Privacy Policy

Who we are

Unpack Property is operated by Gustavo Specht (ABN 11 827 021 139), a sole trader in Australia.

This policy explains what personal information we collect, why we collect it, how long we keep it, who we share it with, and your rights under the Australian Privacy Act 1988. If you visit this site from the European Union or United Kingdom, see the European and UK visitors section below.

Information we collect

Calculator inputs

When you use our calculators and tools, you may enter financial information such as income, expenses, property prices, and loan details. The calculations run in your browser. The exact figures you enter are never sent to our servers or saved by us.

If analytics is on (see Analytics below), Google Analytics receives rounded ranges only, for example an income band of $80,000 to $100,000 or a price band of $700,000 to $800,000, so we can see which tools are used and how. Calculator areas are hidden from Microsoft Clarity recordings.

Newsletter subscription

If you subscribe to our newsletter, we collect your email address. Your email is stored by our email provider (Resend) and used solely to send you updates about our tools and Australian first home buyer information. You can unsubscribe at any time using the link in any newsletter email.

Proof of consent

When you subscribe, we also keep a record that shows you agreed to receive email, as spam and privacy law require. This record holds a scrambled form of your email address and IP address (a one-way keyed hash, so the record does not hold either in readable form), the date and time, your country, the page and form you subscribed from, and which version of the consent wording you saw. It is removed when you unsubscribe.

Contact and partner form submissions

When you submit the contact form, we send your name, email, topic, subject, and message via Resend to our email inbox. The partner enquiry form also sends your business name, role, website (if given), and the details you choose to share about your interests, timeline, team size, and client volume. Your email is set as the reply-to address so we can respond directly. Messages are kept in our inbox only as long as we need them to deal with your enquiry.

Server logs and abuse prevention

Every request to this site passes through our host, Vercel, which processes your IP address to deliver the page and keeps short-lived technical logs under its own retention settings.

To prevent abuse, we briefly store your IP address in Upstash Redis when you use the newsletter, contact, or partner forms, the admin login, or the automatic country lookup that runs when a page first loads. These entries are not linked to your email, name, or any other identifier, and they delete themselves after between about 2 minutes and 2 hours, depending on the form.

Analytics

If you are in the European Union, European Economic Area, or United Kingdom, or we cannot tell where you are, no analytics loads until you click Accept on the cookie banner. Everywhere else, analytics is on by default. Anyone can turn it off at any time with Cookie preferences in the footer, which turns off all of the services below.

We use Google Analytics 4 to understand how visitors use our site. Google Analytics collects:

• Pages visited and time spent on each page
• Device type, browser, and operating system
• Approximate geographic location (city level)
• Referral source (how you found our site)

Google Analytics uses cookies to tell visits apart. When you use a calculator, it receives rounded ranges only, never the exact figures you enter, and the page address we report leaves out anything after the page name (such as the details in a shared link). We only look at this data in aggregate and do not use it to identify you. You can also opt out using the Google Analytics Opt-out Browser Add-on.

Microsoft Clarity. We also use Microsoft Clarity to see how people use our pages, so we can find the parts that are confusing. Clarity records clicks, taps, scrolling and how far down a page you read, and uses this to build heatmaps and playbacks of visits. Calculator figures and anything you type into a form are hidden from these recordings. Clarity uses cookies to recognise a returning browser. Microsoft processes this data in the United States and other countries under the Microsoft Privacy Statement.

Vercel Web Analytics and Speed Insights. Our host, Vercel, also counts page views and measures how quickly pages load. These tools use no cookies. They see the page address (without the details in a shared link), your browser, device type, and approximate country, and they follow the same analytics choice as Google Analytics and Clarity.

What we do not collect

We do not collect tax file numbers, Medicare numbers, driver licence numbers, passport numbers, health information, biometric data, or any other sensitive information under the Australian Privacy Principles.

