Privacy Policy

1. About this Policy

A.A HEMAT-SIRAKY & E RUZDIC, trading as prospect8 (prospect8, we, us or our), provides prospect8, a sales CRM for Australian real estate agencies. This Policy explains how we collect, hold, use and disclose personal information through our web app, our MCP server, our websites, our integrations, our support and related services (the Service). An agency or other business that signs up for the Service is a Customer.

• Legal entity: A.A HEMAT-SIRAKY & E RUZDIC, a partnership
• ABN: 72 439 514 362
• Address: to be added
• Privacy contact: hello@prospect8.io

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and any other privacy law that applies to us or to particular information. Some Privacy Act obligations depend on matters such as an organisation’s turnover and activities, so the Act may not apply to every practice in this Policy; we follow this Policy regardless.

Our Terms of Service set out what Customers and prospect8 are each responsible for.

2. Whose information this covers

This Policy covers personal information about:

• Users: the principals, agents, assistants, property managers and other staff a Customer lets use its workspace;
• Customer contacts: the people an agency deals with, such as vendors, buyers, landlords, tenants, leads, solicitors and suppliers, whose details the agency keeps in prospect8 (section 6 explains our role for this information);
• Business contacts: people at agencies who ask about prospect8, book a demo or deal with us; and
• Website visitors: people who visit prospect8.io.

3. Personal information we collect

Account and contact information

Names, business email addresses, phone numbers, job titles, roles, offices, licence details, sign-in details (including second factors and the identity used for sign-in with Google, Facebook or Microsoft), communications with us and support requests.

Customer contacts and their records

What an agency keeps about the people it deals with: names, contact details, addresses, properties, appraisals, campaigns, enquiries, offers, notes, messages, call records, documents and signatures, consent and opt-out records, and Do Not Call Register check results. People may also give information through pages an agency sends them, such as a signing page, a bank details form, a deposit payment page or an upload page.

AML/CTF identity records

Where an agency carries out customer checks under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth): identity details, dates of birth, identity documents, the results of identity verification, and the results of sanctions and politically exposed person screening.

Sensitive information

We don’t seek sensitive information. Some records an agency keeps, such as identity documents or screening results, may reveal sensitive information. We handle that information only on the agency’s instructions and as the law allows. Customers must not put sensitive information into the Service unless they need it for a lawful purpose and have the authority to do so.

Billing information

Billing contacts, subscription status, invoices, credit purchases, transaction records and the payment method details Stripe makes available to us.

Technical and usage information

When Users use the app: IP address, browser and device details, sign-in times and devices, the pages viewed and actions taken, and diagnostic information. Section 11 describes the product analytics we run in the app. We also keep an activity log of what each User and connected AI assistant does in a workspace, such as records opened, exports and sign-ins, which the Customer can review.

4. How we collect personal information

We collect personal information:

• directly from Users, Customers and business contacts;
• from an agency, which puts its contacts’ information into the Service or imports it from its previous CRM or a spreadsheet;
• from people who use a page an agency sends them, such as a signing or upload page;
• through integrations an agency connects, such as property portals, email and calendar accounts and accounting software;
• from AI assistants a Customer connects over MCP, which read and write data at the Customer’s direction;
• from service providers we use, such as Pricefinder for property data and the Australian Business Register for ABN details;
• automatically, when the app is used, as section 11 describes; and
• from public sources and where the law authorises or requires it.

An agency that gives us information about other people is responsible for having the authority to do so and for giving them any notices the law requires. If an agency holds your information in prospect8, that agency is usually the best first contact about it.

5. Why we handle personal information

We handle personal information to:

• create and manage workspaces and User accounts;
• provide, configure, secure and support the Service, including its AI features and integrations;
• send messages, documents and notifications that Users and the agency ask us to send;
• process subscriptions, credit purchases and payments;
• keep the audit and activity records the Service provides to Customers;
• understand how the Service is used, fix errors and improve it;
• detect and prevent misuse, fraud and security threats;
• communicate with Customers, Users and business contacts;
• handle complaints, enforce our agreements, and establish, exercise or defend legal claims; and
• comply with the law.

If we want to use personal information for a new purpose that isn’t related to these, we will ask for consent where the law requires it.

We may send Customers, Users and business contacts information about prospect8 that is relevant to their relationship with us. You can unsubscribe using the link in any marketing message or by contacting us. We will still send service, security and billing messages where needed.

6. Information we handle for agencies

For information an agency keeps in prospect8 about the people it deals with, including its contacts, their properties, campaigns, messages, documents, signatures and AML/CTF identity records, the agency decides why the information is collected and how it is used. We handle that information on the agency’s behalf and on its instructions, to provide the Service.

