Privacy Policy
Stratapilot Effective Date: 31 May 2026 Last Updated: 31 May 2026
1. Introduction
Stratapilot ("Stratapilot", "we", "us", or "our") provides a cloud-based body corporate management platform ("Platform") designed for Australian strata schemes and body corporates. This Privacy Policy explains how we collect, use, disclose, and protect personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, you must not use the Platform.
2. Who We Are
Stratapilot is an Australian company that provides software-as-a-service (SaaS) solutions to body corporates, strata schemes, and their members. We act as a data processor on behalf of body corporates (our customers), who are the data controllers for personal information of lot owners and scheme members.
Contact: Privacy Officer, Stratapilot Email: support@stratapilot.au
3. What Personal Information We Collect
We collect personal information that is reasonably necessary to provide the Platform. The categories below describe what we collect and why.
3.1 Identity and Contact Information
- Full name
- Email address (used as login credential and for notifications)
- Phone number(s)
- Mailing address (if different from lot address)
Source: Provided by the body corporate's committee when issuing invitations, or provided directly by you when completing your profile.
3.2 Lot and Scheme Information
- Associated lot number(s) and strata scheme details
- Role within the scheme (Committee Member, Caretaker, or Lot Owner/Viewer)
- Committee label (Chairperson, Secretary, Treasurer, or Ordinary Member)
Source: Entered by committee executives when setting up or managing the scheme.
3.3 Financial Information
- Levy amounts and levy schedule details
- Levy payment history and arrears status
- Funding plan details and budget information
- Quote and billing request records
- Financial report data (income, expenditure, fund balances)
Note: Stratapilot is a levy-tracking and financial management tool. We do not process payment card data or operate as a payment gateway. No payment card numbers or bank account credentials are stored in the Platform.
3.4 Voting and Meeting Records
- Ballot choices (YES, NO, or ABSTAIN) per poll
- Poll participation history
- Proxy appointment details (appointor and appointee)
- Meeting attendance and agenda records
Source: Recorded when you participate in committee or general-meeting polls.
3.5 Documents and File Content
- Files uploaded to the Platform (e.g., by-laws, financial reports, meeting minutes, insurance policies, maintenance records, correspondence)
- Document metadata (filename, category, uploader, upload date, visibility level)
- Attachments to reports, complaints, quotes, and other submissions
3.6 Pet Registration Information
- Pet name, species, breed, and description
- Pet photograph (optional)
- Registration status and committee decision notes
3.7 Reports and Complaints
- Submission content (title, description, category)
- Supporting attachments (photos, documents)
- Lot referenced in the submission
- Internal committee notes (visible only to committee members)
- Resolution summary
3.8 AI Assistant Interactions
- Conversation messages sent to and received from the AI assistant feature
- Document context excerpts used to generate AI responses
Important: AI assistant queries may be processed by a third-party AI model provider (see Section 7). Do not include sensitive personal information in AI assistant queries beyond what is necessary.
3.9 Notification and Device Information
- Email address (for transactional and notification emails)
- Mobile device push notification tokens (for push notification delivery)
- Telegram account identifier (if you choose to link your Telegram account)
3.10 Authentication Information
- Bcrypt-hashed password (we never store plaintext passwords)
- Google OAuth subject identifier (if you use Google Sign-In)
- JWT refresh tokens (stored server-side, rotated on use)
- Invite tokens (time-limited, single-use)
3.11 Technical and Usage Information
- IP addresses and approximate geolocation derived from IP
- Browser type and version
- Device type and operating system
- Pages visited, features accessed, and timestamps of activity
- Server-side application logs
4. How We Use Personal Information
We use personal information for the following purposes:
| Purpose | Legal Basis (APP) |
|---|---|
| Providing and operating the Platform | APP 6 — primary purpose of collection |
| Authenticating your identity and securing your account | APP 6, APP 11 |
| Sending transactional notifications (levy reminders, poll results, pet approvals, task updates) | APP 6 — directly related to primary purpose |
| Enabling committee communications and document sharing | APP 6 |
| Processing votes, polls, and proxy appointments | APP 6 |
| Generating automated PDF result documents for closed polls | APP 6 |
| Tracking levies, arrears, and financial records | APP 6 |
| Providing the AI assistant feature (with third-party model provider) | APP 6, with disclosure per APP 5 |
| Sending Telegram notifications (if opted in) | APP 6, with your explicit linkage |
| Improving and troubleshooting the Platform | APP 6 — secondary purpose reasonably expected |
| Complying with legal obligations | APP 3, APP 6 |
| Responding to privacy complaints or regulatory requests | APP 12, APP 13 |
We will not use your personal information for direct marketing without your explicit consent.
5. Cookies and Tracking Technologies
The Platform uses the following technologies:
- Session cookies — required for authentication; expire when you close your browser or when your session times out.
- JWT access tokens — stored in memory or secure HTTP-only cookies; expire within a short period.
- Refresh tokens — stored server-side; rotated on each use.
- Analytics — we may use privacy-respecting analytics tools to understand aggregate Platform usage. Where used, these do not individually identify you.
We do not use third-party advertising cookies or cross-site tracking.
