Privacy Policy

Version: 2.18.2 Effective from: 16 October 2026

This is the current policy. Superseded versions are retained and available on request from privacy@urbanpulse.com.au.

1. About this policy

Urban Pulse Strategies Pty Ltd (ABN 82 650 700 226; ACN 650 700 226), trading as Urban Pulse ("Urban Pulse", "we", "us" or "our"), provides a software-as-a-service platform for the Australian construction industry. The platform provides document transmittal and electronic signing, site and planning intelligence, project management, a services marketplace, payments, referrals and related business tools.

This policy explains how we handle personal information in connection with the platform, our websites and our related services (together, the "Service"). It applies to everyone whose personal information we handle, including account holders, the people they invite, and people who contact us.

We are the entity responsible for the personal information described in this policy. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Contact us. For any privacy question, or to exercise your rights, contact our Privacy Officer:

• Email: privacy@urbanpulse.com.au
• Post: Privacy Officer, Urban Pulse Strategies Pty Ltd, PO Box 81, Aspley QLD 4034.

2. Information we collect

We collect the categories of personal information described below. Where you upload a document, any personal information within it is handled as document content rather than as a separate profile record.

2.1 Account and identity information

Your name, email address, username and hashed password; authentication factors where you use multi-factor authentication, including a phone number where you choose SMS-based verification, which we use to send you a one-time verification code; and session and sign-in records. Where relevant to your use of the Service, we also collect your role, business name, ABN, ACN, licence numbers, business address and contact details. We also collect your ABN, if you provide it, when you create your account. We keep the individual account-holder's own name (as given at sign-up) and email address (as verified when you sign in) as a separate record identifying the person behind an account, distinct from your organisation's own business profile.

We store a one-way hash of your password and never store it in plain text. We record successful and unsuccessful sign-in events, including the time, the outcome and a one-way hash of the identifier used.

2.2 Documents, envelopes and signing records

The documents you upload or generate — contracts, quotes, variations, dilapidation and inspection reports, photographs, drawings, project files and attachments — together with their metadata (filename, type, size, integrity hash, upload time, uploader, malware-scan result and storage location), and any personal information contained within them, such as counterparty names, addresses, signatures, contract values and project details.

Photos and videos you upload to a project or listing. We remove location and camera details from them after the virus scan, before anyone else can open them.

Files are stored and downloaded under a neutral name, such as urban-pulse-3f9a2c.pdf, and not under the name they were uploaded with.

When you prepare an envelope for signature, we collect each participant's name and email address, and their phone number where you provide it. For signers, we record the signature and initials fields assigned to them and the page and placement of each field, which we use to route, evidence and audit that envelope. When a document is signed, we record the signer's name and email address, the time of signing, signing-context metadata, a truncated network prefix and a one-way hash of the browser, bound to the signature and consent record.

2.3 Payments, subscriptions and referrals

Billing name and address, payment references and receipts, subscription plan and status, payment-provider customer and subscription identifiers, and the records we need to reconcile invoices, refunds, disputes and tax obligations. Card details are tokenised in your browser by our payment processor before they reach us; we do not receive or store full card numbers.

If you take part in our referral program, we collect your referral code and its link to your account, and — for referred sign-ups — a one-way hash of the referred email address and the identifiers needed to attribute the referral. Where you provide bank details for the payment of referral rewards, we collect the account name, BSB and account number, and either your ABN or a completed ATO Statement by a supplier form, which we use to make and evidence the payment. To pay a reward by bank transfer, we disclose the account name, BSB, account number and payment amount to our bank, which makes the transfer. We keep a record of each referral payment and whether the bank returned it, with a reason from a fixed list (such as a closed account or an account name that does not match). A returned payment goes back into your referral balance and is sent again in the next weekly payment; if payments are returned twice after you last saved your bank details, we hold further bank payments, show you on your referrals page that your bank details need updating, and alert our team, until you update them.

2.4 Project, planning, marketplace and collaboration content

The information you create in our project-management, town-planning, marketplace and property-intelligence tools, including project names and addresses, tasks, milestones, requests for information, variations, defects, claims, daily logs, comments and attachments; planning-site records, zoning and overlay context and due-diligence material; marketplace profiles, jobs, bids, messages, ratings and dispute records, including the names and email addresses of parties to a marketplace contract; and the messages, channel membership and attachments you exchange with your team, trades and clients in a project's messaging channels.

Where you invite a client to a project channel, we collect the email address you provide, which we use only to send the invitation and to grant that person access to that channel after they sign in and their email is matched to their verified account. Where you send a job-invite referral link to a contractor who does not hold an account, we collect the email address you provide, which we use only to help you share that invite — we do not send it on your behalf — and not for marketing or any other purpose. Where you send a listing enquiry, we collect the listing, subject, message and a one-way hash of the network address for rate-limiting and abuse prevention. Where you log time or costs against a matter, we record who logged each time entry, its date, the time spent and any rate, stage label or note you add, and for each cost its date, the supplier or what it was for, the amounts and any receipt you upload, which we use to show your firm the time and costs recorded on that matter and each person their own weekly timesheet. Where you record an enquiry from a prospective client before it becomes a matter, we collect the enquirer's name, and their email address and phone number where you provide them, which we use to let you respond to the enquiry and, if you accept it, open a matter for that client. Free-text fields may contain personal information you choose to include.

Where a project, contract, document set or thread is shared with someone outside the organisation that owns it — for example a consulting engineer, a certifier, a client's solicitor, or the contractor who wins a job — we keep a record of that access: who was given it (the individual, or the company), the role and level of access they were given, the reason it was given, who granted it, when it started, when it expires, and when it ended or was withdrawn. We keep that record after the access ends, because each party's record of what they were party to is their evidence too, and a construction dispute can surface years after the work finishes.

2.5 Communications and support

The content of emails, messages, in-app chats, support tickets, feature requests and other communications you send to us or through the Service. If you send a listing enquiry, your message and account email address are provided to the person handling that listing so they can respond.

If you contact us through our website enquiry form, we collect the email address and message you provide, your name if you choose to give it, and a short label recording which page you started from. Submitting the form requires you to give consent, which is the basis on which we reply. We use these details to respond to and keep a record of your enquiry, and we do not add you to marketing on the basis of an enquiry unless you separately opt in.

We screen enquiry-form submissions automatically for spam and abuse. If a submission is identified as likely spam, we hold it for review instead of responding to it. A held submission contains the information described in the previous paragraph and a record of why it was held. Held submissions may be reviewed by members of our staff who are authorised to do so. A reviewer may release a submission, after which we handle it as an ordinary enquiry, or dismiss it as spam, in which case we do not respond to it. We do not use a held submission for any other purpose. The confirmation shown after you submit the form is the same whether or not your submission is held. Unless a held submission is released, we permanently delete it 30 days after we receive it, whether or not it has been reviewed. A released submission is retained as an ordinary enquiry (see Section 7).

If an email bounces, is reported as spam or is unsubscribed, we record the address and event so we can honour suppression and opt-out obligations.

2.6 Technical, usage and analytics information

We collect technical and usage information to operate, secure, measure and improve the Service, including your IP address, browser type, device type, operating system, the pages and features you use, the actions you take and related timing. For recipients viewing a document through a secure link, we collect a truncated network identifier and a one-way browser fingerprint. We collect error and diagnostic logs, which are scrubbed to remove credential-shaped values and known personal-information fields before they leave our infrastructure.

We measure how the Service is used through two channels. Our first-party analytics record which pages and features are used and basic engagement signals such as time on a page and scroll depth. This information is stored on our Australian infrastructure and is associated with your account and organisation. We also use a third-party product-analytics provider in a privacy-protective configuration: it runs without analytics cookies and without cross-session tracking, sends only a fixed set of allowlisted events, and carries no directly identifying information in the event payload. We do not use analytics information for advertising or to build advertising profiles. See Section 5 for who we share information with, and Section 10 for cookies.

