers and their staff who use the platform, and other people whose information appears in the records an agency keeps on the platform.

Your information and your clients' information

We hold personal information in two different ways, and the rules differ.

  • Information we hold for our own purposes. This is information about website visitors, prospects and the people who sign up for and use Briesa. We decide how it is used, and we are responsible for it under this policy.
  • Information an agency puts on the platform. Agencies keep records about their own clients, vendors, buyers, landlords, tenants and staff. The agency decides what to collect and why, is responsible for having a lawful basis to collect it and for telling those people, and controls who in the agency can see it. We act as the agency's service provider: we handle that information only to provide and secure the service and as our Terms & Conditions set out, and we never use it to market to the people it is about.

If your information is on Briesa because an agency put it there, please contact that agency first. We will help the agency respond to you.

Information we collect

We collect only what we need for the purposes in section 5.

  • Contact details: your name, email address, phone number, business name and role, from website forms, demo bookings, account registration and enquiries.
  • Account and licence details: your email address, name, role in the agency, and the licence or certificate type and number the agency records for you, entered by you or by an administrator who adds you.
  • Billing details: the billing name and address, the plan and the payment status of an organisation. Card details are entered on and held by Stripe, our payment provider; we never see or store a card number.
  • Usage and device information: the time and network address of each sign-in and the browser used, the actions taken in the platform, and the audit trail of every change made to an organisation's records.
  • Communications: what you send us by email or through the contact form, and our replies.
  • Agency records: the records an agency keeps on the platform, which may include the names, contact details, addresses, identity and tenancy information, trust and transaction records, files and notes of its clients, vendors, buyers, landlords and tenants.
  • Assistant interactions: what you type into the assistant and what it answers, kept with the organisation's records.

Signing in with Google. If you choose to sign in with Google, Google sends us your name, your email address and whether Google has verified it, your profile picture and an identifier for your Google account. We ask Google for these basic profile details and nothing else: we never see your Google password, and we have no access to your email, contacts, calendar, files or any other Google data. We use them only to create your Briesa account, or to connect the sign-in to the account that already uses that email address, and to sign you in. They are held by Supabase, our sign-in provider, with the rest of your account (section 7), kept while your account is open (section 12), and never sold, used for advertising, used to train models or shared with anyone else. You can remove Briesa's access at any time in your Google Account's security settings and sign in with your email address instead. Briesa's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We run no analytics tools, and no advertising tools in the platform. Our website carries Meta's pixel, which tells Meta that a browser visited a page so that visits from our Meta ads can be counted and the ads measured; it sends Meta the page address and its own cookies, never your name or anything you type, and it runs on briesa.com alone. We hold no tracking data about you ourselves.

How we collect it

We collect personal information directly from you when you complete a form, book a demo, create or use an account, or contact us; automatically, through the cookies described in section 10, when you sign in and use the platform; and from agencies and their staff when they add records or invite users. If you sign in with Google, we receive the details in section 3 from Google. We may also receive information from Stripe about the status of a payment, and from public sources such as the NSW public register of licence holders.

You can browse our website and ask a general question anonymously or under a pseudonym. We cannot provide an account, support or billing without your real details.

How we use your information

We use personal information for these purposes, and for related purposes you would reasonably expect:

  • to provide, secure and support the platform, including creating and managing accounts, applying the right permissions and keeping the audit trail;
  • to run the assistant when you or your agency use it (section 6);
  • to bill customers and manage subscriptions;
  • to answer your questions, provide support and tell you about changes to the service;
  • to market Briesa to you where you have asked us to or where the law allows (section 9);
  • to improve the platform by studying how it is used;
  • to keep the platform safe, prevent fraud and misuse, and investigate and respond to security incidents; and
  • to meet our legal obligations, handle complaints, and establish, exercise or defend legal claims.

We use or disclose personal information for another purpose only with your consent, where it is related to the original purpose and you would reasonably expect it, or where the law requires or allows it, for example to a court, regulator or law enforcement body. We do not sell personal information.