6. Disclosure of Personal Information
We may disclose personal information to:
6.1 Within Your Strata Scheme
Personal information is shared with other members of your scheme strictly in accordance with the role-based access controls built into the Platform. For example:
- Contact details are visible to committee members and caretakers, but not to general lot owners.
- Voting records (name + choice) appear in generated result PDFs accessible to scheme members with appropriate permissions.
- Report submitter identities are visible to committee members but not to other lot owners.
6.2 Body Corporate (Your Scheme's Administrator)
Your body corporate's committee executives are the data controllers for scheme-related personal information. They have administrative access to member data within their scheme.
6.3 Service Providers (Sub-processors)
We engage sub-processors who assist us in delivering the Platform. All sub-processors are contractually bound to handle personal information only on our instructions and in accordance with applicable privacy law.
| Sub-processor | Purpose | Data Shared |
|---|---|---|
| Cloud hosting provider | Platform infrastructure | All Platform data |
| S3-compatible object storage | File and document storage | Uploaded files and documents |
| SMTP / SendGrid (or equivalent) | Transactional email delivery | Email address, notification content |
| Google LLC | Google Sign-In authentication | Google account identifier (OAuth) |
| Telegram Messenger Inc. | Telegram notification delivery | Telegram account ID, notification content |
| AI model provider (e.g., OpenAI or Anthropic) | AI assistant feature | Message content, document context excerpts |
| PDF generation library | Automated poll result PDFs | Poll and voter data |
6.4 Legal and Regulatory Disclosure
We may disclose personal information where required by law, court order, or regulatory authority, or where we reasonably believe disclosure is necessary to protect our legal rights, prevent fraud, or ensure the safety of persons.
6.5 Business Transfers
In the event of a merger, acquisition, or sale of all or part of our business, personal information may be transferred to the acquiring entity, subject to equivalent privacy protections.
We do not sell, rent, or trade personal information to third parties for their own marketing purposes.
7. Cross-Border Data Transfers
Some of our sub-processors are based outside Australia (e.g., the United States). Where personal information is transferred overseas, we take steps to ensure the recipient handles it in accordance with the APPs or a comparable standard, including by entering into data processing agreements.
If you are located in the European Economic Area (EEA) or United Kingdom, transfers of personal information to Australia and other third countries are governed by applicable transfer mechanisms (e.g., standard contractual clauses). Please contact us at support@stratapilot.au for further details.
8. Data Retention
We retain personal information for as long as:
- Your account is active on the Platform; or
- The body corporate's subscription is active; or
- Retention is required by law (e.g., financial records under the Corporations Act 2001); or
- It is necessary to resolve disputes or enforce our agreements.
Upon termination of a scheme's subscription:
- Scheme data is retained for 90 days after the subscription end date to allow data export.
- After 90 days, scheme data (including personal information of members) is permanently deleted from production systems.
- Anonymised or aggregated data (with no re-identification risk) may be retained for analytics purposes.
You may request deletion of your personal information at any time (subject to legal retention obligations) — see Section 10.
9. Security
We implement a range of technical and organisational measures to protect personal information:
- Passwords stored as bcrypt hashes (never in plaintext)
- JWT authentication with short-lived access tokens and server-side refresh token rotation
- Role-based access controls enforced at the API level
- File downloads served via short-lived pre-signed URLs (files not proxied through the application)
- Data encrypted in transit via TLS 1.2 or higher
- Data encrypted at rest in object storage
- Asynchronous email delivery with retry logic
- Audit logging of key actions
No security system is impenetrable. If you believe your account has been compromised, contact us immediately at support@stratapilot.au.
In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988.
10. Your Privacy Rights
Under the Privacy Act 1988 and the APPs, you have the following rights:
10.1 Access (APP 12)
You may request access to the personal information we hold about you. We will respond within 30 days. Access may be declined in limited circumstances prescribed by the APPs (e.g., where it would unreasonably impact the privacy of other individuals).
10.2 Correction (APP 13)
You may request correction of personal information that is inaccurate, out-of-date, incomplete, irrelevant, or misleading. You may also update much of your profile information directly within the Platform.
10.3 Deletion
You may request deletion of your personal information. We will comply to the extent permitted by law and not inconsistent with the body corporate's legitimate record-keeping requirements. Note that voting records, levy records, and official meeting documents may be subject to statutory retention requirements.
10.4 Complaints (APP 1)
If you believe we have mishandled your personal information, you may lodge a complaint with our Privacy Officer at support@stratapilot.au. We will acknowledge your complaint within 5 business days and endeavour to resolve it within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the OAIC at www.oaic.gov.au.
To exercise any of these rights, contact: support@stratapilot.au
11. Children's Privacy
The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child's personal information has been provided to us without appropriate consent, please contact us at support@stratapilot.au.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Where changes are material, we will notify scheme administrators by email at least 30 days before the new policy takes effect. Continued use of the Platform after the effective date constitutes acceptance of the updated policy. Previous versions of this policy are available upon request.
13. Contact Us
Privacy Officer Stratapilot Email: support@stratapilot.au Website: www.stratapilot.com.au
For urgent security concerns: support@stratapilot.au
This Privacy Policy covers Australian Privacy Principles 1–13 under the Privacy Act 1988 (Cth). It is intended as a starting point and should be reviewed by a qualified Australian privacy lawyer before commercial use.