Where a map is shown on a property or site-intelligence surface, the address or map area you are viewing is used to draw the map, and the map provider receives standard technical information from your browser (see Section 5).

2.7 AI-assisted features

When you use an AI-assisted feature, we process the prompts, documents, extracted text, and project or planning records needed to produce the requested draft or answer. AI output is draft assistance only; a person remains responsible for reviewing it before it is sent, lodged, signed or relied on.

Our cross-project assistant is powered by a third-party AI model provider. It answers status questions across your projects, summarises what needs your attention, suggests questions drawn from your own records, and drafts client updates for you to review and send. When you use it, we send the relevant project and status records and your question to that AI model provider to generate the response (see Section 5.6).

2.8 Real-estate listing feed data

Where an agency account holder connects a property listing feed, we ingest the for-sale and for-lease listings that agency publishes through its customer-relationship-management (CRM) or listing-management system, in the industry-standard REAXML format. Those listings and their metadata may contain personal information — in particular the name, agency, photograph and contact details of the listing or sales agent, and any vendor, owner, landlord or tenant details the agency chooses to include in a listing — and we ingest and re-host the listing photographs the feed references. We handle this information as listing content on behalf of the agency account holder that publishes it; that agency is responsible for the listings it sends us and for having the authority to publish the personal information within them. Listings ingested from a feed are held as drafts and are not shown publicly unless the agency is verified and the listing is published.

2.9 Marketplace jobs: who sees what

What a marketplace job shows depends on who is looking and whether the job has been awarded.

• Anyone not signed in sees the job's suburb and a short summary. They never see the street, the lot, an exact map position, or the poster's name, phone number, email address or website. The description, documents, bids and the poster's profile are for signed-in members only. There is no public job board, and job pages are kept out of search engines.
• Signed-in members who can see the job, before it is awarded, may see its full address. Neither side sees the other's phone number, email address, website or personal social-media accounts, and contact happens through Marketplace chat.
• Contact details typed into a job, bid or message before the award are replaced with a placeholder such as "[phone hidden]", and the sender is told what was hidden and why. This covers phone numbers, email addresses, web links and social-media handles. We store only the masked text and do not keep the original.
• After the award, a contact card can show the poster and each trade awarded the job the other side's name, email address and phone number: the name and email address of the person who holds that business's account, and the business phone number if one is on file. Nobody else sees it, including the other bidders. Until the card is switched on for a job, contact after the award stays in Marketplace chat and the contract, which shows each signer's name and email address to the other party. Each time one party opens the other's card, we record which side opened it and when, but not the details on it.

These limits do not stop a disclosure that Australian law requires (see Section 5.10).

3. How we collect personal information

We collect personal information:

• Directly from you — when you create an account, complete onboarding, upload a document, send an envelope, use our planning, project or marketplace tools, make or receive a payment, submit an enquiry, or contact support.
• From the people you deal with — when another user nominates you as a recipient, collaborator, payer, contractor, consultant or project participant.
• From your device — through cookies, logs and browser interactions.
• From our service providers — such as our payment processor, OAuth provider and authentication provider, where they return information needed to deliver the Service.
• From listing feeds an agency connects — where an agency account holder directs its CRM or listing-management system to send us its property listings, we receive the personal information contained in those listings from that system rather than from each individual named in them.

Where we collect your personal information from someone other than you, we take reasonable steps to make you aware of this policy, including by linking to it from account and recipient surfaces.

