Privacy policy

1. Owners' information about other people

Owners use Leasii to manage their own tenancies, so much of the information about tenants, applicants and trades is entered by, or collected for, the owner. The owner decides what to collect and why, and must have a lawful reason to collect it and tell the people concerned. We handle that information to provide Leasii to the owner, under this policy, and we don't use it for our own purposes beyond running and securing Leasii.

If you're a tenant or applicant and have questions about why a landlord has your information, ask them first. You can also contact us.

2. What we collect

• Account details: your name, email address, phone number, password (stored only in a form that can't be reversed), two-step verification settings, and the consents you've given and when.
• Owners: the owner's legal name and type (person, company, trust or SMSF), ABN or ACN, contact details, the bank account rent is paid into, and team members and their roles.
• Properties and tenancies: addresses, property details and photos, leases, bonds, notices, inspection reports and photos, repairs, compliance records, rent ledgers, receipts, and documents the owner uploads.
• Tenants: names, contact details, emergency contacts where given, the tenancy and rent record, messages, and anything the tenant uploads, such as repair photos.
• Applicants: the application and renter profile, including identity and income documents and references the applicant chooses to provide, and the results of any checks the applicant has agreed to.
• Identity checks: owners verify their identity once before their properties go live, and applicants verify theirs if an owner asks. Our identity verification provider, Didit, checks a photo of your driver licence or passport and a short video selfie, to confirm the ID is genuine, that you're a real person, and that your face matches the photo on the ID. We keep only the result: whether it passed, the name on the ID, your year of birth, the type of ID and the country that issued it, whether the liveness and face match checks passed, and Didit's reference for the check. We don't keep your ID images, your selfie or your full date of birth.
• Trades and partner businesses: business name, ABN, contact details, licences and insurance, quotes, invoices and job reports.
• Payments: for owners' Leasii fees, a token from our payment provider and the card's last four digits and expiry (never the full card number); invoices and credit. For rent, the payments the owner records or matches from a bank statement they upload. We don't take or hold rent. If a tenant sets up direct debit or PayTo for rent, they give their bank account details to Stripe directly, on Stripe's page, for the owner's own Stripe account. We keep only Stripe's references for the arrangement (such as the mandate), the account's last 4 digits and BSB, and the amount, date and outcome of each debit.
• Communications: messages in Leasii, and every email Leasii sends or receives for an owner, in full, including replies.
• Electronic signatures: when you sign or decline a document in Leasii, the evidence of it: each step you take and when (opening the link, confirming who you are with a one-time code or your two-step sign-in, agreeing to sign electronically, opening the document, signing or declining), your IP address and browser and device details for each step, the signature you adopt (your typed name, or an image of the signature you draw), initials if asked, and any reason you give for declining.
• Technical information: sign-in times, IP addresses (for example, when you accept these policies or sign a lease), devices you've turned notifications on for, and an audit log of changes made in Leasii.

Sensitive information: an identity check uses biometric information (your face) to verify you, which is sensitive information under the Privacy Act. We only collect it with your express consent, which we ask for on its own screen before the check starts, and we use it only to verify your identity. Apart from that, we don't ask for sensitive information such as health or racial information. Please don't upload it unless you need to, for example a document a tribunal requires.

3. How we collect it

• From you, when you sign up, fill in forms, upload files or send messages.
• From owners and their team, about their tenants, applicants and trades.
• From tenants, applicants and trades who use Leasii with an owner.
• From bank statements an owner uploads to match rent payments.
• From our service providers, such as delivery results for emails we send.
• Automatically, through cookies and logs, when you use Leasii.

