Effective date: 3 July 2026 Last updated: 13 October 2026
This Privacy Policy explains how UpVal Pty Ltd (ABN 88 699 872 243, ACN 699 872 243) (UpVal, we, us or our) collects, uses, holds, discloses and protects personal information when you use UpVal, including our website at upval.io, our application at app.upval.io, and any related services, tools, reports, project pages, request-for-quote tools, builder tools, communications and content we make available (together, the Service).
UpVal is incorporated in Australia and based in New South Wales.
We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By using the Service, you agree to the collection, use, holding and disclosure of your personal information as described in this Privacy Policy.
If you do not agree with this Privacy Policy, you must not use the Service.
For privacy questions, access or correction requests, deletion requests or complaints, contact:
Privacy Officer UpVal Pty Ltd ABN 88 699 872 243 ACN 699 872 243 New South Wales, Australia Email: privacy@upval.io Postal address: 7 Vista Street, Mosman NSW 2088, Australia Phone: +61 466 539 998
You may also contact us through hello@upval.io for general support.
Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether it is recorded in a material form or not.
The personal information we collect depends on how you use the Service and whether you use it as a homeowner, buyer, investor, builder, trade professional, consultant or other user.
We may collect and hold the following categories of information.
For builder, trade and professional users, we may collect:
We use Stripe or other payment providers to process payments. We do not store your full payment card number.
We may receive and hold limited payment and billing information, such as billing name, billing email, billing address, subscription plan, payment status, invoice details, payment history, last four digits of a card, card type and expiry date.
We may collect records of your communications with us and, where relevant, with other users through the Service, including support requests, complaints, RFQ messages, quote messages, project comments and email or in-app correspondence.
We may collect:
We may create and use aggregated or de-identified information that does not reasonably identify you. For example, we may use aggregated project-type, suburb-level, cost-range or feature-usage data to improve the Service, understand market patterns, benchmark assumptions or develop product features.
We generally collect personal information directly from you when you:
We may also collect personal information from:
If you provide personal information about another person, such as a co-owner, tenant, client, employee, subcontractor, builder, trade contact or business contact, you must ensure you are authorised to do so and that the person is aware of this Privacy Policy where required.
You may browse some public parts of our website without creating an account. However, because the Service involves property addresses, project files, account access, paid subscriptions, collaboration, RFQs, quotes and security controls, it will usually not be practical for you to use the app or project features anonymously or under a pseudonym.
We do not seek to collect sensitive information as defined in the Privacy Act, such as information about health, race, ethnic origin, political opinions, religion, philosophical beliefs, sexual orientation, criminal record or biometric information.
Please do not upload sensitive information unless it is genuinely necessary for your project and you have authority to provide it. If you choose to provide sensitive information, you consent to us handling it in accordance with this Privacy Policy for the purposes for which it was provided, unless the law requires or permits otherwise.
We use personal information to:
We will only use personal information for the purpose for which it was collected, a related secondary purpose you would reasonably expect, a purpose you have consented to, or a purpose otherwise permitted or required by law.
A core part of the Service uses artificial intelligence and automated processing to analyse project inputs and generate outputs such as cost ranges, value-uplift indications, planning-pathway flags, scopes, scenarios, RFQs, quote comparisons and reports.
The information processed by AI or automated systems may include:
To generate outputs, we may send relevant project inputs to third-party AI providers, including Anthropic (Claude), to process on our behalf and return results. We select providers that offer appropriate confidentiality, security and data-protection commitments for the nature of the Service.
We do not intentionally permit third-party AI providers to use your identifiable project inputs to train general public AI models unless this is disclosed to you or you separately consent.
AI-generated and automated outputs are decision-support tools only. They are not final determinations, statutory approvals, professional advice, valuations, building contracts, certificates, insurance documents, guarantees or substitutes for professional review.
Because outputs may influence significant property, renovation or financial decisions, we aim to design outputs to include assumptions, limitations, confidence indicators or prompts to seek professional advice where appropriate.
We may use automated processing to generate or assist with:
UpVal does not use solely automated processing to make final decisions that determine your legal rights, grant or refuse statutory approvals, issue professional certifications, approve building work, approve credit, approve insurance, or bind you to a building contract.
If you would like more information about how automated processing is used in relation to your personal information, you can contact us using the details in section 2.
BRUCE is an AI assistant in the Service that answers questions about your project. When you use BRUCE:
We do not sell personal information.
We disclose personal information only where needed to operate the Service, where you direct or consent to disclosure, or where permitted or required by law. This may include disclosure to the following categories of recipients.
