Privacy

Privacy policy

Effective 11 June 2026· Draft pending Australian privacy lawyer review.

Tenwise (“we”, “our”) operates the self-management software at tenwise.com.au. We handle personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). This policy explains what we collect, why, who sees it, and what you can ask us to do with it.

What we collect

We collect different things from landlords and from prospective tenants, because the product treats those roles differently.

From landlords (account holders)

• Email address (used as the sign-in identifier)
• Display name (optional, used to personalise the app)
• Property details you enter (address, attributes, photos)
• Listing data (rent, bond, availability)
• Application decisions and private notes
• Payment instrument metadata (Stripe holds the card itself)
• Your phone and your address for service of notices — the address shown on the tenancy agreement where notices can be served
• If your property is co-owned, the second landlord’s name, email and phone, so they can be named on and sign the agreement
• Service contacts you save (a tradesperson’s name, business, phone, email and licence number)
• Support requests you send us (email, phone, and your message)

From prospects (applicants & enquirers)

• Name, email, phone (and optional message) when you submit an enquiry or RSVP for an inspection
• When you apply: identity, date of birth, employment, income, rental history, references, and any “about you” text you choose to add
• Consent records — the exact text you ticked, when, and the IP address + user-agent at the time of consent
• For any additional adults on your application (co-applicants), the same identity, date of birth, employment, income and rental-history details, each with their own consent
• For people who will live at the property but not sign (occupants), their name and date of birth — including, where the landlord enters them, minors
• References you provide (referee name, contact and what they tell us), recorded with the IP address and user-agent

We do not collect identity documents (driver licence, passport) through Tenwise itself. If the landlord runs a tenancy-database check, that provider may request ID separately; their privacy policy governs that handling.

From tenants (during a tenancy)

• Messages you exchange with your landlord through Tenwise, recorded with the IP address and user-agent
• Maintenance requests, including descriptions and any photos you add (which may show the inside of the home)
• Inspection condition reports and photos, and your rent payment history
• If you ask to sub-let, the proposed sub-tenant’s name, email and your reason

We also log technical data — your IP address and browser/user-agent — for security and to record consent.

Why we collect it

• To run the leasing flow you signed up for
• To prove (to you, the landlord, the tenant, or a regulator) who consented to what, when
• To send transactional email (sign-in, enquiry confirmations, decision notifications)
• To detect and prevent abuse of the public-facing forms
• To meet our record-keeping obligations under tenancy and consumer law

Who we share it with

We share personal information only with the parties below, and only as much as the function requires:

• The landlord sees the applications and enquiries submitted against their listings. This is the whole point of the product.
• Hosting and infrastructure— Neon (PostgreSQL), Vercel or AWS Sydney (hosting), Resend (email), Anthropic (AI ad drafting for landlords; tenant data is never sent), and Stripe (subscription billing). We sign data-processing agreements with each.
• Rent payments— rent is paid by direct bank transfer between the tenant and the landlord, so no payment processor receives the data and Tenwise never holds the money. The landlord’s bank details are shown to the tenant for this purpose.
• Annature— our e-signature provider (an Australian provider), when a lease is signed electronically. It handles the signing and the signing audit trail, including the time, IP address, and a document fingerprint.
• HubSpot(our CRM) — if you join the waitlist or contact us through our support form, the details you provide (such as your name, email, and state) are copied to HubSpot so we can manage your signup and respond. HubSpot stores this in its Australian (AP1) region; HubSpot, Inc. is US-based, and the transfer is covered by a data-processing agreement under which we remain accountable for your information. We use HubSpot only for our own communications with you.
• Tenancy-database providers(TICA, NTD, TRA) and credit-check services — only with your explicit consent at the time of application.
• State rental-bond authorities— only the bond information required by law.
• Government agencies and courts— if required by Australian law or a binding court order.

We do not sell personal information, and we do not share it for third-party marketing.

Where it’s stored

Personal data is stored on infrastructure located in Australia (Sydney) where possible. Some sub-processors (e.g. Resend) operate from other jurisdictions; in those cases we use providers that contractually commit to APP-equivalent handling.

Files such as photos, property documents and signed leases are held in S3-compatible object storage (Cloudflare R2 or Amazon S3), configured to an Australian region where available.

How long we keep it

• Active landlord accounts— for as long as the account is active, plus a reasonable wind-down period (currently 30 days after deletion request, unless you ask for immediate erasure).
• Tenancy records, lease documents, and bond receipts — seven years after the tenancy ends. This is the standard retention period under Australian tax law and most state tenancy legislation.
• Consent records— kept as a version-controlled, append-only audit trail for the life of the related tenancy plus seven years.
• Waitlist signups— removed on request. We are adding automated retention limits so unused signups clear over time.

Your rights under the APPs

You can ask us, at any time, to:

• Show you the personal information we hold about you
• Correct anything that’s wrong
• Delete what we’re not legally required to keep
• Request a copy of your data — landlords can also export their portfolio (enquiries, applications, rent ledger) as CSV at any time

Email privacy@tenwise.com.au and we’ll respond within 30 days (usually within seven business days).

Cookies and tracking

Tenwise uses a small number of cookies, all functional:

• authjs.session-token(and related) — signs you in
• tenwise_saved— remembers which listings a tenant has shortlisted (no account required)
• tw_signup_consent— carries your marketing opt-in choice through sign-up
• tw_ref— remembers a referral link for up to 60 days so a referral can be credited
• tenwise-preview— grants temporary preview or inspection access

We don’t run our own third-party analytics or advertising cookies on the public site. If you join the waitlist and your browser already carries HubSpot’s cookie from elsewhere, the waitlist form may read it so we can link your enquiry — otherwise we don’t track you across sites.

So you can resume a part-finished rental application, we save your draft answers in your browser’s local storage for up to seven days. That draft stays on your device — it isn’t sent to us until you submit, and it never includes your consent ticks or uploads.

Security

Data is encrypted in transit (TLS). At-rest encryption is provided by our database and storage hosts, and in-app assistant conversations are additionally encrypted at the application layer. Sensitive documents — screening reports, signed lease PDFs and property documents — are kept in a private store served only through authenticated access, never by a public URL. Internal access to production data is least-privilege and audited, and we are progressively adding application-level encryption to other sensitive fields.

If we ever experience a data breach that meets the threshold under the Notifiable Data Breaches scheme, we will notify affected users and the OAIC within the statutory timeframe.

Automated decisions

We don’t make automated decisions about applicants. Tenant screening provides information to the landlord; the decision to approve or decline an application is always the landlord’s.

Children

Tenwise is not directed at people under 16, and applicants must be at least 16 (the floor used by most state residential-tenancy legislation). A landlord may record the name and date of birth of a minor who will live at the property as an occupant; we hold that information on the landlord’s behalf.

Changes to this policy

We’ll update this page if we materially change how we handle personal information — and we’ll email existing account holders before the change takes effect.

Contact

Privacy questions, requests, or complaints: privacy@tenwise.com.au. If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner.