Privacy Policy

1. About This Policy

SuburbScan ("we", "us", or "our") is operated by Yakhnov Studio. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our website at suburbscan.com.au (the "Service"). We are committed to complying with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

2. Information We Collect

We collect the following types of information:

• Search queries — suburb names, addresses, and postcodes you search for, and the criteria you set in the Suburb Finder tool (your chosen city, budget, property type, and how you weight factors such as safety, schools and transport). These are recorded to understand what visitors are looking for and improve the Service.
• Usage data — pages visited, time spent, browser type, device type, operating system, and referring URLs.
• IP address — collected automatically when you access the Service.
• Cookies and similar technologies — used to remember your session, your "Remember me" email (login page), which suburbs you have rated in our liveability polls (so you can change your rating instead of voting twice), and to collect usage analytics (see "Third-Party Services" for what Google Analytics receives).
• AI suburb search — what you type into the "Describe what you're after" box is sent to OpenAI to turn it into Suburb Finder settings, then kept with that search (up to 300 characters) to understand what visitors ask for. It is stored without your IP address, so it is not linked to you. Don't type anything personal into it.
• Suburb Finder places — the Suburb Finder lets you add places you travel to (work, school, family) so suburbs can be ranked by distance to them. These are held in your own browser, as coordinates and the labels you choose, and are sent to us only to run the search you asked for. We do not store them, and they are never put in the page address, so they do not appear in your browsing history or in our logs. They last for the visit unless you tick "Remember these places on this device", and "Forget these places" removes them immediately.
• Account information (if you sign up) — name (optional), email address, and a hashed password. If you sign in with Google, we also receive your Google account email, display name, and the stable Google account identifier (`sub`).
• Contact-form submissions — name, email, subject, and message text you provide on our contact form. Used only to reply.
• Page feedback — when you use the "Was this page useful?" control, we record your Yes/No answer and the page it relates to. If you leave an optional comment, we store that too; and only if you tick the box asking to be contacted do we store the name and email you provide, used solely to reply to your feedback. We do not use it for marketing.
• "Save for later" emails — if you ask us to email you a link to a page, we use the email address you enter once, to send that one message, and do not store it (if sending fails, the address appears in our error log so we can investigate). To stop the feature being used to flood an inbox, we keep a count of requests against a one-way hash of the address, and against your IP address, for up to a day.
• Lender referral requests — if you use the "Help me find a lender" option on a suburb page, we collect the name, mobile number and email address you enter, and the suburb page you sent it from. We collect these only to pass to a licensed mortgage broker, and only when you tick the box agreeing to that. We do not ask for, and do not collect, information about your income, savings, deposit or borrowing capacity.
• Subscription billing data (if you subscribe) — handled by Stripe (see "Third-Party Services" below). We store the Stripe customer ID, subscription status, and current period end on our side; we do not see or store full card details.

Free-tier browsing (suburb pages, state pages, tag pages) does not require an account or any personal details.

3. How We Use Your Information

We use the information we collect to:

• Provide and improve the Service, including search functionality and suburb data.
• Authenticate signed-in users and manage subscriptions (when applicable).
• Reply to messages you send via the contact form.
• Analyse usage patterns to enhance user experience and site performance.
• Monitor and prevent abuse or misuse of the Service.
• Comply with legal obligations.

4. Data Sources

The property, demographic, crime, bushfire, coastal erosion, aircraft noise, transport, and school data displayed on SuburbScan is sourced from publicly available Australian government datasets. We do not collect or display personal information about individual property owners or residents. For a full list of data sources, see our Data Sources page.

5. Cookies

We use cookies and similar technologies to remember your preferences (such as light or dark mode) and to collect usage analytics. The analytics cookie holds a random identifier that distinguishes your browser from others across visits — it is not linked to your name. If you rate a suburb in one of our liveability polls, we also set a cookie holding a random identifier so that returning to that suburb updates your own rating rather than adding a second one. It holds no rating, no account details and no name, and we do not use it to track you between sites. You can control cookies through your browser settings. Disabling cookies may affect some features of the Service.

6. Third-Party Services

We use the following third-party services, each of which receives some information when you use the corresponding feature. Each provider operates under its own privacy policy and may store data outside Australia (typically in the United States).

• Google Analytics 4 (Google LLC) — usage analytics on every page. Receives page URLs, referrers, browser/device characteristics, and IP-derived approximate location. This is pseudonymous rather than anonymous: a random identifier stored in a cookie lets Google Analytics recognise the same browser across visits. It is not linked to your name, and we do not attempt to identify individuals from it, but it is not anonymous data. See Google Privacy.
• Google Sign-In (Google OAuth, Google LLC) — only invoked when you click "Continue with Google" on the login or subscribe page. Receives your IP address and returns to us your verified email, display name, and stable Google account ID. We do not receive your Google password.
• Google reCAPTCHA v3 (Google LLC) — anti-spam protection on the contact form. The reCAPTCHA script runs invisibly in the background and reports a confidence score to Google to determine whether you're a human or a bot. Google receives the page URL, your IP address, and behavioural signals (mouse movement, timing). See Google Privacy and Terms.
• OpenAI (OpenAI, L.L.C.) — only when you use the AI suburb search. Receives the words you typed, which it turns into Suburb Finder settings; it does not receive your IP address from us, and the results are ranked on our own data. OpenAI states that API inputs are not used to train its models by default. See OpenAI Privacy.
• Stripe (Stripe, Inc.) — payment processing for subscriptions. When you click "Subscribe", we redirect you to Stripe's hosted checkout page. Stripe collects and stores your card details directly — we never see or store them. Stripe returns to us a customer ID and subscription status which we hold on our side. See Stripe Privacy.
• Email — outgoing email (contact-form replies, sign-in links, subscription notices) is sent through our own mail server on the same Australian infrastructure as the site, rather than handed to a third-party bulk-email service. Once a message leaves us it travels to your mail provider like any other email.
• OpenStreetMap tile servers (OpenStreetMap Foundation) — map tile rendering on suburb and property pages. Receives your IP address and tile coordinates when your browser fetches map tiles.
• Hosting providers — the website itself runs on infrastructure in Australia.

7. Data Sharing and Disclosure

We do not sell your personal information. We may share information in the following circumstances:

• With service providers who assist us in operating the Service, subject to confidentiality obligations.
• When required by law, regulation, or legal process.
• With a licensed mortgage broker, if you asked us to refer you using the "Help me find a lender" option and ticked the consent box. We pass on your name and contact details only. We may receive a fee if you take out a loan through a broker we refer you to. We do not provide credit assistance and do not recommend loan products.
• To protect the rights, safety, or property of SuburbScan, our users, or the public.

8. Data Security

We take reasonable steps to protect your information from unauthorised access, modification, disclosure, or destruction. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

9. Data Retention

Searches, Suburb Finder criteria, page ratings and data reports: we keep the record, but not the parts that identify you. A weekly job blanks the IP address and browser user-agent on any of these rows older than 90 days. What was searched for survives; the link back to the browser that searched it does not.

Account information is kept while the account exists. Deleting your account removes it — see Your Rights below.

Aggregated counts that identify nobody — how many people viewed a suburb page, how many searches ran in a week — are kept indefinitely.

10. Your Rights

Under Australian privacy law you can ask to access, or to correct, any personal information we hold about you — contact us and we will action it.

You can also delete your account outright, from your account page, without asking us. Deleting your account cancels any active subscription, removes your customer record from Stripe (including the saved payment method), signs out all sessions, and deletes your account and its activity trail. We keep a single record that an account was deleted — no email, no IP, no identity — so we can count how many people leave without keeping a record of who they were.

11. Children's Privacy

The Service is not directed at children under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us so we can promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us.