The assistant and your information

Briesa includes an assistant that drafts, checks, summarises and answers questions about an agency's records. It changes nothing on its own: what it drafts is text for a person to review, and a record changes only when a person changes it.

  • Who runs the model. The assistant uses models made by Anthropic, reached through Vercel's AI Gateway. What you type and the records the question is about are sent to that provider to produce the answer, under terms that do not allow it to train its models on what we send.
  • What we do with it. We do not use the content you submit, or the answers, to train or improve models, and we do not give one agency access to another's records through the assistant.
  • Accuracy. The assistant can be wrong. A person checks its output before relying on it, and no decision that significantly affects an individual is made on its output alone.
  • Your choices. Enter only what the task needs. An agency that does not want the assistant used on its records can simply not use it; nothing is sent to the provider until somebody asks a question.

Direct marketing

We send marketing email only to people who have asked for it or whose consent can reasonably be inferred, as the Spam Act 2003 (Cth) requires. Every marketing message identifies Briesa and has a working unsubscribe link, and we act on an unsubscribe within 5 business days. Leaving a list never affects your account or your service. We send service messages that are not marketing, such as billing notices, security alerts and changes to our terms, to account holders whether or not they have unsubscribed from marketing. We do not sell or rent our mailing lists, and we do not build advertising audiences from them.

How it's looked after

Who else ever handles personal information, where it is kept, how it is protected, and how long it stays.

Disclosure to third parties

We share personal information only with people and organisations that need it for the purposes in section 5, and we require them to protect it. The providers that handle data for us, what each does and where it holds data are listed on our Subprocessors page and are, today:

  • Supabase, which runs our database, sign-in and file storage, and holds the platform's data, including agency records;
  • Vercel, which hosts the platform and relays assistant requests to the model provider through its AI Gateway;
  • Anthropic, whose models answer the assistant, receiving what you submit to it and the records it concerns;
  • Stripe, which takes payments and manages subscriptions, receiving billing and payment details;
  • Resend, which delivers the platform's email, receiving the addresses and messages it sends;
  • Meta, whose pixel on our website receives the address of each page visited and its own cookies, to count visits from our Meta ads; and
  • your agency's identity provider, if your agency turns on single sign-on, which receives your sign-in request.

We may also disclose personal information to our professional advisers, insurers and auditors where they need it; to courts, regulators and law enforcement where the law requires or allows; and to a buyer or successor if Briesa is sold or restructured, under the same protections. We do not share one agency's records with another agency, and we do not give agency records to marketers.

Overseas disclosure

Our hosting and our database are in Sydney, Australia (Vercel and Supabase, both in the ap-southeast-2 region). Our model, payment and email providers are listed on the Subprocessors page and operate their own systems in the United States, so what is sent to them is handled there.

Before we send personal information overseas we take reasonable steps to make sure the recipient handles it consistently with the Australian Privacy Principles, through the terms we hold with each provider and by choosing providers with recognised security practices. By using Briesa you understand that your information may be sent to and handled in these places. You can ask us which countries your information is held in at the address in section 18.

Storage and security

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Today those steps are:

  • One organisation at a time. Every query the platform runs is scoped to your organisation, and the database enforces the same boundary a second time with row-level security, so one agency can never read another's records.
  • Named accounts and a second factor. Every person signs in with their own account. An authenticator app can be added to any account, an agency can require one of every member, and Briesa's own staff cannot open the staff console without one.
  • Sign-in protection. Passwords are held only as salted hashes by our sign-in provider. Five failed attempts in fifteen minutes lock sign-in for fifteen minutes. A session lasts at most twelve hours, is bound to the address that issued it, and ends everywhere when you sign out everywhere, change your password or close your account.
  • An audit trail nothing can edit. Every change to an organisation's records is written to an audit log that cannot be updated or deleted, and compliance records are closed rather than deleted. Staff who look at an agency's records in the console must give a reason, and the agency's owners and administrators can see that they did.
  • Encryption. Every connection uses TLS, and our providers encrypt the database, files and backups at rest.
  • Backups. Our database provider takes automated backups of the production database.
  • Written policies. We keep written policies for information security, access control, backup and recovery, data handling and retention, and data breach response, and review them at least every year.