How we use your information

• Newsletter emails: to send updates you have opted into
• Contact form: to reply to your message
• Rate limiting: to prevent abuse of forms, the country lookup, and admin endpoints
• Country lookup: to decide whether to show the cookie banner or the Australia-only notice, and to pre-select your state in the calculators
• Analytics: to understand usage patterns and improve our tools

We do not sell, rent, or share your personal information with third parties for marketing purposes.

Cookies and local storage

This is everything the site itself can keep in your browser. None of it is advertising, and none of it holds your calculator figures, name, or email.

Your preferences (kept until you clear your browser storage)

• Theme (unpackproperty-theme, localStorage): light or dark mode. Saved for every visitor so each page opens in the same theme; light is the default.
• Theme version (unpackproperty-theme-version, localStorage): a marker so a one-off theme reset after a site redesign runs only once. An older name for the theme setting, helppeople-theme, is moved across and deleted if your browser still has it.
• Your state (unpackproperty-state, localStorage): the Australian state you last picked in a calculator, so the next one opens on it. Saved only when you pick a state.
• Australia-only notice (unpackproperty-au-notice-dismissed, localStorage): remembers that you closed the notice shown to visitors outside Australia.
• Email updates box (unpackproperty-result-capture-dismissed and unpackproperty-result-capture-subscribed, localStorage): remembers which calculators you closed the email updates box on, and that you already signed up, so we don't ask again.

Your cookie choice

• Cookie consent (unpackproperty-consent, localStorage): whether you accepted or rejected analytics. It stays until you click Cookie preferences in the footer, which clears it and shows the choice again. If we add a new analytics service, we ask again anyone who had accepted.

This visit only (cleared when you close the tab)

• Your country and approximate state (unpackproperty-country, sessionStorage): see below.
• Update recovery (chunk-reload-at and chunk-bust-at, sessionStorage): a time stamp set only if we update the site while your tab is open, so the page reloads once instead of showing a blank screen.

Admin only

• Admin session (hp_admin_session): an HTTP-only Secure SameSite=Strict cookie scoped to /api, set only after the site operator logs in to /admin. Expires within 1 hour and is cleared on logout. Not used for tracking.

Analytics cookies (only when analytics is allowed)

• Google Analytics (_ga, _ga_*): set by Google to tell visits apart. They last up to 2 years.
• Microsoft Clarity (_clck and _clsk on this site, CLID on clarity.ms): set by Microsoft to recognise a returning browser and to group the pages of one visit together. _clsk lasts a day; _clck and CLID last up to a year.

If you choose Reject, these analytics cookies are not set, and the ones this site can reach are deleted. Cookies held on Microsoft's own domains can only be cleared in your browser settings.

Your approximate state

To pre-select a state in the calculators before you pick one, the site uses the approximate Australian state your internet connection comes from, as reported by our hosting provider. Your country and state are not saved on our servers (the short-lived abuse-prevention entry described above holds only your IP address). They are kept in your browser for the current visit only and cleared when you close the tab. The site never asks for your device location. If you pick a state yourself, your pick is used instead.

Overseas recipients

We use the following overseas service providers to operate this site. We have taken reasonable steps to satisfy ourselves that each operates under privacy protections at least equivalent to the Australian Privacy Principles.

A more detailed register is available on request from privacy@unpackproperty.com.au.

Your rights

Under the Australian Privacy Act 1988, you can:

• Access your personal information. Email privacy@unpackproperty.com.au with the subject line "Access request" and we will respond within 30 days.
• Correct inaccurate or out-of-date information. For newsletter subscriptions, the simplest path is to unsubscribe using the link in any email and resubscribe with the correct address. For other corrections, email us with subject "Correction request".
• Delete your personal information. For newsletter subscriptions, the unsubscribe link removes you immediately. For other requests, email us with subject "Deletion request" and we will delete what we can within 30 days. We cannot delete records held by third parties (such as Google Analytics) directly but will help you find the right path with each.
• Opt out of analytics with Cookie preferences in the footer (this turns off Google Analytics, Microsoft Clarity, and Vercel Web Analytics and Speed Insights), the Google Analytics Opt-out Browser Add-on or your browser's tracking settings.

