Privacy Policy

Heritage Melbourne is a platform for discovering Melbourne's distinctive apartments and the agents who represent them, operated by Heritage Melbourne Pty Ltd (ABN 50 699 399 043). We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy explains what we collect, why, how we protect it, who we share it with, and the choices and rights you have.

See also our Collection Notice — a short, plain-English summary of the same thing.

1. The information we collect

We collect only what we reasonably need to run the platform:

• Account information — the email address you sign in with, and (for agents) your professional profile details.
• Enquiry details — the name, email, phone and message you choose to send an agent, or provide when registering for an inspection or requesting an appraisal. These are shared with the relevant agent so they can respond.
• Newsletter subscriptions — the email address and preferences you submit when you opt in to the newsletter.
• Saved searches and preferences — the searches, alerts and saved properties you choose to keep.
• Agent and agency records — for agents who advertise with us, the profile, listing and billing information needed to run that relationship.
• Our usage analytics — how the platform is used (pages viewed, searches run, listings and buildings browsed, links and buttons used, how far down a page you read, and whether a form was started or left unfinished — never what you typed into it). This is recorded against a random identifier stored in your browser — not against your name. Where available we record only a coarse location (country and state or region) — never your precise location or GPS — and we do not store your raw IP address.

We usually collect this directly from you. If you submit a Facebook or Instagram instant form, Meta sends us the contact details and answers you submit. We may also receive information about you from an agent or agency you have dealt with. We do not ask you to provide sensitive information as that term is defined in the Privacy Act.

2. Browsing and usage analytics

You may browse Heritage Melbourne without identifying yourself, and you have the option of dealing with us anonymously or by pseudonym where it is lawful and practicable (APP 2). Our own usage analytics use a random browser identifier: we do not link them to your identity unless you are signed in and have given us your express, opt-in consent to do so (see section 5). The site is fully usable whether or not you consent.

We also use Google Analytics to understand how the site is found and used. We do not link it to your account, and section 6 sets out what it receives.

3. Cookies and local storage

We use first-party browser storage to keep you signed in, to remember your preferences, and to hold the random identifier used for our usage analytics. Google Analytics and the Meta advertising pixel each set their own identifier in this browser so repeat visits can be recognised as the same visitor. While advertising measurement is on, we also keep a count in this browser of how many separate times you have opened each listing, so we can tell Meta when you return to one; it is erased if you opt out. Meta may match the activity it receives to your Meta account. You can clear this storage in your browser at any time, though doing so will sign you out.

4. Why we collect it

We collect and use personal information to:

• operate the platform, your account, and the agent–buyer enquiry process;
• send service messages and, where you have opted in, saved-search alerts and newsletters;
• administer our relationships with agents and agencies, including billing;
• understand and improve how the platform is used, and to build aggregate, de-identified insight about property demand (a data asset we own);
• keep the platform secure and prevent abuse;
• measure and improve our advertising, and show relevant ads (see section 7); and
• comply with our legal obligations, resolve disputes, and — as a disclosed standing purpose — transfer information as part of a possible sale, merger or restructure of our business (see section 6).

5. Linking analytics to your account (opt-in only)

Today our own usage analytics are not linked to your identity. If we introduce identity-linked analytics in future, it will be strictly opt-in: we would link your usage to your account only with your express, specific consent — never bundled into our terms, never pre-ticked, and never required to use the site. You would be able to withdraw that consent at any time, and each consent would be recorded. We also honour browser Global Privacy Control and Do Not Track signals as a request not to link your activity. This is separate from the Meta advertising matching described below.

