Privacy Policy

UNREVIEWED — pending legal review. This draft has not been reviewed by a qualified Australian legal practitioner. Do not enable public signups until it has been. The operator's legal entity name, ABN, registered address and the contact address for privacy enquiries must be confirmed at review.

This policy explains how Stagerator, the operator of stagerator.com, handles personal information. It is written to meet the Australian Privacy Principles under the Privacy Act 1988 (Cth) and the information privacy principles under the New Zealand Privacy Act 2020.

1. Two different roles

Stagerator is a business tool used by home-staging companies. That means we hold personal information in two distinct capacities, and this policy covers both.

As the business we run. Information about the staging companies who subscribe, and about the individual staff who log in — names, email addresses, passwords (stored hashed, never in plain text), and billing details held by our payment processor.

On behalf of our customers. Information a subscribing company puts into its own workspace about its clients — names, contact details, property addresses, photographs of properties, quote and job records, and notes. For this information the subscribing company decides what is collected and why; we hold and process it on their instructions. Our obligations to them are set out in our Data Processing Addendum.

If you are a client of a staging company that uses Stagerator and you want your information corrected or removed, contact that company directly. We will assist them with your request.

2. What we collect and why

| What | Why | | --- | --- | | Name, email, organisation name | To create and secure your account | | Hashed password | To authenticate you | | Billing name, address, payment method | To take payment and issue tax invoices (held by our payment processor, not by us) | | Usage and log data, including IP address and browser type | To keep the Service secure, diagnose faults and understand how it is used | | Records of your acceptance of our legal documents, including IP address and browser | To prove what you agreed to, and when | | Support messages you send us | To answer them | | Content your organisation uploads | To provide the Service to your organisation |

We do not sell personal information. We do not use Customer Data to train machine-learning models.

3. How we collect it

Mostly directly from you — when you sign up, use the Service, or contact us. Some technical information is collected automatically when you use the Service. Where a staging company invites a staff member, we collect that person's name and email from the company.

4. Who we share it with, and where they are

We use third-party providers to run the Service. Several are located outside Australia and New Zealand, which means your information may be stored and processed overseas — most commonly in the United States and the European Union. Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with this policy and applicable law.

Our current providers are:

• Vercel — application hosting and content delivery (United States)
• Neon — database hosting (United States / European Union)
• Vercel Blob — file and image storage (United States)
• Stripe — payment processing (United States, with local entities)
• Resend — transactional email delivery (United States)
• Anthropic — AI assistant features, where your organisation enables them (United States)
• Google — AI room-staging image generation, where your organisation enables it: photographs of rooms you upload for staging previews are processed by Google's Gemini service (United States)

An up-to-date list, including each provider's purpose and location, is published at our Subprocessors page. We will also disclose personal information where the law requires it, or where necessary to establish or defend a legal claim.

5. Security

We protect personal information with measures appropriate to its sensitivity, including encryption in transit, encryption at rest, hashed passwords, role-based access within each customer workspace, strict separation between customer organisations, and audit logging of significant actions. No system is perfectly secure, and we cannot guarantee absolute security.

If a data breach occurs that is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and the New Zealand Office of the Privacy Commissioner where the New Zealand Privacy Act applies.

6. How long we keep it

We keep account information for as long as you hold an account. After a subscription ends we retain the workspace for a limited period so the data can be recovered or exported, then delete it. Records of legal-document acceptance are retained for as long as we may need to evidence the agreement. We keep records we are legally required to keep for the period required.

7. Accessing and correcting your information

You can access and correct most of your information directly in the Service. You may also ask us for access to the personal information we hold about you, or ask us to correct it. We will respond within a reasonable period. We may need to verify your identity first. If we refuse access or correction, we will tell you why.

8. Cookies

We use cookies that are necessary for the Service to work — principally to keep you signed in and to remember which branch you are working in. We do not use advertising cookies.

9. Complaints

If you think we have mishandled your personal information, contact us first using the address published on stagerator.com and we will investigate.

If you are not satisfied with our response, you can complain to:

• Australia — the Office of the Australian Information Commissioner, oaic.gov.au
• New Zealand — the Office of the Privacy Commissioner, privacy.org.nz

10. Changes to this policy

We may update this policy. The current version is always published here, and superseded versions remain available so you can see what applied and when. Where a change materially affects how we handle your information, we will require an administrator of your organisation to acknowledge the new version.

11. Contact

Privacy enquiries can be sent to the contact address published on stagerator.com.