Privacy Policy

Girilang ("we", "us", "our") is committed to protecting the privacy of all users of our platform. This policy describes what personal information we collect, why we collect it, how we use and protect it, and your rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By creating an account or using the Girilang platform, you agree to the collection and use of information as described in this policy.

1. Who we are

Girilang is an all-in-one management platform for sharehouses and boarding houses, serving property managers, owners, and tenants primarily in New South Wales and Victoria, Australia. Our platform supports tenancy management, maintenance coordination, payments, lease execution, condition reporting, key management, and day-to-day property operations.

For privacy enquiries, contact us at privacy@girilang.com .

2. Information we collect

Account information

When you create an account we collect your name, email address, and where applicable a profile photo. Passwords are securely hashed and are never stored in plain text.

You may instead sign in using a Google, Apple, or Microsoft account, in which case we receive your name and email address from that provider. If you change the email address used to sign in, the change takes effect only after you confirm it from the new address.

Passkeys and biometric sign-in

If you set up a passkey, we store a public key, a credential identifier, the credential's transport methods and sign-in counter, and a general description of the device that created it (for example "iPhone" or "Mac") so you can recognise and revoke it later. Your fingerprint, face, device passcode, and the corresponding private key never leave your device and are never transmitted to or stored by Girilang. You can remove a passkey at any time from Account → Security.

Property and tenancy information

Managers and owners may enter property addresses, room configurations, and tenancy details including tenant names, contact information, lease dates, bond amounts, and weekly rent. This information is stored on your behalf to deliver the core features of the service.

Financial information

We record rent amounts, payment statuses, utility bill amounts, and cost allocations within the platform. We do not store payment card numbers or bank account credentials — these are handled directly by third-party payment processors.

Signatures and signed documents

When you sign a document through the platform, we capture your electronic signature as a digital image together with a timestamp, IP address, and device information. These details form part of the legally admissible audit trail attached to each signed document. Completed documents including signature images are retained for the purposes described in section 7.

Photos and media

Users may upload photographs in connection with maintenance requests, condition reports, property marketing, and room management. These images are stored securely and access is restricted to authorised parties within the relevant property organisation.

Maintenance and communication records

Maintenance job descriptions, status updates, vendor details, and associated notes and files are stored within the platform. Messages and notifications sent via the platform are retained to provide a communication history.

Documents and condition reports

Lease agreements, condition reports, house rules, disclosure statements, and other property documents uploaded to or generated within the platform are stored securely with access controls that restrict visibility to authorised parties only.

Support enquiries

When you submit the support form on our website — which you may do without an account — we collect your name, email address, the organisation name you optionally supply, and the topic, subject, and content of your message. The enquiry is stored so we can track and answer it, and a copy is emailed to our support team with your address set as the reply-to address. To prevent the form being used to flood our inbox, we also record a one-way cryptographic hash of your email address and of your network address together with a submission count; the underlying address is neither stored nor written to our logs.

Location information

Certain features — such as verifying proximity to a property when accessing key management tools — may request access to your device's location. This access is voluntary and prompted explicitly by the browser or operating system. We do not continuously track your location, and your coordinates are not transmitted to or stored on our servers — they are used on your device only, for the specific in-session check you initiate. You can withdraw this permission at any time from Account → Privacy or in your browser or device settings.

Device and security identifiers

To protect the platform against automated misuse and fraudulent access, we use device attestation technology that collects limited device and application identifiers. This information is not used for advertising and is processed solely for security purposes.

Usage and technical data

We automatically collect limited technical data when you use the platform, including device type, browser type, IP addresses recorded in activity and audit logs, and interaction logs. This data is used solely to maintain platform reliability, diagnose errors, provide the audit trail functionality described in these policies, and improve the service.

