Effective 7 August 2026. This policy is issued by XTO Pty. Ltd.
(ACN [ACN NOT SET]) of , Australia.
XTO Pty. Ltd. operates suburbrank.com.au and the calculators published on it.
SuburbRank is one of them, and is the one this policy is being shown to
you from. The same policy applies to all of them.
1. About this policy
This policy explains how XTO Pty. Ltd. (we, us,
our) collects, holds, uses and discloses personal information, and how you
can access, correct or complain about it. We handle personal information in accordance with
the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
It applies to suburbrank.com.au and to every email we send you. It does not apply to any
third party site we link to.
2. What we never collect
We do not ask for, and you should never send us, your Medicare number, tax file
number, a tax file number, a bank account number, a credit file, a driver licence or any other government identifier, bank account details or card number.
The calculator does not need them. If you send one to us anyway we will delete it rather
than store it.
We do not collect sensitive information as defined in the Privacy Act — health information,
racial or ethnic origin, political or religious beliefs, sexual orientation, or criminal
record. Where the calculator asks about care needs it asks about funding categories, never
about a medical condition.
3. What we collect, and why
Information you give us
- Account details — first and last name, email address, and optionally
phone, suburb, state, postcode and your relationship to the person entering care. Used to
create and secure your account and to deliver what you bought.
- Saved reports — the figures you entered and the results produced,
stored against your account only if you choose to save one. Used so you can
return to and compare them.
- Purchases — the order, amount, currency, access period and the PayPal
transaction reference. Used to grant access, issue receipts and meet our tax and record
keeping obligations.
- Correspondence — what you write to us and our reply. Used to answer you
and to resolve disputes.
- Email estimates and reviews — the email address you give us to receive a
free estimate, and any review you submit for publication.
Information collected automatically
- Technical data — IP address, browser user agent, device type, screen and
viewport size, and the referring page.
- Activity data — the pages you open, the order you open them in, time
spent on each, how far you scroll, which calculator steps you complete, and which buttons
you press. Used to understand where the site is confusing and to improve it.
- Advertising identifiers — where you arrive from an advertisement, the
click identifier appended to the link (for example Google's gclid) and any
campaign parameters, so we can measure which advertising works.
4. Where the calculation happens
In your browser, on your device. The figures you type into the calculator are
processed locally to produce your result. They are transmitted to us only if you choose to
save a scenario to your account. If you never save one, we never receive them.
Two exceptions, and both are things you have to choose to do:
- If you ask us to email your free estimate, the headline figure that
estimate produced is stored with your email address so the estimate we send you is the
one you saw.
- If you use the optional report assistant, the figures in the report you
have open are sent to us and on to the service that answers it. That is the only part of
this site that sends anything to a third party, and section 5 sets out exactly what does
and does not travel.
5. The report assistant
A paid report comes with an optional assistant you can ask questions about
your own figures. It is the one part of this site that sends anything to a third party, so
it is set out here in full.
It is entirely your choice, and it does nothing until you use it. Nothing is
sent anywhere unless you open the assistant and ask a question. If you never open it, this
section does not apply to you at all, and the rest of the report works exactly the same.
What is sent when you do ask
- A plain-text summary of the figures in the report you have open — the
amounts, categories and comparisons the report already shows you on screen.
- The question you typed, and the questions and answers already in that
conversation, so a follow-up makes sense.
What is not sent
- Your name. The name field on the calculator is optional and is used only
on your own report cover. It is not part of what the assistant is given.
- Your email address, your account, your phone number or your street address.
The assistant is not told who you are, and is given no way to find out.
- Your Medicare number, tax file number, a tax file number, a bank account number, a credit file, a driver licence or any other government identifier, bank account or card
details — we never hold these in the first place. See section 2.
What travels is a set of amounts and categories. On its own it does not
identify anybody, and we do not send anything alongside it that would.
Who processes it
The request is answered by Google's Gemini API, which processes it outside
Australia — see sections 10 and 11. We do not train any model on your figures and we have no
arrangement permitting anyone to do so; what Google does with data sent to its API is
governed by its own terms, which we do not control.
How long it is kept
- The summary of your figures is held in our server's memory for one hour
so a conversation does not have to re-send it with every question, and is then
discarded. It is never written to our database.
- The conversation itself is stored in your own browser tab and is gone
when you close that tab. We do not keep a copy.
- We record that a question was asked, and how long it was, so we know
whether the feature is used. We do not record what it said.
Because the assistant is optional, you can have the entire paid report without any of the
above ever happening. Nothing in the report is withheld from somebody who never opens it.
6. Cookies and browser storage
We use the following, and nothing else:
- An authentication cookie — set only when you sign in, so you stay signed
in. Strictly necessary.