We may disclose information to service providers that help us operate the Service, including:
We require service providers to protect personal information and use it only for the purposes of providing services to us, unless the law permits otherwise.
We may disclose project information to other users where you choose to share it or where sharing is part of the feature you use. For example:
You should carefully check what information is included before sharing a project, RFQ, quote, report or link.
We may disclose personal information where reasonably necessary to:
If UpVal is involved in a merger, acquisition, restructure, financing, sale of business, sale of assets, insolvency process or transfer of all or part of our business, personal information may be disclosed to advisers, counterparties, prospective counterparties or successors, subject to appropriate confidentiality and legal protections where required.
Some of our service providers and their subprocessors may store or process personal information outside Australia. Likely locations include Australia, the United States, the European Union, the United Kingdom and other countries where our providers or their subprocessors operate.
Where we disclose personal information overseas, we take reasonable steps to ensure it is handled consistently with the APPs, including through contractual, technical and security measures where appropriate.
The countries and providers may change as the Service develops. Where practicable, we will maintain or make available updated information about material service providers or overseas processing locations.
We may send marketing communications where you have consented or where it is otherwise permitted by the Spam Act 2003 (Cth) and other applicable laws.
Marketing messages will identify UpVal or the authorised sender, include contact details where required, and include a functional unsubscribe or opt-out mechanism where required.
You can opt out of marketing communications at any time by using the unsubscribe link or instructions in the message or by contacting us. We will action unsubscribe requests within the time required by law.
Even if you opt out of marketing, we may still send non-marketing service communications, including security, billing, account, legal, project, RFQ, quote and transactional notices.
We use cookies and similar technologies to:
Some cookies are essential for the Service to work. Others support analytics, diagnostics, marketing measurement or personalisation. You can control cookies through your browser settings, but disabling some cookies may affect how the Service functions.
We may provide additional cookie notices or consent controls where required.
We hold personal information using reputable cloud infrastructure and service providers. We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.
Our safeguards may include:
No method of transmission or storage is completely secure. We cannot guarantee absolute security. You are responsible for keeping your account credentials secure and notifying us promptly of suspected unauthorised access.
We keep personal information for as long as reasonably needed for the purposes described in this Privacy Policy, including to provide the Service, maintain project records, meet legal, tax, accounting and record-keeping obligations, resolve disputes, enforce agreements, maintain security and improve the Service.
When we no longer need personal information, we will take reasonable steps to delete or de-identify it, unless we are required or permitted by law to retain it.
Some information may remain in backups or logs for a limited period before being overwritten or deleted in accordance with our retention processes.
Records of token purchases, token balances and the tokens each job used are kept for as long as your account exists and afterwards for the period required for tax, accounting and dispute purposes.
You may request access to personal information we hold about you and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.
You can update some account information directly within the Service. For other access or correction requests, contact us using the details in section 2.
We will respond within a reasonable period. There is generally no fee for making a request, although we may charge reasonable costs for giving access where permitted by law. If we refuse access or correction, we will tell you why in writing where required and explain how you can complain.
You may request account closure or deletion of certain personal information by contacting us.
We will take reasonable steps to action deletion requests where required or appropriate. However, we may retain information where necessary for legal, tax, accounting, security, dispute-resolution, fraud-prevention, backup, audit or legitimate business purposes, or where deletion would adversely affect the rights or records of another user.
We may de-identify information instead of deleting it where permitted by law.
We maintain processes to identify, assess and respond to suspected data breaches.
If a data breach involving your personal information is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.
The Service is intended for users aged 18 and over. We do not knowingly collect personal information from children.
If you believe a child has provided personal information to us, contact us and we will take reasonable steps to delete it where appropriate.
The Service may contain links to third-party websites or services, including builder websites, council websites, NSW Planning Portal pages, government resources, payment providers and other external tools.
We are not responsible for the privacy practices, security or content of third-party websites or services. You should review the relevant third party's privacy policy before using them or providing personal information.
We may update this Privacy Policy from time to time to reflect changes to our Service, information-handling practices, providers, legal obligations or business operations.
We will post the updated version with a new Last updated date. Where changes are material, we will take reasonable steps to notify affected users, such as through the Service or by email.
Your continued use of the Service after an updated Privacy Policy takes effect means you accept the updated policy, except where the law requires a different form of consent.
If you have a privacy complaint, please contact us using the details in section 2 and include enough information for us to understand and investigate the issue.
We will acknowledge your complaint and aim to respond within a reasonable period. We may ask for further information if needed.
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner:
Website: www.oaic.gov.au Phone: 1300 363 992 Mail: GPO Box 5218, Sydney NSW 2001
UpVal Privacy Policy