3. How we use your information

• To provide, operate, and improve the Girilang platform and its features.
• To send transactional notifications such as lease signing invitations, signing reminders, rent reminders, and maintenance updates.
• To enable managers, owners, and tenants to collaborate on property management tasks.
• To generate lease documents, condition reports, and other property records on your behalf.
• To maintain a legally admissible audit trail for signed documents and key actions.
• To assist with producing listing descriptions and property marketing content using information you provide (processed entirely on our servers — your data is not used to train third-party AI models).
• To comply with our legal obligations under applicable NSW and Victorian tenancy and boarding house legislation.
• To respond to support enquiries and resolve technical issues.
• To authenticate you, including verifying passkeys you have registered, and to detect and prevent fraudulent access, spam, and automated misuse of our sign-in and public support forms.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4. How we share your information

We share personal information only in the following circumstances:

• Within your organisation: Managers, owners, and tenants within the same property organisation can view information relevant to their role. Access is governed by role-based permissions enforced throughout the platform.
• Lease signing parties: When a lease is sent for signing, the names and email addresses of all signatories are visible to the manager and other parties to that document as required for the execution process.
• Service providers: Google Firebase provides authentication, cloud functions, database, and file storage services; Google, Apple, and Microsoft process information when you choose their sign-in services; and Resend delivers service emails. These providers process information under their own privacy terms and our instructions. We require service providers that handle Girilang data to provide protections consistent with this policy and applicable privacy law.
• Optional integrations: If you choose to connect third-party accounting or other services (such as Xero), relevant financial data will be shared with those services in accordance with their own privacy policies. You control which integrations are enabled.
• Legal requirements: We may disclose information if required by law, regulation, or valid legal process, or to protect the rights, property, or safety of Girilang, its users, or the public.
• Business transfers: If Girilang is acquired or merges with another entity, your information may be transferred as part of that transaction. We will notify users before any such transfer and before information becomes subject to a different privacy policy.

5. Data storage and security

Your data is stored on infrastructure located in Australia. We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, disclosure, alteration, and destruction.

Data in transit is encrypted. Data at rest is encrypted. Access to your data is controlled by role-based permissions that restrict reads and writes to authenticated users with appropriate authorisation. Sensitive documents such as signed leases and signature images are accessible only via short-lived, time-limited secure links.

Despite these measures, no internet-based service can be guaranteed completely secure. If you become aware of a security vulnerability or suspected data breach, please contact us immediately at security@girilang.com .

6. Your rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate, incomplete, or out-of-date personal information.
• Request deletion of your account and associated personal data from Account → Security → Delete account in the iOS app, or by contacting us, subject to our legal record-keeping obligations (see section 7). Deleting your account removes your sign-in credentials, profile, personal files, and your membership of any organisation. Records owned by an organisation — properties, tenancies, signed leases, and financial records — belong to that organisation and are retained under section 7. If you are the owner of an organisation, ownership must be transferred to another member before the account can be deleted.
• Complain about how we have handled your personal information. Complaints may be directed to us at privacy@girilang.com, or escalated to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

To exercise any of these rights, contact us at privacy@girilang.com . We will respond within 30 days.

7. Data retention

We retain your personal information for as long as your account is active or as needed to provide the service. Specific retention periods by data type:

• Tenancy records, signed leases, and financial records — retained for up to seven years after the end of the relevant tenancy to satisfy Australian tax and tenancy record-keeping obligations, even after account closure.
• Archived properties — when a property is archived, its data (including all associated rooms, documents, and media) is retained for 30 days and then permanently and irreversibly deleted from our systems.
• Condition reports and maintenance records — retained for the duration of the relevant tenancy and for such further period as may be required by applicable legislation.
• Audit logs for signed documents — retained indefinitely as part of the legally admissible record of the signing event.
• Passkey credentials — retained until you remove the passkey or delete your account, whichever is earlier.
• Support enquiries — retained for up to two years so we can refer back to your support history, then deleted. The hashed identifiers used for rate limiting are held only as counters and are reset once the limiting window expires.
• Usage and technical logs — retained for up to 90 days for diagnostic purposes, then deleted.

When data is no longer required, it is securely deleted from our systems and those of our service providers in accordance with our data processing agreements.

8. Cookies and tracking

Girilang uses session cookies and browser local storage to maintain your login session and application preferences. We use device and application verification technology to protect the platform from automated misuse. We do not use third-party advertising cookies or behavioural tracking technologies.

9. Children's privacy

The Girilang platform is intended for adults aged 18 and over. We do not knowingly collect personal information from persons under 18 years of age. If you believe a minor has provided us with personal information, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "last updated" date at the top of this page. Where changes are material, we will notify registered users by email. Your continued use of the platform after any changes constitutes acceptance of the updated policy.

11. Contact us

For any privacy-related questions, requests, or complaints: