Privacy Policy

1. Scope

This policy applies to personal information we collect in connection with PurpleGem.au. It does not apply to third-party websites or services that we do not control (for example, your interactions with your bank or super fund outside our Service), though we explain below when we use subprocessors such as Google Firebase.

2. What personal information we collect

The types of information we collect depend on how you use the Service. They may include:

• Identity and account data: such as name, email address, and authentication identifiers created when you register or sign in (including identifiers issued by our authentication provider).
• Profile and financial inputs: information you enter into forms, calculators, or profile fields — for example age, income ranges, expenses, superannuation balances, property details, debts, and other fields relevant to the tools you use.
• Technical and usage data: such as browser type, device type, approximate location derived from IP address, timestamps, and diagnostic data needed to operate and secure the Service.
• Communications: content you send to us (for example support requests or feedback).

Some information you provide may be sensitive information under the Privacy Act (for example, information about your finances or circumstances). We only collect sensitive information with your consent (which may be implied by your voluntary submission through the Service) and only where reasonably necessary for the functions you have requested.

3. How we collect personal information

We collect personal information:

• directly from you when you register, complete forms, use tools, upload content, or contact us;
• automatically when you use the Service (for example server logs and security records); and
• via our service providers when they process data on our behalf in accordance with this policy (for example Firebase Authentication for sign-in).

4. Local storage on your device

Some features may store information locally in your browser (for example using localStorage or similar technologies) so that drafts or preferences persist between visits on that device. This data remains on your device unless you clear it or use functions we provide to reset data. It is not transmitted to us solely by virtue of being stored locally; it may be synced to your account or our servers when you save or sign in, as described elsewhere in this policy.

5. Why we collect and use personal information

We use personal information for purposes that include:

• providing, operating, and improving the Service and its features;
• authenticating users and maintaining account security;
• generating estimates, reports, comparisons, and saved snapshots that you request (on an illustrative or educational basis as described in our Terms);
• communicating with you about the Service, security, or policy updates;
• complying with legal obligations and responding to lawful requests;
• detecting, preventing, and addressing fraud, abuse, or technical issues;
• exercising our rights under the Terms — including modifying, restricting, or deleting data where permitted by law.

Where the Privacy Act requires a secondary purpose, we will only use or disclose your information for that purpose where permitted by law (for example with your consent or where you would reasonably expect the use).

6. No guarantee of ongoing access or retention

We take reasonable steps to operate the Service securely, but we do not guarantee uninterrupted access to your account or any particular dataset. As described in our Terms, we may modify, delete, suspend, or discontinue features or the Service, and we may delete or restrict accounts or data for operational, security, legal, or business reasons.

You should keep your own records and backups of information that matters to you. Do not rely on the Service as your sole repository of financial or personal records.

7. Disclosure of personal information

We may disclose personal information to:

• Service providers who assist us in hosting, authentication, databases, storage, analytics, email delivery, or security — including Google Firebase (Authentication, Firestore, Cloud Storage, and related infrastructure) and other subprocessors we engage. These providers may process data in Australia, the United States, or other countries where they operate data centres.
• Professional advisers (such as lawyers or insurers) where required for our legitimate business purposes.
• Law enforcement or regulators when required or authorised by law.

We take reasonable steps to ensure overseas recipients handle personal information in a manner consistent with the APPs where required (including through contractual safeguards where appropriate).

8. Security

We implement technical and organisational measures appropriate to the nature of the information we hold, including access controls, encryption in transit where supported, and reliance on reputable cloud infrastructure. No method of transmission or storage is completely secure; we cannot guarantee absolute security. You should protect your account credentials and devices.

9. Retention and deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this policy and our Terms, including legal, accounting, and reporting requirements. We may delete or de-identify information earlier where we discontinue features, terminate accounts, wind down services, or where retention is no longer needed.

Backup or archival systems may retain residual copies for a period despite deletion requests; we take reasonable steps to overwrite or purge data in accordance with our practices and applicable law.

10. Access, correction, and complaints

Under the APPs, you may request access to the personal information we hold about you and ask that we correct inaccurate, out-of-date, incomplete, or misleading information. You can update much of your profile data directly in the Service where that feature is available.

If you wish to make a formal request or complaint, please contact us using the details on purplegem.au. We will respond within a reasonable period. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Nothing in this policy limits any non-excludable rights you may have under the Privacy Act or other applicable law. Our Terms describe limits on the Service itself (including availability of features and data export) that operate alongside your privacy rights.

11. Notifiable data breaches

If we become aware of unauthorised access, disclosure, or loss of personal information that is likely to result in serious harm, we will assess the incident and comply with the Notifiable Data Breaches scheme under the Privacy Act, including notification to affected individuals and the OAIC where required.

12. Children

The Service is not directed at individuals under 18. We do not knowingly collect personal information from children. If you believe we have collected such information, please contact us so we can delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. The revised policy will be posted on this page with an updated “Last updated” date. Where changes are material, we will take reasonable steps to notify you. We encourage you to review this policy periodically.

14. Contact

For privacy questions or requests, contact PURPLE NEXUS PTY LTD (ABN 43 693 813 160) using the details published on purplegem.au (or as otherwise provided in the Service).