The agency is responsible for having the right to collect the information and to contact the people it concerns, including under the Privacy Act, the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth), its AML/CTF obligations and the real estate laws of its state or territory. The agency is also responsible for which Users can see the information, and for its configuration choices. We remain responsible for our own handling of personal information and for the obligations that apply to us directly.

We don’t use an agency’s contacts for our own marketing.

If you want to access or correct information an agency holds about you, or opt out of its messages, contact the agency first. If you contact us, we will refer the request to the agency or work with it to respond.

7. AI and personal information

prospect8’s AI

prospect8 has its own AI: an AI assistant in the app, drafting of messages and documents, and template design. It runs on AI models through OpenRouter, which routes each request to an AI model provider such as Anthropic. When a User asks the AI to do something, the information the task needs, which can include personal information in the workspace, is sent to OpenRouter and the model provider to produce the result.

Each agency decides what the AI may do: act on its own, propose an action for a person to approve, or not act at all. AI output can be wrong, so Users check it before relying on it.

An agency’s own AI assistant

An agency can instead connect its own AI assistant, such as Claude or ChatGPT, to its workspace over MCP. That AI assistant reads and changes workspace data with the access the agency gives it. The information it reads goes to that AI provider under the agency’s own agreement with the provider, not under this Policy. prospect8 isn’t responsible for that provider’s handling of the information.

8. Who we disclose personal information to

We may disclose personal information to:

• the relevant Customer and its authorised Users;
• the service providers that help us run the Service, listed in section 9;
• integration providers an agency chooses to connect, also listed in section 9;
• our professional advisers, insurers, auditors and financiers;
• regulators, courts and law enforcement bodies, where the law authorises or requires it;
• a prospective or actual buyer of, investor in or successor to our business, in a genuine corporate transaction and under appropriate confidentiality protections; and
• anyone else at the direction or with the consent of the Customer or the individual.

prospect8 doesn’t sell personal information and doesn’t disclose it for third-party advertising. If that changes, we will update this Policy first and give any notice, consent or opt-out the law requires.

9. Service providers and integrations

We list every provider that may receive personal information, and where each may process it. A provider handles information under its contract with us or with the agency, and under its own terms and privacy practices.

Providers we use to run the Service

Integrations an agency chooses to connect

These providers receive information only if the agency connects them. We exchange what the integration needs, under the permissions the agency gives. The provider handles the information under its own terms and its agreement with the agency, and agencies should review a provider before connecting it.

10. Payment data

Subscriptions and credit purchases are billed through Stripe. Card details are entered with and held by Stripe; prospect8 doesn’t store full card numbers. We keep billing contacts, subscription status, invoices and payment records needed for accounting, support and disputes. Stripe handles payment information under its own terms and privacy practices.

Payments an agency takes from its own clients, such as deposits, go through the provider the agency connects, under that provider’s terms.

11. Cookies and analytics

Our website

prospect8.io sets no cookies and loads no analytics or tracking scripts. Cloudflare, which serves it, processes visitors’ IP addresses and request details to deliver and protect it.

The app

The app uses cookies to keep Users signed in and to secure their sessions. These are needed for the Service to work.

We run PostHog product analytics in the app, on our own servers in Sydney. It records page views, clicks and other interactions, and records sessions so we can see how the app is used and find problems. What a User types into form fields is masked in recordings, but recordings can include other information shown on screen, such as contact details. PostHog identifies each User by their name and email address, and stores an identifier in a cookie and in the browser’s local storage.

Pages served for agencies

Pages we serve for agencies, such as signing pages and agency websites, use cookies needed for them to work. An agency can add its own tracking and chat tools to its public pages, under its own cookie consent banner; those tools are listed in section 9.

You can block or delete cookies in your browser settings, but parts of the app may then stop working.

12. Storage and security

prospect8’s application, its database (Postgres), cache (Redis), log store and analytics database (ClickHouse), document rendering (Gotenberg), and our self-hosted product analytics (PostHog and Plausible) run on servers in Sydney, Australia. Files such as documents and photos are stored with Cloudflare and may be stored outside Australia. Other providers in section 9 may process information overseas, as section 13 describes.

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure. They include:

• two-factor sign-in, which a workspace can require of all its Users;
• login hours and device limits a workspace can set;
• a fresh check of a User’s second factor before sensitive actions;
• sensitive fields, such as dates of birth, shown masked until a User with access reveals them, with each reveal logged;
• an audit log that is sealed and signed every hour in write-once storage, so a changed or removed entry shows up when the log is checked;
• controls on data leaving the Service, such as export, print and sync permissions, limits on how much a User can read in a day, and alerts for unusual activity; and
• error reports from our servers with personal information removed.