4. Why we use it

• To provide Leasii: running accounts, tenancies, leases, notices, inspections, repairs, rent records and receipts, and sending the emails and notifications people need.
• To keep records as evidence, because tenancy matters can end up before a tribunal, and to meet our legal and tax obligations.
• To keep Leasii and its users secure, including preventing fraud, such as attempts to change where rent is paid, and checking the identity of owners before their properties go live and of applicants when an owner asks.
• To fill in a tenancy's details from a lease an owner uploads, when they ask Leasii to read it. The owner checks every detail against the lease before saving it.
• To bill owners for Leasii plans.
• To answer support requests. Our staff only see an owner's records when the owner gives them access for a support request, or when the law requires it.
• To improve Leasii, using information that doesn't identify you where we can.

If you don't give us information we need, we may not be able to provide some features. For example, you can't sign in without a confirmed email address.

5. Automated decisions

Some decisions about you are made by Leasii's software on its own, following set rules, and for others the software does something that helps a person decide. This section explains what information is used, which decisions are automated, what they can mean for you, and how to ask a person to look at one again.

Leasii doesn't decide who rents a home. Owners choose their tenants. We don't score, rank or rate applicants, and Leasii never picks one applicant over another.

The information used

• Account and sign-in details: your name, email address, role, failed sign-in attempts and two-step and signing codes.
• Identity checks: the result of your check from Didit, the name on your ID compared with the name in Leasii, and the number of checks declined recently. Didit's check uses biometric information (your face), which is sensitive information.
• Owners and properties: the owner's legal name, property addresses, whether proof of ownership has been checked, the plan and whether payments for it succeeded, and the bank account rent is paid into.
• Rent: the rent, due dates, payments recorded or matched from a bank statement, the arrears balance and how many days overdue it is, payment plans, and the outcome of direct debits.
• Applications: what the applicant gave in their application, such as income, number of occupants, move-in date and any rent offered, and the rules of the property's state or territory.
• Email delivery: whether emails to an address bounced or were reported as spam.

Decisions made automatically

No person is involved in these when they happen:

• Signing in: after 5 failed attempts at a password or two-step code, an account is locked for 15 minutes. Leasii staff roles, and owner team roles the owner chooses, can require two-step verification: if yours does, you can't use the rest of Leasii until it's set up. When you sign a document, 5 wrong codes lock signing for 15 minutes, and only 5 codes can be sent an hour.
• Identity checks: Didit decides whether your ID is genuine, whether you're a real person and whether your face matches the photo on the ID. If Didit approves the check and the name on your ID matches the name you gave Leasii (we ignore capitals, accents, punctuation, titles, middle names and the order of names), you're verified automatically. After 3 declined checks in 30 days you can't start another one and need to contact us. If Didit later changes its decision, Leasii follows it, unless our staff have already decided the check. A check that isn't finished within 8 days expires. If an applicant verified in the last 12 months, another owner who asks sees that result instead of a new check.
• Fraud flags: Leasii raises a flag for our trust and safety team when the name on an ID doesn't match at all, when a second identity check is declined within 30 days, when an owner changes the bank account their rent is paid into, or when a property's address has already been verified for another owner. A flag doesn't block anything by itself: a person reviews it.
• Changing where rent is paid: when an owner changes the bank account their rent is paid into, the new account takes effect after 3 days, and their tenants who use Leasii are told then. In the meantime the owner's team is told and can stop the change.
• Properties and plans: a property can't be used beyond adding it until its proof of ownership has been checked and a plan covers it. If a payment for a plan fails, we try again every 3 days; if it's still unpaid 14 days later, the paid features for the owner's properties stop until it's paid. These include the automatic rent reminders and online rent payments for their tenants. Promotions and referral credit are applied automatically under their conditions.
• Emails we stop sending: if emails to an address bounce permanently or are reported as spam, Leasii stops sending emails to it, except legal notices and security emails. Marketing goes only to people who have agreed to it.
• Rent: Leasii works out what rent is due and how many days a tenancy is in arrears. If an owner turns on rent reminders, Leasii emails the tenants on the days the owner chose (unless a payment plan is in place), and the last reminder says a formal notice may follow. When an owner uploads a bank statement, a payment whose description has exactly one tenancy's payment reference is recorded as rent for that tenancy. A rent increase notice that has been served changes the rent on its start date. For direct debits, a debit that can't be taken within 3 days of its due date is cancelled, a failed debit isn't tried again and the payment is reversed, and some bank errors end the direct debit, so the tenant needs to set it up again. A payment plan is marked complete once the arrears are paid.
• Applying for a home: Leasii applies the rules of the property's state or territory, such as one application per home for each person, leaving out questions the rules don't allow, and limits on rent offers and holding deposits. When an applicant accepts an owner's offer, the other applications for that home are marked unsuccessful and those applicants are told, because the home is no longer available.
• Checking owners' actions against the law: Leasii won't let an owner serve a notice that breaks the rules it knows for their state, such as notice periods, entry times and how often rent can be increased, or hand over the keys before the compliance checks the state requires before move-in are recorded. Where a state's rules say a tenant's request is treated as approved if the owner doesn't answer in time, Leasii records it as approved.
• Keeping and deleting information: information is erased automatically when its retention period ends (see How long we keep it), unless a legal hold applies. Unsuccessful applications are deleted after the period the state's rules allow.
• Partner businesses: a partner can't be booked once its insurance, or for an agency its licence, has expired, and an agency's listings on property websites are taken down.