4. How we use personal information

We use personal information where it is reasonably necessary for our functions and activities, where you have consented, where you would reasonably expect the use, or where the use is required or authorised by Australian law. Specifically, we use it to:

• Provide the Service — create and secure accounts, operate workspaces, send envelopes and capture signatures, store documents, run our planning, project and marketplace tools, provide support, and maintain transaction records.
• Process payments and referrals — verify payment methods, settle funds through our payment processor, reconcile payments and refunds, and administer referral rewards.
• Secure the Service and prevent fraud — authenticate users, detect and investigate suspicious activity, enforce our terms, and protect users and the platform.
• Measure and improve the Service — analyse how features are used, diagnose and fix faults, and develop improvements.
• Communicate with you — send service notifications, security alerts, document-status updates, receipts, support replies and, where you have opted in, marketing.
• Comply with the law — meet our tax, consumer-protection, privacy and data-breach obligations, and respond to lawful requests from courts, regulators and law-enforcement agencies.

5. Who we share personal information with

We share personal information only with the recipients described below, and only to the extent necessary to provide the Service. Each overseas recipient is identified by country. For overseas recipients, we take reasonable steps to ensure they handle personal information consistently with the Australian Privacy Principles, through data-processing agreements, contractual safeguards and vendor security commitments, and we maintain an internal cross-border disclosure register.

5.1 Payment processor (United States)

We use a payment processor to process card payments, subscription billing and disputes. The payment processor receives payment and billing information, including cardholder name, billing address, email address, a payment-method token, amount, invoice references and subscription identifiers. Your full card number is tokenised by the payment processor in your browser and does not reach us.

5.2 Transactional email provider (United States) and regional email delivery infrastructure (Japan)

We use a transactional email provider to deliver transactional email, including sign-in confirmations, invoices, document notifications, support updates and recipient notifications. The email provider receives the recipient's email address, the message and delivery metadata. The provider's control plane operates in the United States, and outbound delivery and bounce processing are routed through regional email delivery infrastructure in Tokyo, Japan.

5.3 Hosting, storage and database providers (Australia)

We host the Service on cloud infrastructure in the Sydney region (ap-southeast-2) for compute, file storage and secrets management, and we use a managed PostgreSQL database configured in the Sydney region. Account data, documents, audit records and analytics reside on this Australian infrastructure. Your electronically signed documents are prepared and completed within Urban Pulse's own signing ceremony and stored on this infrastructure; we do not send them to a third-party e-signature provider.

5.4 Authentication provider (Australia) and OAuth provider (United States)

We use an authentication provider to manage account credentials and sessions. When you choose to sign in with an OAuth provider (such as Google), your browser is directed to that provider to approve the sign-in and returned to us with a signed token containing your email address, whether it is verified, and basic profile information such as your name, which we use to authenticate you and create or match your account.

Account administration service (United States), used when we create your account for you.

5.5 Mapping and geospatial provider (United States)

Where we display a map on a property or site-intelligence surface, it is loaded directly from the mapping provider in your browser. The provider receives the map location and standard technical information, including IP address, browser type and device type, and may set or read its own cookies within the embedded map.

5.6 AI model provider (United States)

Our cross-project assistant is powered by an AI model provider based in the United States. When you use it, the provider receives your project and status records and the text of your question and the draft it produces — including project names (often a property address), task, milestone, request-for-information and variation names, statuses and dates, and, where relevant, document status and party names from your records. It does not receive your uploaded document contents, passwords or one-time codes. The provider processes this information under a Zero Data Retention agreement with us and does not retain it after the response is generated.

5.7 Product analytics provider (United States)

We use a product analytics provider to measure how the Service is used. The provider receives the allowlisted analytics events described in Section 2.6 — page and feature usage, campaign and source parameters, and coarse technical information. Your IP address is received at the point of collection and discarded after coarse location is derived; we do not enable analytics cookies, cross-session tracking, session recording or advertising features.

5.8 Support chat provider (no longer used)

We switched off in-product support chat and no longer send any information to a support-chat provider.

5.9 Government geospatial data provider (United States) — government planning-scheme zoning by coordinate

For a small number of Australian jurisdictions — currently the Australian Capital Territory (ACT Territory Plan) and Brisbane City Council — the only public source of statutory planning-scheme zoning is a government data layer hosted on a geospatial data provider's infrastructure in the United States. When you run a site or planning assessment for a property in one of those jurisdictions, we first resolve the property address to a map coordinate inside Australia, then send only that coordinate — a latitude and longitude — to the overseas government zoning layer to read the site's zone. We do not send the property address, your name, your account details or any other personal information with this lookup, and the lookup is read-only. For this zoning lookup: if the address cannot be resolved inside Australia, the lookup is not attempted and no coordinate is sent to these overseas layers. For Brisbane, a coordinate outside the council's data area is not sent. For the ACT, the coordinate is sent whenever the property is recorded as being in the ACT. If a lookup is attempted but fails or times out, the coordinate may already have been sent, no zone is read from the overseas layer, and we fall back to indicative zoning information. We record these government zoning endpoints, and the fact that only a coordinate is disclosed, in our internal cross-border disclosure register.

5.10 Other recipients

• The people you deal with. When you send a document, enquiry, project item, marketplace job or message through the Service, the recipient you nominate receives the information needed to view, respond, sign, quote, pay or collaborate. For a marketplace job, what each person sees, and when contact details are shared, is limited as described in Section 2.9.
• Our bank. To pay a referral reward by bank transfer, our bank receives the account name, BSB and account number you provide for the payment of referral rewards, and the payment amount, and uses them to make the transfer (see Section 2.3).
• Professional advisers. Our lawyers, accountants, auditors and insurers may receive information where reasonably necessary and under duties of confidentiality.
• Regulators and law enforcement. We may disclose information where required or authorised by Australian law.
• A successor. If our business is sold or restructured, personal information may transfer to the acquirer under equivalent privacy commitments.

We do not sell personal information, and we do not disclose it for third-party advertising.

5.11 Government spatial mapping service (Australia) — property map and planning overlay tiles

Where a property map or planning overlay renders on a site-intelligence surface, the User's browser loads the map's background tile imagery directly from a government spatial mapping service located in Australia. That service receives standard technical information, including the User's IP address and the bounding coordinates of the map tiles being requested. No other personal information accompanies this request.

5.12 SMS provider (United States)

Where you choose SMS-based verification, we use an SMS provider that sends verification codes to deliver a one-time code to the phone number you provide. That provider receives the phone number and the code needed to deliver the SMS. This is disclosed in advance: SMS-based verification has not yet gone live.

5.13 Accounting-software provider (New Zealand, Australia, United States)

Where you connect your accounting software, we disclose the relevant invoice, payment and contact records to an accounting-software provider headquartered in New Zealand, with data processing in Australia, New Zealand and the United States, to keep your accounting records in step. This is disclosed in advance: the accounting-software integration has not yet gone live.

5.14 Payment provider (Australia) — project invoice payments

Where a builder issues a project invoice and collects payment through the Service, we disclose the payer's email address, and the invoice amount and currency, to our Australian, AUSTRAC-registered payment provider, to create and process the payment. The provider operates in Australia; no cross-border disclosure applies. This is disclosed in advance: project invoice payment collection has not yet gone live.

6. Storage and security

We store customer personal information in Australia: our database, file storage, compute and secrets management are all in the Sydney region (ap-southeast-2). Personal information leaves Australia only through the overseas recipients identified in Section 5.

We take reasonable steps to protect personal information from loss, misuse and unauthorised access, modification or disclosure, including:

• Encryption — TLS 1.2 or higher in transit, and encryption at rest for file storage and the managed database.
• Access control — role-based access, least-privilege cloud roles, and multi-factor authentication on our staff cloud and code accounts.
• Auditing — durable, append-only logging of state-changing actions on envelopes, documents, payments and key records.
• Secret management — credentials and keys held in a managed secrets vault under least-privilege controls.
• Engineering controls — runtime scrubbing of credential-shaped values, automated checks against committing secrets, tenant-isolation controls and bounded payloads.
• Assurance — a defined incident-response process, independent security reviews and tracked remediation.