No system is completely secure. You can help by using a strong, unique password with an authenticator, keeping your devices up to date and telling us at once if you think your account has been misused.

How long we keep information

We keep personal information only as long as we need it for the purposes in section 5 or as the law requires, and then we delete or de-identify it. In summary:

  • Agency records on the platform: for as long as the agency's organisation is open. When its owner closes the organisation, there are 30 days to reopen it or export its records; after that, access ends and the records are held, unchanged, for the period the law sets for them: seven years for trust, agreement, identity, register and similar compliance records, and three years for photographs and other files. After that period, or earlier at the agency's written request where the law allows, we delete or de-identify them.
  • Your account: while it is open. Closing your account ends every sign-in and removes you from every organisation; the record that the account existed is kept so that each organisation's audit trail stays complete.
  • Sign-in records, including the network address and browser of each sign-in: while your account is open.
  • Billing records: while the organisation is open, and for seven years afterwards to meet tax, accounting and legal obligations.
  • Support and enquiry records: usually up to two years after the matter ends.
  • Backups: until the backup expires on our provider's normal cycle. Until then it is kept secure and used for nothing but recovery.

Data breaches

We have a written procedure for responding to a data breach. If a breach is likely to cause serious harm to you, we will tell you and the OAIC as the Notifiable Data Breaches scheme requires, and we will tell the agency whose records are affected without undue delay. We will say what happened, what information was involved and what you can do to protect yourself.

Your choices

Seeing and correcting what we hold, controlling cookies, and what to do if something is wrong.

Accessing and correcting your information

  • Access. You can ask for the personal information we hold about you. We respond within 30 days. We may refuse in some cases, such as where giving access would affect another person's privacy, and we will tell you why in writing.
  • Correction. If information we hold about you is inaccurate, out of date, incomplete or misleading, you can ask us to correct it. We correct it or tell you why we have not.
  • Deletion and objection. You can ask us to delete your personal information, or to stop using it for marketing. We will do so unless we need to keep it for the reasons in section 12 or because the law requires it, and we will tell you if we cannot.
  • Information held for an agency. If your information is in an agency's records on Briesa, ask the agency. We will help the agency respond within the time the law allows.
  • How to ask. Write to us at the address in section 18. We will ask you to confirm who you are before giving out or changing information. There is no charge to make a request, and we will not charge for giving access except where the law allows a reasonable charge for unusual effort.

An agency's owner and administrators can export the organisation's records as a file from the platform at any time, and its registers and audit trail as spreadsheets.

Cookies

The platform sets a small number of cookies to keep you signed in and to remember how you left it, none of them for advertising or analytics. Our website, briesa.com, carries Meta's pixel, which sets two advertising cookies of Meta's so that a visit from a Meta ad can be counted; a browser that blocks third-party trackers blocks them. Every cookie, what it is for and how long it lasts is on our Cookies page. You can control cookies in your browser's settings, though signing in needs them.

Complaints

If you think we have breached the Australian Privacy Principles or this policy, contact our Privacy Officer using the details in section 18. Tell us what happened and what outcome you want. We will acknowledge your complaint within 5 business days, investigate it, and give you a written reply, usually within 30 days.

If you are not satisfied with our reply, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, by phone on 1300 363 992, or by post to GPO Box 5288, Sydney NSW 2001.

Children and sensitive information

Briesa is a business service for real-estate professionals and is not directed at children. We do not knowingly collect personal information from anyone under 18 for our own purposes; if you think a child has given us information, contact us and we will delete it.

We do not ask for sensitive information, such as health, racial or ethnic origin, political or religious beliefs or criminal records, for our own purposes. Agencies may hold some sensitive information about their clients, and where they do we handle it only to provide the service and with extra care.

Changes to this policy

We review this policy at least once a year and when our practices or the law change. We publish the current version on this page with its date, and tell account holders by email about changes that matter to them.

Contact us

Briesa's Privacy Officer is Jye Sanjurjo. For privacy questions, requests or complaints, write to privacy@briesa.com or use our contact page. We reply to privacy requests within 30 days.

Related content