Decisions a person makes with help from the software

• Identity checks that need a person: if Didit approves a check but the name only partly matches or doesn't match, or Didit is still reviewing it, our trust and safety team decides whether you're verified.
• Proof of ownership: once the owner has sent their documents and verified their identity, our staff check them. Leasii shows our staff possible warning signs, such as an account name that doesn't resemble the owner's legal name, or an address already verified for another owner. Our staff make the decision.
• Choosing a tenant: Leasii may show the owner notes comparing an application with the owner's own criteria, such as rent as a share of the income the applicant gave, the number of occupants, or the move-in date. If the owner orders a tenancy database check, we show the findings the provider returns and leave out any score, rating or pass or fail result in them, though the provider's own report, which the owner can open, may include its rating. The owner decides.
• Reading a lease: when an owner asks Leasii to read a lease they upload, an AI model fills in the tenancy's details. The owner checks each one against the lease before saving it.
• Joint decisions by owners: where an owner requires their approvers to agree to something, such as choosing a tenant, a request is declined once enough approvers say no, and closes if nobody acts in time. A person still has to go ahead with anything approved.

Asking for a person to look again

If you think an automated decision about you is wrong, email support@leasii.com.au or, if you're signed in, ask under Settings › Support. Tell us which decision it was and why you think it's wrong. A member of our team will review it, and tell you what we found and what we've done.

These are the outcomes our staff can review and change. Each change is made by a named member of staff whose role allows it, is recorded in our audit log with the reason and any evidence they relied on, and we tell you what we changed and why.

• Identity checks (trust and safety team): decide a check where the name doesn't match or Didit is still reviewing it; verify you after a declined or expired check, once we've reviewed other evidence of who you are, such as an ID document sighted on a video call; and reset the limit of 3 declined checks in 30 days so you can try again. A staff decision stands, even if Didit later changes its own.
• Changing where rent is paid (trust and safety team): stop a flagged change to the account rent is paid into during its 3-day hold, so it doesn't take effect and tenants aren't told, and release it once we're satisfied. The owner is told either way.
• Emails we stopped sending (support team): start sending email to an address again after a bounce or spam report, once we've confirmed the address with you another way. If you unsubscribed from marketing, only you can opt back in.
• Signing in (support team): unlock your account after too many wrong passwords. You can also wait 15 minutes or reset your password.
• Plans (billing staff): extend the 14-day grace period after a failed payment, or restore a plan that lapsed because of one, for a stated period of up to 60 days at a time.
• Proof of ownership and fraud flags: our staff can verify or reject proof of ownership, and clear a fraud flag.

Our staff can't change the rules of your state or territory that Leasii applies, such as notice periods, questions an application can't ask or how long applications are kept, and they can't change an owner's decision. If a decision was made by an owner using Leasii, such as choosing a tenant, sending rent reminders or recording a payment, ask the owner first. We can tell you how Leasii worked.

6. Who we share it with

We don't sell personal information. We share it only as follows:

• The people you work with in Leasii: for example, an owner's team sees their tenancies; tenants see their own tenancy, lease, rent record, notices and receipts; trades see the jobs sent to them; a partner agency an owner hands a property to sees that property's records.
• Other people signing the same document: the certificate of completion, sent to everyone who signs, lists each signer's name, email address (a landlord's is partly hidden), how they confirmed who they are, IP address, browser and times, and their signature. Other than that, signers see each other's names but not their email addresses.
• Service providers who run Leasii for us: Microsoft (hosting, storage and our email mailboxes), Amazon Web Services (sending email), Stripe (owners' card payments) and Didit (identity checks). For online rent payments, we also send Stripe, for the owner's own Stripe account, the tenant's name and email address and the amount and dates of each debit. They may only use the information to provide their services to us.
• Reading uploaded leases: when an owner asks Leasii to read a lease they upload, the lease file, which includes the names and contact details of the people in it, is sent to Claude, an AI model made by Anthropic, running on Amazon Bedrock (Amazon Web Services) in Australia. Only the lease is sent, nothing else about the owner or tenants. Amazon processes it only to read it for us: it doesn't keep the lease after reading it or use it to train models, and Anthropic doesn't receive it.
• Identity check results: Leasii's staff see the result of an owner's identity check, to check their properties. When an owner asks an applicant to verify, the owner sees whether the applicant's identity was verified, whether the name on the ID matches the application and whether the liveness check passed, never the ID or photos. For 12 months after an applicant verifies, another owner they apply to who asks sees the same result.
• Push notification services: if you turn on notifications on a device, the notification passes through your browser maker's push service (such as Apple, Google or Mozilla).
• Accounting software an owner connects: if an owner chooses to connect their own Xero or MYOB account, Leasii sends it the owner's rental income and expenses: amounts, dates, categories, the property's address, payees of expenses, and Leasii's own invoices to the owner. Descriptions give the property and date, not tenants' names. Xero or MYOB then holds that information under the owner's own agreement with them and their privacy policy. The owner can disconnect at any time; what was already sent stays in their books.
• Tenancy database providers: when an owner orders a tenancy database check, such as through the National Tenancy Database, and the applicant has agreed, we send the provider the applicant's name, date of birth, contact details and current address, and keep the findings it returns with the application.
• Others an owner chooses: for example, when an owner serves a notice, books a partner service, lodges documents, or gives a tenant notice of a proposed tenancy database listing. Leasii doesn't run a tenancy database.
• When the law requires or allows it: for example, to a court, tribunal, regulator or law enforcement body, or to prevent serious harm.
• If our business changes hands: to a buyer, who must handle it under this policy.

7. Where it's stored

Leasii's database and files are stored with Microsoft Azure in Australia (the Australia East region). Emails are sent through Amazon Web Services in Sydney, and leases owners ask Leasii to read are read by Amazon Web Services in Australia (Melbourne or Sydney).

Some of our providers may access or process information outside Australia, for example for support or security, or as part of their global services. Didit, which does identity checks, has offices in Spain and the United States; it stores verification data, including ID images and the selfie, in the European Union (Ireland), and some of its own service providers are in the United States. Stripe processes card payments and online rent payments and may handle payment information in the United States and other countries. Push notification services are run by browser makers and may be overseas. If an owner connects Xero or MYOB, those providers may store and process the information Leasii sends them outside Australia, as their own privacy policies and terms describe. We choose providers that protect information to a standard comparable with the Australian Privacy Principles.