If we become aware of an eligible data breach under Part IIIC of the Privacy Act, we will notify affected individuals and the Office of the Australian Information Commissioner as required.

We take reasonable steps to keep personal information accurate, up to date and complete for the purpose for which it is held. Please tell us if your details change.

7. How long we keep information

We keep personal information only for as long as we need it for the purposes in this policy, or for longer where the law requires. The periods below apply.

Where you ask us to delete your personal information (Section 8), we do so except where we are required by law to keep it.

8. Your rights

You have the right to:

• Access the personal information we hold about you.
• Correct information you believe is inaccurate, out of date, incomplete or misleading.
• Delete your personal information, which we will do except where we are required by law to retain it.
• Port the personal information you have provided, in a structured, commonly used, machine-readable format where technically practicable.
• Object to direct marketing (see Section 9).
• Complain about how we have handled your personal information (see Section 12).

To exercise any of these rights, email privacy@urbanpulse.com.au. We will respond within a reasonable period and, for access and correction requests, no later than 30 days. We may need to verify your identity before we act.

9. Marketing

We send marketing only where you have expressly opted in through a clearly labelled consent. Every marketing email identifies Urban Pulse Strategies Pty Ltd as the sender, includes our ABN and Australian postal address, and includes a working unsubscribe link; every marketing SMS identifies us as the sender and includes an opt-out instruction (such as "Reply STOP to opt out"). We action unsubscribe and opt-out requests within five business days, and we keep consent and opt-out records to evidence our compliance with the Spam Act 2003 (Cth).

You can manage your preferences at any time by emailing privacy@urbanpulse.com.au. Service messages — such as sign-in alerts, document notifications, receipts and security notices — are not marketing and continue while your account is active.

10. Cookies and similar technologies

We use cookies and similar technologies for:

• Strictly necessary functions — keeping you signed in, remembering security preferences and protecting against attacks.
• Analytics — our analytics run without analytics cookies, using in-memory state rather than cookies or local storage.
• Referral links — if you arrive through someone's referral link, or type in a referral code, and then join the waitlist or sign up, we set a first-party cookie on our own site called UP_REFERRAL_CODE. It holds only that referral code (and whether you typed it in), and nothing that identifies you. We use it to credit the person who referred you once you have verified your email address and set up your account. It is not used for advertising or to track you across other sites. It expires after 30 days, or sooner once your account is set up.
• Embedded maps — where a Google map is displayed, Google may set or read its own cookies within the map frame; those cookies are controlled by Google.

Your browser lets you inspect and clear cookies. Clearing strictly necessary cookies will sign you out.

11. Children

The Service is intended for people aged 18 and over and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe we have, email privacy@urbanpulse.com.au and we will delete it.

12. Complaints

If you believe we have mishandled your personal information, please contact us first at privacy@urbanpulse.com.au. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days; if it will take longer, we will explain why and give you a revised timeframe.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC): oaic.gov.au · 1300 363 992 · GPO Box 5288, Sydney NSW 2001.

13. Changes to this policy

We update this policy from time to time. When we make a change, we update the version and effective date at the top and at the foot of this page, and describe the change below.

Material changes to what we do — new information we collect, a new recipient we disclose it to, or a change to your rights — take effect at least 14 days after we notify you by email or in-app notice.

Corrections and clarifications — where we improve how this policy describes something we already do, or disclose a practice before we start it, and what we do is unchanged — take effect when we publish them. Delaying a correction would only leave the published policy inaccurate for longer.

The current version applies from its effective date. We retain superseded versions unchanged; to request the text that applied to you at a given time, email privacy@urbanpulse.com.au.

