UpVal Privacy Policy

Effective date: 3 July 2026
Last updated: 3 July 2026

1. About this Privacy Policy

This Privacy Policy explains how UpVal Pty Ltd (ABN 88 699 872 243, ACN 699 872 243) (UpVal, we, us or our) collects, uses, holds, discloses and protects personal information when you use UpVal, including our website at upval.io, our application at app.upval.io, and any related services, tools, reports, project pages, request-for-quote tools, builder tools, communications and content we make available (together, the Service).

UpVal is incorporated in Australia and based in New South Wales.

We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By using the Service, you agree to the collection, use, holding and disclosure of your personal information as described in this Privacy Policy.

If you do not agree with this Privacy Policy, you must not use the Service.

2. Privacy contact

For privacy questions, access or correction requests, deletion requests or complaints, contact:

Privacy Officer
UpVal Pty Ltd
ABN 88 699 872 243
ACN 699 872 243
New South Wales, Australia
Email: privacy@upval.io
Postal address: 7 Vista Street, Mosman NSW 2088, Australia
Phone: +61 466 539 998

You may also contact us through hello@upval.io for general support.

3. What personal information means

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether it is recorded in a material form or not.

4. What personal information we collect

The personal information we collect depends on how you use the Service and whether you use it as a homeowner, buyer, investor, builder, trade professional, consultant or other user.

We may collect and hold the following categories of information.

4.1 Account and profile information

• Name

• Email address

• Phone number

• Account password, stored in hashed form

• User role, such as homeowner, buyer, investor, builder, trade or consultant

• Account settings, preferences, subscription status and authentication information

4.2 Property and project information

• Property addresses and related location information

• Floorplans, photos, plans, drawings, documents and other uploaded files

• Renovation goals, budget ranges, style preferences, scope preferences, assumptions, project notes and decisions

• Current condition, proposed works, room information, materials, fixtures and finishes

• Structured project data generated through the Service, including scopes, scenarios, planning flags, RFQs, quotes, assumptions, reports and confidence indicators

• Communications, comments and collaboration activity connected with a project

4.3 Builder, trade and professional-user information

For builder, trade and professional users, we may collect:

• business name, ABN, ACN, trading name and contact details;

• licence, registration, qualification and insurance information;

• service areas, trade categories, capacity, availability and business profile information;

• quote responses, pricing, exclusions, assumptions and supporting documents;

• communications with homeowners, other users and UpVal; and

• information from public registers or third-party sources used to help verify or supplement business, licence or insurance information.

4.4 Payment and subscription information

We use Stripe or other payment providers to process payments. We do not store your full payment card number.

We may receive and hold limited payment and billing information, such as billing name, billing email, billing address, subscription plan, payment status, invoice details, payment history, last four digits of a card, card type and expiry date.

4.5 Communications and support information

We may collect records of your communications with us and, where relevant, with other users through the Service, including support requests, complaints, RFQ messages, quote messages, project comments and email or in-app correspondence.

4.6 Technical, usage and analytics information

We may collect:

• IP address, device information, browser information and operating system information;

• log data, approximate location derived from technical information and access times;

• pages viewed, buttons clicked, features used, forms submitted and actions taken;

• referral source, campaign information and cookie identifiers;

• error, crash, performance and diagnostic information; and

• security, fraud-prevention and audit logs.

4.7 Aggregated and de-identified information

We may create and use aggregated or de-identified information that does not reasonably identify you. For example, we may use aggregated project-type, suburb-level, cost-range or feature-usage data to improve the Service, understand market patterns, benchmark assumptions or develop product features.

5. How we collect personal information

We generally collect personal information directly from you when you:

• create an account;

• enter an address or project details;

• upload a floorplan, photo, plan, document or other file;

• generate a report, scope, scenario, RFQ or quote;

• invite another user or accept an invitation;

• share a project with a builder or trade professional;

• submit a quote or business profile;

• subscribe, pay or request billing support;

• contact us for support or make a complaint; or

• use our website, app, cookies or analytics tools.

We may also collect personal information from:

• another user who invites you to collaborate on a project or shares information involving you;

• public registers, including ABN, licence or building-related registers;

• mapping, geocoding, address-normalisation and property-data providers;

• payment providers;

• analytics, diagnostics and security providers; and

• professional advisers, regulators or authorities where relevant.

If you provide personal information about another person, such as a co-owner, tenant, client, employee, subcontractor, builder, trade contact or business contact, you must ensure you are authorised to do so and that the person is aware of this Privacy Policy where required.

6. Anonymous and pseudonymous use

You may browse some public parts of our website without creating an account. However, because the Service involves property addresses, project files, account access, paid subscriptions, collaboration, RFQs, quotes and security controls, it will usually not be practical for you to use the app or project features anonymously or under a pseudonym.

7. Sensitive information

We do not seek to collect sensitive information as defined in the Privacy Act, such as information about health, race, ethnic origin, political opinions, religion, philosophical beliefs, sexual orientation, criminal record or biometric information.