8. How we protect it

• Information is encrypted in transit, and stored data is encrypted at rest. Certain sensitive fields are also encrypted inside the database.
• Each owner's records are kept separate, and the database itself stops one owner's records being read by another.
• People only see what their role allows. Changes are recorded in an audit log, and key records, such as messages, can't be edited or deleted.
• Passwords must be at least 12 characters, accounts lock after repeated failed sign-ins, and two-step verification is available to everyone and required for some roles.
• Files uploaded by tenants, applicants and trades can be checked for malware before they're served.

No system is perfectly secure, but we take reasonable steps to protect information from misuse, loss and unauthorised access.

9. How long we keep it

We keep information while it's needed for the purposes above and for as long as the law requires. Typical periods are:

• tenancy records, notices and emails about them, and rent receipts: 7 years after they're created or the tenancy ends;
• signing evidence, including signature images and the certificate of completion: as long as the signed document it belongs to;
• sign-in and security emails, such as verification codes: 1 year;
• unsuccessful rental applications: deleted after the period the rules allow (90 days unless a state's rules differ), unless the applicant agrees to us keeping them longer;
• identity check results: for owners, 7 years after the check; for applicants, 12 months, or as long as an application the result was shared with is kept, if that's longer. Didit keeps the ID images and selfie only for the limited period set in our Didit account, and then deletes them;
• downloads of your data you request: 7 days;
• a lease uploaded to be read, and what was read from it: 14 days, unless the owner adds the tenancy, when they're kept with its records.

When a period ends, the personal information is erased or deleted, unless it's subject to a legal hold, such as a dispute before a tribunal. Some records are kept with the personal details removed so ledgers and audit trails still add up.

10. Cookies

We only use cookies Leasii needs to work. We don't use advertising or tracking cookies.

• Sign-in: keeps you signed in.
• Trusted device: if you choose it, remembers a device for 30 days so it doesn't ask for a two-step code each time.
• Current owner: remembers which owner you're working on if you belong to more than one.
• Referral: if you arrive through a referral link, remembers the code for 30 days so the referral can be credited.
• Security: protects forms against cross-site request forgery.

11. Marketing

We only send marketing emails, such as Leasii news and offers, to people who have agreed to get them: by ticking the box when they create an account, or by turning on Leasii news and offers in Settings › Notifications. The box is never ticked for you. Each marketing email says it's from Leasii, tells you how to contact us, and has a link to unsubscribe, as the Spam Act 2003 (Cth) requires.

You can unsubscribe at any time with that link (it works without signing in, and many email apps show an unsubscribe button that uses it), by turning off Leasii news and offers in Settings › Notifications, or by asking us. We act on it straight away, and always within 5 business days. We keep a record of what you agreed to and when, and of the address that unsubscribed, so we don't email it again.

Emails about your account, tenancies, notices and billing aren't marketing and will still be sent. Optional notification emails, such as reminders and activity updates, also have an unsubscribe link, which turns off that kind of email.

12. Seeing, correcting and removing your information

Signed-in users can do most of this themselves under Settings › Privacy:

• see the consents you've given, and withdraw optional ones;
• download a copy of your information;
• ask us to correct information; and
• ask us to close your account.

You can also email support@leasii.com.au. We'll respond within 30 days. We may need to confirm who you are first. We may refuse a request where the law allows, for example where records must be kept as evidence or a tenancy is still current, and we'll explain why.

If your information was entered by a landlord, you can ask them to correct it, or ask us.

13. If something goes wrong

If a data breach is likely to cause serious harm, we'll notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

14. Questions and complaints

If you have a question or a complaint about how we handle personal information, contact us at support@leasii.com.au or Aayush Tech Pty Ltd, [registered address]. We'll acknowledge it within 5 business days and aim to resolve it within 30 days.

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.

15. Changes to this policy

We'll update this policy when the way we handle information changes. If a change is significant, we'll tell you by email or in Leasii before it takes effect. The date at the top shows when it last changed.