No system is completely secure. Users must keep their sign-in details safe and tell their agency and us promptly about suspected unauthorised access.

13. Cross-border disclosure

prospect8, its service providers and the integrations an agency connects may store, access or process personal information outside Australia. Section 9 lists each provider and where it may process information. In summary:

• our providers in the United States and other countries include Cloudflare, OpenRouter, the AI model providers it routes to (such as Anthropic), Postmark, Twilio, Meta, Google, Unsplash, Pexels, GIPHY, YouTube, Vimeo, browser push services, Sentry, Facebook, Microsoft, Stripe, GitHub and Calendly; and
• integrations an agency connects may process information in the United States, New Zealand and other countries, as the table in section 9 shows.

Before we disclose personal information to an overseas recipient, we take reasonable steps to make sure it handles the information consistently with the Australian Privacy Principles. Depending on the case, these may include assessing the recipient, contractual privacy and security obligations, limiting what we disclose, or consent where appropriate. Integration providers an agency connects set their own processing locations, and agencies should review them before connecting.

14. Retention and deletion

We keep personal information only as long as we reasonably need it for the purpose we collected it for, or a related lawful purpose. How long depends on the kind of information, the Customer’s instructions and settings, whether the workspace is open, legal and accounting requirements, unresolved complaints or disputes, and the time it takes for information to cycle out of backups.

Some records are kept for fixed periods the law requires:

• AML/CTF records are kept for seven years;
• the change history of records, and the sealed audit log, are kept for seven years; and
• trust records are kept for seven years from the ledger’s last entry.

A workspace chooses how long its activity log is kept, within a minimum we set.

When information is no longer needed, we take reasonable steps to delete or de-identify it, except where the law requires us to keep it or it remains in protected backups until they are overwritten.

15. Access, correction and other requests

Subject to the law, you may ask to access the personal information we hold about you, ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading, withdraw a consent you gave us, or opt out of our marketing. Contact hello@prospect8.io. We may take reasonable steps to confirm your identity and authority first.

If we hold the information for an agency, we may refer your request to the agency or work with it to respond. We may refuse or limit a request where the law allows or requires, for example to protect someone else’s privacy, and we will give reasons and tell you how to complain where the law requires. We respond within the time the law requires or, if none applies, within a reasonable time. Making a request is free, although a reasonable charge for access may apply after we tell you about it.

16. Privacy complaints

1. Email hello@prospect8.io with your contact details, the conduct or information concerned and the outcome you want.
2. We will acknowledge your complaint, investigate it fairly and aim to respond within a reasonable time.
3. We may ask for more information or reasonable proof of identity. If the complaint concerns information an agency holds, we may work with that agency.
4. We will explain our response and any further options you have under the law.

If you aren’t satisfied and the Privacy Act applies, you can complain to the Office of the Australian Information Commissioner.

17. Data breaches

If we become aware of suspected unauthorised access to, disclosure of or loss of personal information, we will assess it, take reasonable steps to contain it, preserve the evidence, reduce the possible harm and fix what caused it. We will work with affected Customers and service providers as appropriate.

Where the Privacy Act’s Notifiable Data Breaches scheme or another breach notification law applies, we will assess whether the breach is likely to result in serious harm and notify affected individuals, Customers and the Office of the Australian Information Commissioner as the law requires. Where the breach affects information we hold for an agency, we will tell the agency without undue delay so it can meet its own obligations.

18. Children

The Service is for businesses and isn’t directed to children. A person under 18 must not create a prospect8 account or accept our Terms for a Customer.

An agency may hold information about a child where its real estate work needs it. The agency must have lawful authority to do so and keep only what it needs. We handle that information on the agency’s instructions and never use it to market to children. If we learn that a child’s information was provided unlawfully, we will work with the agency to delete it or otherwise handle it lawfully.

19. Policy updates and external links

We may update this Policy when the Service, our providers, our practices or the law change. We will publish the new version and update its date. Where a change materially affects personal information we already hold, we will give further notice or ask for consent where the law requires it.

Third-party websites linked from ours, and integrations an agency connects, are governed by those parties’ own privacy policies, not this one.

20. Contact us

A.A HEMAT-SIRAKY & E RUZDIC, trading as prospect8
ABN: 72 439 514 362
Address: to be added
Email: hello@prospect8.io