Privacy Policy

Project Profile Pty Ltd (ABN 57 674 795 745) is a property marketing agency based in Brisbane, Queensland, Australia. We are the data controller for the information described here. You can reach us at admin@projectprofile.agency.

• Account information. Your name, email address and role. Accounts are created by us; there is no public sign-up.
• Work records. Projects, tasks, briefs, deliverables, approvals, comments and messages created by our team and by clients using the platform.
• Files. Artwork, documents and images uploaded by our team or by a client, stored against the project they belong to.
• Business and billing records. Invoices, purchase orders and payment status for the services we provide.
• Campaign and enquiry data. Advertising results, landing page results and enquiry records for the campaigns we run on a client's behalf. Enquiry records can include the name, email address, phone number and postcode a member of the public submitted to one of our client's campaigns.
• Connected account data. Where a member of our staff connects a mailbox, calendar or accounting account, the data described in section 4.
• Technical records. Sign-in events, delivery records for emails we send, and error logs. We do not run advertising or tracking cookies on this platform.

We use this information to run the platform and deliver the services our clients engage us for. Specifically:

• To sign you in and to show you the work, files, results and invoices that belong to your account.
• To send transactional messages — sign-in links, notifications that something needs your approval, invoices, and campaign updates.
• To produce reporting on the campaigns we run for a client.
• To keep the platform secure, diagnose faults, and keep records we are required to keep.

We do not sell your information, and we do not use it for advertising to you. We do not use client data to train machine learning models.

Some features work by connecting an account you already hold. A connection is only ever made by you, from the settings screen, and can be disconnected there at any time.

Google

• Google Drive file picker. If you choose to attach a file from Google Drive, we request the drive.file permission. This permission lets the application see only the specific files you select in the picker. We store a link to the file you picked and its name — we do not browse, index or copy the rest of your Drive.
• Your email address. Used to identify which account you connected, so the connection can be shown and removed.
• Advertising and analytics results. Where a client engages us to run Google advertising, we retrieve performance figures for those campaigns — spend, impressions, clicks and conversions. This is campaign reporting data, not personal Google account data.

Project Profile's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Meta

• Where a client engages us to run Facebook or Instagram advertising, we retrieve performance figures for those campaigns — spend, reach, impressions, clicks, and the enquiries a campaign generated.
• Enquiries submitted through a Meta lead form on a client's campaign are stored against that client so we can report on them and so the client can follow them up.
• We do not post as you, read your personal profile, or access anything beyond the advertising accounts a client has authorised us to manage on their behalf.

LinkedIn

• Where a client engages us to run LinkedIn advertising, we retrieve performance figures for those campaigns — spend, impressions, clicks and conversions. This is campaign reporting data, not personal LinkedIn profile data.
• We do not post as you, read your personal profile or messages, or access anything beyond the advertising accounts a client has authorised us to manage on their behalf.

Other connections work the same way and are listed in section 5: a Microsoft 365 mailbox and calendar, and a Xero accounting organisation.

We do not sell data or share it for anyone else's marketing. We use the following service providers to run the platform, and each receives only what it needs to do its job:

• Supabase — database, authentication and file storage.
• Vercel — hosting for this website.
• SendGrid — sending transactional email.
• Twilio — sending SMS where a campaign uses it.
• Microsoft — mailbox and calendar access, where a staff member has connected their Microsoft 365 account.
• Xero — invoicing and accounting.
• Google, Meta and LinkedIn — advertising and analytics platforms, as described in section 4.
• Mailchimp — email campaign delivery and results, where a client uses it.
• Anthropic, OpenAI and OpenRouter — the assistants built into the platform that help our team draft and review work. Content sent to them is processed to produce a response and is not used to train their models.

Some of these providers process data outside Australia, including in the United States. We will also disclose information where the law requires it.

We keep work records, files and campaign results for as long as we act for the client they belong to, and afterwards for as long as we need them for the business and legal purposes they were collected for — including the seven years Australian tax law requires us to keep financial records. Records that are no longer needed are deleted.

Accounts are protected by a password or an emailed sign-in link. Access is restricted by role: a client account can only reach the portfolios it has been granted, through server-side checks rather than by what the screen chooses to show. Data is encrypted in transit, and files are held in private storage that requires an authorised, time-limited link to open.

No system is perfectly secure. If a breach affects your information and is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

• You can ask us what personal information we hold about you and ask for a copy.
• You can ask us to correct anything that is wrong.
• You can ask us to delete your information — see our data deletion instructions.
• You can disconnect a connected Google, Microsoft or Xero account at any time from the settings screen, which revokes our access.
• You can unsubscribe from campaign email using the link in the message. Sign-in links, invoices and notices about work in progress are not marketing and are sent as part of the service.

To make any of these requests, email admin@projectprofile.agency. Full instructions for deletion are on our Data Deletion page.

If you are unhappy with how we have handled your information you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

The platform is a business tool and is not intended for, or directed at, anyone under 16. We do not knowingly collect their information.

If we change this policy we will update the date at the top of this page. Where a change materially affects how we handle your information, we will tell account holders directly.