Version 2.18.2 (effective 16 October 2026) makes one disclosure change. It discloses a practice before we start it, so it takes effect on publication:

• Section 5.14 is new. It discloses our Australian, AUSTRAC-registered payment provider as a recipient of the payer's email address, invoice amount and currency where a builder collects payment on a project invoice through the Service. This is disclosed in advance: project invoice payment collection has not yet gone live.

Version 2.18.1 (effective 12 October 2026) makes one disclosure change. It records a practice that is already disclosed above, so it takes effect on publication:

• Section 5.4: added the account administration service (United States) used when we create your account for you.

Version 2.18 (effective 2 October 2026) makes one disclosure change. It discloses a practice before we start it, so it takes effect on publication:

• Section 5.13 is new. It discloses an accounting-software provider (New Zealand, Australia, United States) as an overseas recipient where a user connects their accounting software. This is disclosed in advance: the accounting-software integration has not yet gone live.

Version 2.17 (effective 2 October 2026) makes one disclosure change. It does not change what we do, so it takes effect on publication:

• Section 2.4 adds that where you record an enquiry from a prospective client before it becomes a matter, we collect the enquirer's name, and their email address and phone number where you provide them, which we use to let you respond to the enquiry and, if you accept it, open a matter for that client.

Version 2.13 (effective 1 October 2026) makes three disclosure changes (PR #2813, referral payouts). Each describes something we already do or discloses a practice before we start it. None changes your rights, and it takes effect on publication:

• Section 10 adds the UP_REFERRAL_CODE cookie: a first-party cookie holding only a referral code, set when you join the waitlist or sign up through a referral link or code, used to credit the person who referred you once your email address is verified, and expiring after 30 days or sooner once your account is set up.
• Section 2.3 describes referral bank details as collected where you provide them for the payment of referral rewards, rather than where you choose a cash payout, and says that we disclose the account name, BSB, account number and payment amount to our bank to make each transfer. Section 2.3 also describes the record we keep of returned referral payments and the hold that applies after two returns.
• Section 5.10 adds our bank to the recipients listed there, for the payment of referral rewards.

Version 2.11 (effective 30 September 2026) makes three disclosure changes. None changes what information we currently collect or who we currently disclose it to. One removes a provider we no longer use, one discloses an SMS provider before we use it, as this section allows for a practice disclosed before we start it, and one corrects how we describe an existing lookup. All take effect on publication:

• Section 5.8 removes the entry for our former support-chat provider. We switched off in-product support chat and no longer send any information to a support-chat provider.
• Section 2.1 and Section 5.12 add that where you choose SMS-based verification, we collect the phone number you provide to send you a one-time verification code, and share it with an SMS provider that sends verification codes. This is disclosed in advance: SMS-based verification has not yet gone live.
• Section 5.9 now says exactly when a coordinate is sent to the overseas zoning layers, and that a lookup that fails or times out may already have sent it.

Version 2.10 (effective 30 September 2026) makes one disclosure change. It discloses a practice before we start it, so it takes effect on publication:

• Section 5.11 is new. It discloses that when a property map or planning overlay renders on a site-intelligence surface, the User's browser loads map tiles directly from a government spatial mapping service located in Australia, and that the service receives standard technical information, including the User's IP address and the bounding coordinates of the tiles requested.

Version 2.9 (effective 30 September 2026) makes one presentation change. It does not change what we do, so it takes effect on publication:

• Sections 2, 3, 4, 5 and 6 now describe overseas recipients by category and country rather than by name. The recipients, what each receives, the safeguards in place and the countries are unchanged.

Version 2.8 (effective 30 September 2026) makes four disclosure changes. Each describes something we already do, or discloses a practice before we start it, and none changes your rights. It takes effect on publication:

• Section 2.9 is new. It sets out what a marketplace job shows to people who are not signed in (the suburb and a short summary, never the street, the lot, an exact map position or the poster's contact details), to signed-in members before the award (the full address, but no contact details on either side), and how we mask phone numbers, email addresses, web links and social-media handles typed into a job, bid or message before the award, storing only the masked text. It also sets out that, after the award, a contact card can show the poster and each awarded trade the other side's name, email address and phone number, that nobody else sees it, and that we record each time a card is opened.
• Section 2.2 adds that files are stored and downloaded under a neutral name.
• Section 5.10 points to Section 2.9 for what the other people on a marketplace job receive.
• Section 7 adds that the record of each time a contact card is opened is kept for the same 7 years as the audit log.

Version 2.7 (effective 30 September 2026) makes one disclosure change. It discloses a practice before we start it, so it takes effect on publication:

• Section 2.2 adds that you can upload photos and videos to a project or listing, and that we remove location and camera details from them after the virus scan, before anyone else can open them.

Version 2.6 (effective 29 September 2026) makes one disclosure change. It does not change what we do, so it takes effect on publication:

• Section 2.4 adds that where you log time or costs against a matter, we record who logged each time entry, its date, the time spent and any rate, stage label or note you add, and for each cost its date, the supplier or what it was for, the amounts and any receipt you upload, which we use to show your firm the time and costs recorded on that matter and each person their own weekly timesheet.

Version 2.5 (effective 26 September 2026) makes one disclosure change. It does not change what information we collect, who we disclose it to, or your rights, so it takes effect on publication:

• Section 2.5 and Section 7 restate how we handle enquiry-form submissions our spam checks hold for review: what a held submission contains, that authorised staff may review it and either release it (it is then handled as an ordinary enquiry) or dismiss it as spam, that it is not used for any other purpose, and that a held submission that is not released, including one dismissed as spam, is permanently deleted 30 days after we receive it.

Version 2.4 (effective 21 September 2026) makes one disclosure change, describing a new step in how we already handle contact-form enquiries:

• Section 2.5 and Section 7 add that where our automated spam checks flag a contact-form submission, we now hold it in a review queue rather than immediately and permanently discarding it, so a team member can recover a genuine enquiry the check wrongly caught. Previously, a flagged submission was not stored at all. The visitor-facing response is unchanged — everyone who submits the form sees the same confirmation.

Version 2.3 (effective 27 August 2026) makes one disclosure change. It does not change what we do, so it takes effect on publication:

• Section 2.4 adds that when you send a job-invite referral link to a contractor who does not hold an account, we collect the email address you provide and use it only to help you share that invite — we do not send it on your behalf — and not for marketing or any other purpose. This is disclosed in advance: the referral-invite feature has not yet gone live.

Version 2.2 (effective 26 August 2026) makes one disclosure change. It does not change what we do, so it takes effect on publication:

• Section 2.1 records that we keep the individual account-holder's own name and email address as a separate record, distinct from your organisation's own business profile. Sign-up already asked for this name and email; this correction names the separate record we keep of it.

Version 2.1 (effective 8 August 2026) makes three disclosure changes. None changes what we do, so both take effect on publication:

• Section 5.9 adds a government geospatial data provider (United States) as a coordinate-only overseas recipient for the government planning-scheme zoning used by our planning and site-intelligence features. This corrects an omission: the lookup described in Section 5.9 was already running when Version 2.0 was published, and Version 2.0 did not identify it. Nothing about the lookup changes — only its disclosure.

• Section 2.8 and Section 3 describe the personal information contained in real-estate listings where an agency account holder connects a listing feed, and record that we receive it from that agency's listing system rather than from each individual named in a listing. This is disclosed in advance: the feed intake is not yet operating.

• Section 2.4 records that when a project, contract, document set or thread is shared with someone outside the organisation that owns it, we keep a record of who was given access, at what level, why, by whom, and when it started and ended. This is disclosed in advance: the capability is built but not switched on.

Version 2.0 (effective 1 August 2026) was a full rewrite of the policy.

Version: 2.18.2 · Effective from: 16 October 2026 Issued by Urban Pulse Strategies Pty Ltd (ABN 82 650 700 226). Questions: privacy@urbanpulse.com.au.