Please do not upload sensitive information unless it is genuinely necessary for your project and you have authority to provide it. If you choose to provide sensitive information, you consent to us handling it in accordance with this Privacy Policy for the purposes for which it was provided, unless the law requires or permits otherwise.

8. How we use personal information

We use personal information to:

• create, authenticate and manage accounts;

• provide, operate, secure, maintain and improve the Service;

• verify identity, business details, licence details, insurance details and payment status where relevant;

• process addresses, floorplans, photos, budgets, goals and other project inputs;

• generate UpVal outputs, including reports, first-pass cost ranges, value-uplift indications, planning-pathway flags, scopes, scenarios, RFQs, quote comparisons and assumptions;

• enable homeowners, buyers, builders, trades, consultants and collaborators to connect and share project information where chosen by the relevant user;

• process payments, subscriptions, invoices and billing communications;

• provide customer support and respond to questions, complaints and disputes;

• send service, security, billing, account, project, RFQ, quote and transactional communications;

• send marketing communications where permitted by law;

• conduct analytics, diagnostics, testing, product development and service improvement;

• monitor, detect, prevent and respond to fraud, misuse, unauthorised access, security incidents and unlawful activity;

• enforce our Terms & Conditions and other agreements;

• comply with legal, regulatory, tax, accounting, insurance and record-keeping obligations; and

• create aggregated or de-identified information that does not reasonably identify you.

We will only use personal information for the purpose for which it was collected, a related secondary purpose you would reasonably expect, a purpose you have consented to, or a purpose otherwise permitted or required by law.

9. Artificial intelligence and automated processing

A core part of the Service uses artificial intelligence and automated processing to analyse project inputs and generate outputs such as cost ranges, value-uplift indications, planning-pathway flags, scopes, scenarios, RFQs, quote comparisons and reports.

9.1 Information used by AI and automated systems

The information processed by AI or automated systems may include:

• property addresses and location information;

• floorplans, photos, plans, documents and uploaded files;

• renovation goals, budgets, scope preferences and project notes;

• builder, trade and quote information;

• structured project data generated through the Service; and

• technical or usage information needed to operate, secure, debug and improve the Service.

9.2 AI providers

To generate outputs, we may send relevant project inputs to third-party AI providers, including Anthropic (Claude), to process on our behalf and return results. We select providers that offer appropriate confidentiality, security and data-protection commitments for the nature of the Service.

We do not intentionally permit third-party AI providers to use your identifiable project inputs to train general public AI models unless this is disclosed to you or you separately consent.

9.3 Nature of AI outputs

AI-generated and automated outputs are decision-support tools only. They are not final determinations, statutory approvals, professional advice, valuations, building contracts, certificates, insurance documents, guarantees or substitutes for professional review.

Because outputs may influence significant property, renovation or financial decisions, we aim to design outputs to include assumptions, limitations, confidence indicators or prompts to seek professional advice where appropriate.

9.4 Automated decision-making

We may use automated processing to generate or assist with:

• indicative cost ranges;

• value-uplift or rental-uplift indications;

• planning-pathway flags;

• project risk flags;

• scope suggestions;

• RFQ or quote summaries;

• builder/trade matching or filtering signals; and

• fraud, security or misuse checks.

UpVal does not use solely automated processing to make final decisions that determine your legal rights, grant or refuse statutory approvals, issue professional certifications, approve building work, approve credit, approve insurance, or bind you to a building contract.

If you would like more information about how automated processing is used in relation to your personal information, you can contact us using the details in section 2.

10. Who we disclose personal information to

We do not sell personal information.

We disclose personal information only where needed to operate the Service, where you direct or consent to disclosure, or where permitted or required by law. This may include disclosure to the following categories of recipients.

10.1 Service providers and subprocessors

We may disclose information to service providers that help us operate the Service, including:

• Supabase — database, authentication, file storage and backend infrastructure;

• Stripe — payment processing, billing and subscription management;

• Anthropic (Claude) — AI analysis and output generation;

• Sentry — error tracking and diagnostics;

• PostHog — product analytics;

• email delivery providers — account, transactional, notification and support emails;

• mapping, geocoding, address-normalisation and property-data providers;

• hosting, security, monitoring, logging and infrastructure providers;

• customer-support and communication tools; and

• professional advisers, including lawyers, accountants, insurers, auditors and consultants.

We require service providers to protect personal information and use it only for the purposes of providing services to us, unless the law permits otherwise.

10.2 Other users and project participants

We may disclose project information to other users where you choose to share it or where sharing is part of the feature you use. For example:

• a homeowner may share a project, report, scope, RFQ or uploaded files with a builder, trade professional, consultant, co-owner or collaborator;

• a builder or trade professional may submit quote information to a homeowner or project owner;

• users invited to a project may view information made available within that project; and

• information included in a public or shareable link may be viewable by anyone with that link.

You should carefully check what information is included before sharing a project, RFQ, quote, report or link.

10.3 Legal, regulatory and safety disclosures

We may disclose personal information where reasonably necessary to:

• comply with a law, court order, subpoena, regulator request or government authority request;

• respond to legal claims, disputes, complaints or investigations;

• enforce our Terms & Conditions or other agreements;

• protect the rights, property, security or safety of UpVal, users or third parties; or

• detect, prevent or respond to fraud, misuse, security incidents or unlawful activity.

10.4 Business transfers

If UpVal is involved in a merger, acquisition, restructure, financing, sale of business, sale of assets, insolvency process or transfer of all or part of our business, personal information may be disclosed to advisers, counterparties, prospective counterparties or successors, subject to appropriate confidentiality and legal protections where required.

11. Overseas disclosure

Some of our service providers and their subprocessors may store or process personal information outside Australia. Likely locations include Australia, the United States, the European Union, the United Kingdom and other countries where our providers or their subprocessors operate.

Where we disclose personal information overseas, we take reasonable steps to ensure it is handled consistently with the APPs, including through contractual, technical and security measures where appropriate.

The countries and providers may change as the Service develops. Where practicable, we will maintain or make available updated information about material service providers or overseas processing locations.

12. Marketing communications

We may send marketing communications where you have consented or where it is otherwise permitted by the Spam Act 2003 (Cth) and other applicable laws.

Marketing messages will identify UpVal or the authorised sender, include contact details where required, and include a functional unsubscribe or opt-out mechanism where required.

You can opt out of marketing communications at any time by using the unsubscribe link or instructions in the message or by contacting us. We will action unsubscribe requests within the time required by law.

Even if you opt out of marketing, we may still send non-marketing service communications, including security, billing, account, legal, project, RFQ, quote and transactional notices.

13. Cookies and analytics

We use cookies and similar technologies to:

• keep you signed in;

• remember preferences;

• operate and secure the Service;

• understand how the Service is used;

• measure marketing and product performance;

• detect errors, fraud and misuse; and

• improve the Service.

Some cookies are essential for the Service to work. Others support analytics, diagnostics, marketing measurement or personalisation. You can control cookies through your browser settings, but disabling some cookies may affect how the Service functions.

We may provide additional cookie notices or consent controls where required.

14. How we hold and protect personal information

We hold personal information using reputable cloud infrastructure and service providers. We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

Our safeguards may include:

• authentication controls;

• role-based access controls;

• database row-level security where appropriate;

• encryption in transit;

• restricted administrative access;

• logging, monitoring and diagnostic tools;

• data-backup and recovery processes;

• service-provider due diligence; and

• internal policies and procedures for privacy and security.

No method of transmission or storage is completely secure. We cannot guarantee absolute security. You are responsible for keeping your account credentials secure and notifying us promptly of suspected unauthorised access.

15. Data retention

We keep personal information for as long as reasonably needed for the purposes described in this Privacy Policy, including to provide the Service, maintain project records, meet legal, tax, accounting and record-keeping obligations, resolve disputes, enforce agreements, maintain security and improve the Service.

When we no longer need personal information, we will take reasonable steps to delete or de-identify it, unless we are required or permitted by law to retain it.

Some information may remain in backups or logs for a limited period before being overwritten or deleted in accordance with our retention processes.

16. Accessing and correcting personal information

You may request access to personal information we hold about you and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

You can update some account information directly within the Service. For other access or correction requests, contact us using the details in section 2.

We will respond within a reasonable period. There is generally no fee for making a request, although we may charge reasonable costs for giving access where permitted by law. If we refuse access or correction, we will tell you why in writing where required and explain how you can complain.

17. Deletion requests and account closure

You may request account closure or deletion of certain personal information by contacting us.

We will take reasonable steps to action deletion requests where required or appropriate. However, we may retain information where necessary for legal, tax, accounting, security, dispute-resolution, fraud-prevention, backup, audit or legitimate business purposes, or where deletion would adversely affect the rights or records of another user.

We may de-identify information instead of deleting it where permitted by law.

18. Data breaches

We maintain processes to identify, assess and respond to suspected data breaches.

If a data breach involving your personal information is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

19. Children

The Service is intended for users aged 18 and over. We do not knowingly collect personal information from children.

If you believe a child has provided personal information to us, contact us and we will take reasonable steps to delete it where appropriate.

20. Third-party links and services

The Service may contain links to third-party websites or services, including builder websites, council websites, NSW Planning Portal pages, government resources, payment providers and other external tools.

We are not responsible for the privacy practices, security or content of third-party websites or services. You should review the relevant third party's privacy policy before using them or providing personal information.

21. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our Service, information-handling practices, providers, legal obligations or business operations.

We will post the updated version with a new Last updated date. Where changes are material, we will take reasonable steps to notify affected users, such as through the Service or by email.

Your continued use of the Service after an updated Privacy Policy takes effect means you accept the updated policy, except where the law requires a different form of consent.

22. Complaints

If you have a privacy complaint, please contact us using the details in section 2 and include enough information for us to understand and investigate the issue.

We will acknowledge your complaint and aim to respond within a reasonable period. We may ask for further information if needed.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner:

Website: www.oaic.gov.au
Phone: 1300 363 992
Mail: GPO Box 5218, Sydney NSW 2001