Complaints

If you believe we have mishandled your personal information, contact us at privacy@unpackproperty.com.au and we will respond within 30 days. If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au/privacy/privacy-complaints.

Data breaches

We keep the amount of personal information we hold deliberately small, which limits the impact of any incident. If a data breach happens that is likely to cause serious harm, we will assess it promptly and, where the Notifiable Data Breaches scheme requires it, notify the Office of the Australian Information Commissioner (OAIC) and the people affected as soon as practicable, along with the steps you can take in response.

Data retention

• Newsletter subscriber email: until you unsubscribe.
• Newsletter consent record (a one-way hash of your email and IP address, plus your country and the page you subscribed from): up to 7 years as proof of consent, or removed when you unsubscribe.
• Contact and partner form messages: as long as we need them to deal with your enquiry.
• Abuse-prevention IP entries: about 2 minutes to 2 hours, then deleted automatically.
• Admin session cookie: up to 1 hour from issue.
• Admin login audit log (a one-way hash of the IP address and browser, used only by the site operator to spot suspicious logins): 30 days.
• Google Analytics user-level data: 14 months (the longest retention available without a paid Google Analytics tier).
• Microsoft Clarity visit recordings: 30 days, except recordings we mark as favourites and a random sample Microsoft keeps for up to 9 months. Clarity heatmaps: up to 9 months.
• Exact calculator inputs: never stored by us.
• Browser storage: stays on your device until you clear it. Items marked "this visit only" end when you close the tab.

No automated decisions

Our calculators, quizzes, and comparison tools provide indicative information only. They do not make automated decisions about you, your eligibility, or your financial position. The official authorities (state revenue offices, Housing Australia, lenders) make all final determinations.

European and United Kingdom visitors

If you access this site from the European Union, European Economic Area, or United Kingdom, the General Data Protection Regulation (Regulation (EU) 2016/679) and UK Data Protection Act 2018 apply to our processing of your personal data.

Controller

Unpack Property is operated as a sole trader by Gustavo Specht. We have no establishment in the EU or UK. We do not have a designated EU representative under Article 27 on the basis that our processing is occasional, does not include large-scale processing of special category data, and is unlikely to result in a risk to your rights and freedoms.

Lawful basis for each processing activity

• Newsletter subscription: your consent (Art. 6(1)(a)). Withdraw via the unsubscribe link in any email.
• Contact form: legitimate interest in responding to your enquiry (Art. 6(1)(f)).
• Rate limiting using IP address: legitimate interest in site security (Art. 6(1)(f)).
• Country lookup for the cookie banner and Australia-only notice: legitimate interest in showing the right notices (Art. 6(1)(f)).
• Analytics (Google Analytics, Microsoft Clarity, Vercel Web Analytics and Speed Insights): your consent given via the cookie banner (Art. 6(1)(a)).

Your rights under GDPR

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), object (Art. 21), withdraw consent.
• Not be subject to automated decisions (Art. 22). See the no-automated-decisions section above.

To exercise any of these rights, email privacy@unpackproperty.com.au with the subject "GDPR request". We respond within one month under Art. 12(3); this may be extended by two further months for complex requests with written notice.

Complaints

• European Union: the data protection authority in your member state. List at edpb.europa.eu.
• United Kingdom: the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

International transfers

Our processors (Resend, Upstash, Vercel, Google, Microsoft) process data in the United States and other countries. We rely on EU-US Data Privacy Framework certifications and Standard Contractual Clauses as required. A list of processors and the transfer mechanism for each is available on request.

Children

This site is not aimed at children. We do not knowingly process data of anyone under 16. If you believe a child under 16 has provided us personal data, email privacy@unpackproperty.com.au and we will delete it.

Changes to this policy

We may update this privacy policy from time to time. Material changes will be reflected on this page with an updated "Last reviewed" date. Earlier versions are available on request from privacy@unpackproperty.com.au.

Contact

Privacy enquiries and requests (including GDPR / UK GDPR): privacy@unpackproperty.com.au
Security and responsible disclosure: security@unpackproperty.com.au

Our security contact details are also published at /.well-known/security.txt.