- A guest identifier — so a scenario saved before you register can be
attached to your account when you do.
- A session key (browser session storage) — identifies one visit for the
activity data described above. It is a random value and is discarded when you close the
tab.
- A visitor key (browser local storage) — a random value kept for up to
twelve months so we can tell a returning visitor from a new one. It contains no personal
information and is not shared with anyone.
- Preferences — your light or dark theme choice.
You can clear or block these through your browser at any time. Clearing them will sign you out
and reset your preferences; the site will otherwise work normally.
7. Analytics and advertising
We use Google Analytics and Google Ads to measure how people
find and use the site and whether our advertising is worth running. Where these are enabled,
Google receives your IP address, device and browser information, the pages you viewed, and —
when you complete a purchase — the order reference and the amount paid. Google may set its own
cookies and may combine this with data it holds from other sources. Google's handling of that
data is governed by its own privacy policy, not ours.
We do not sell your personal information, and we do not disclose it to data brokers,
advertising networks other than as described above, any government identifier, or any detail of your finances beyond the budget figure you type into the tool, or anyone who might try to sell you something.
You can opt out of Google Analytics using Google's browser add-on, and you can adjust
personalised advertising in your Google account settings.
8. Payments
Payments are processed by PayPal. Your card or account details are entered on
PayPal's systems and are never transmitted to, seen by, or stored on our servers. We receive
only the transaction reference, the amount, the status and the email address associated with
the payment.
9. Who we disclose information to
- Service providers who host the site, send our email and process payments,
and only so they can perform that function.
- Google, as described in sections 5 and 7.
- Professional advisers — our accountants and lawyers, under obligations of
confidence.
- A purchaser of our business, if it is ever sold, on terms that require
them to honour this policy.
- Law enforcement, courts or regulators, where we are required or
authorised by law.
10. Overseas disclosure
Some of these providers store or process data outside Australia, principally in the
United States (Google, PayPal) and, depending on our email provider, in other
countries. By using the site you acknowledge that we take reasonable steps to ensure overseas
recipients handle your information consistently with the APPs, but that we cannot control and
are not accountable for how an overseas recipient handles it once disclosed, and that you may
not be able to seek redress in that jurisdiction.
11. Security
The site runs entirely over HTTPS. Passwords are stored as salted PBKDF2 hashes, not as text
anyone here can read. Access to the database is restricted to those who need it. No system is
perfectly secure, and we cannot guarantee the security of information transmitted over the
internet, but we take reasonable steps to protect it from misuse, interference, loss and
unauthorised access, modification or disclosure.
If a data breach occurs that is likely to result in serious harm, we will notify you and the
Office of the Australian Information Commissioner as required by the Notifiable Data Breaches
scheme.
12. How long we keep it
- Account and saved reports — until you delete them or ask us to.
- Order and payment records — seven years, as required by Australian tax
law. We cannot delete these earlier, even on request.
- Activity data — up to twenty‑six months, then deleted or grouped so it
no longer identifies anyone.
- Email leads — until you unsubscribe, then only the record needed to
honour that unsubscribe.
13. Direct marketing
If you give us your email address for a free estimate we may follow up about the full report.
Every commercial email we send identifies us and carries a functional unsubscribe link, as
required by the Spam Act 2003 (Cth). We action unsubscribes immediately. You will
still receive transactional email — receipts, access details and password resets — because
those are not marketing.
14. Accessing, correcting and deleting your information
Write to support@suburbrank.com.au. We will:
- give you access to the personal information we hold about you, or explain why we cannot;
- correct anything inaccurate, out of date, incomplete, irrelevant or misleading;
- delete your account and every scenario attached to it, subject to the retention periods in
section 12.
We will respond within 30 days and will not charge you for making a request.
We may need to verify your identity first.
15. Complaints
If you think we have breached the APPs, write to support@suburbrank.com.au
with "Privacy complaint" in the subject line. We will acknowledge within 5 business days and
respond substantively within 30 days.
If you are not satisfied with our response, you may complain to the Office of the Australian
Information Commissioner: oaic.gov.au, 1300 363 992, or GPO Box 5288, Sydney
NSW 2001.
16. Children
The site is intended for anyone deciding which Australian suburb to buy an investment property in. It is not directed at
children and we do not knowingly collect personal information from anyone under 18.
17. Changes to this policy
We may update this policy. The effective date at the top changes when we do. Where a change is
material we will tell you by email or by notice on the site before it takes effect. Continuing
to use the site after that means you accept the updated policy.
18. Contact
Privacy Officer
XTO Pty. Ltd. (ACN [ACN NOT SET])
support@suburbrank.com.au