6. How we share information

• Agents — your enquiry, inspection or appraisal details are shared with the agent you contacted so they can respond. For a property enquiry or inspection request, every agent representing that listing receives it. This also applies to buyer requests submitted through a Meta instant form. From that point the agents hold their own copies and handle them under their own legal obligations. An enquiry does not subscribe you to our newsletter; we do that only when you expressly request it.
• Service providers — we use trusted providers to run the platform, including Supabase (database and hosting), Vercel (application delivery), and providers for email, telephony and maps. They process data on our behalf under contract.
• Meta (Facebook and Instagram) — we use the Meta advertising pixel and server-side event reporting to measure and improve our ads and reach people with relevant content. We report pages and property listings viewed and what you did on a listing: whether you spent more than a few seconds reading it, came back to it, looked through its photos, opened its floor plan or price statement, checked its inspection times, or saved or shared it. We also report searches with the price and bedroom ranges you chose, building alerts, agent-number reveals and taps to call or email an agent, enquiry, inspection and appraisal forms opened, started or left unsent, enquiries, private inspection requests, open-inspection registrations, appraisals, account registrations and newsletter signups. Meta also receives browser and click identifiers where available, your IP address and browser information. For submitted enquiries, appraisal requests, private inspection requests, open-inspection registrations and newsletter signups, we may send hashed email addresses and phone numbers where supplied from our servers to help Meta match the outcome to its users. While you are signed in, we may also send the hashed email address and phone number on your account, and a hashed account identifier, with the events above. Hashing transforms the details before transmission; it allows matching and does not make them anonymous to Meta. We do not send Meta your name, what you typed into a search box or a form, enquiry text or other free-text answers. When you reveal an agent's number we send the fact that you asked, never the number. The advertising opt-out in section 7, Global Privacy Control and Do Not Track stop both browser and server-side reporting from this site. If you submit a Meta instant form, Meta already holds the details you give it and handles them under its own policy.
• Google Analytics — we use Google Analytics to understand how people find and use the site: which pages you viewed, which listings you opened, whether you ran a search, whether you sent an enquiry, requested an appraisal or created an account, roughly where in the world you are, and which site or search brought you here. We use it to see which parts of the platform work, not to identify you. We do not send Google your name, email address, phone number, what you typed into a search box, or anything you write in an enquiry, and we do not link what it records to your account. Google receives your IP address in order to derive that rough location and does not make it available to us. The same Don't track me control described in section 7 stops Google Analytics loading, and it is not loaded at all if your browser sends a Global Privacy Control or Do Not Track signal.
• We do not sell information that identifies you. We do not sell or licence person-level behavioural profiles, and we do not provide your details to third parties for their own independent marketing.
• De-identified data — we may create, use, licence or sell data that has been de-identified so it is no longer about an identifiable person. Where we ever offer records that still identify you, we would do so only with your separate, specific consent.
• Legal and safety — we may disclose information where the law requires or permits it, or to protect people, property or the platform.
• Business transfers — if our business (or part of it) is sold or merged, information held by the business may transfer to the new owner, who must continue to handle it under this policy and the Privacy Act.

7. Direct marketing and advertising

Newsletters and alerts are opt-in. Every marketing message identifies us and includes a working unsubscribe link, and you can change your preferences at any time. If you unsubscribe we keep a record of that request so we can honour it. We do not use our own usage analytics to decide who to email.

Advertising is separate. Because our site carries the Meta advertising pixel, Meta may use the fact that you visited to show you our ads on Facebook or Instagram. We have linked Google Analytics to Google Ads to measure whether Google advertising leads to enquiries or account registrations. The link also makes Google Analytics audiences available for targeting our Google ads. The same control below turns off both the Meta pixel and Google Analytics.

You can opt out of advertising measurement and matching at any time — there is a Don't track me control at the bottom of this page, and the same switch sits under Privacy & data in your account settings if you have an account. Either one stops both the Meta pixel and Google Analytics loading on this browser, including for the page you are on, and stops our server-side Meta reporting for submissions from that browser. You can also turn on Global Privacy Control or Do Not Track in your browser, which we honour as a standing refusal, or manage what Meta shows you in Meta's own ad settings. Your choice is stored in this browser, so clearing your browsing data clears it too, and the site works exactly the same either way.

8. Where your information is held

Our primary database is hosted in Australia (the Sydney region). Some application delivery, email, telephony and logging is processed at global edge locations or in the United States by our providers; where this occurs we take the reasonable steps APP 8 requires, and we discard raw IP addresses at the point of collection to minimise what is processed.

Separately, the tools described in section 6 disclose information overseas: browsing activity and hashed contact details from submissions and signed-in accounts for advertising matching to Meta Platforms, Inc. in the United States, and browsing activity to Google LLC in the United States for Google Analytics. Those providers handle the information under their own terms and privacy policies. Each is an overseas disclosure for the purposes of APP 8. Reporting from this site stops if you use the Don't track me control or your browser sends a Global Privacy Control or Do Not Track signal.

9. Data security

We protect personal information with technical and organisational measures, including access controls, encryption in transit and at rest, role-based permissions, and keeping the keys that could link usage data to a person strictly separated and access-limited. No system is perfectly secure, but we take our obligations under APP 11 seriously and have a data-breach response process.

10. How long we keep it

We keep personal information only as long as we reasonably need it for the purpose it was collected for, to operate the platform, or to meet a legal or dispute-resolution requirement — after which we destroy or de-identify it. Aggregated, de-identified insight may be kept longer, as it is no longer about you. Account and enquiry records are kept for as long as your account is active or as required by law.

11. Your rights

You can ask us to:

• Access the personal information we hold about you;
• Correct information that is wrong, out of date or incomplete;
• Withdraw any consent you have given; and
• Delete your personal information, where we are not required to keep it. We sever any link to your identity and recompute our aggregates so your identified contribution is removed.

To make a request, email info@heritagemelbourne.com. We may need to verify your identity first. We will respond within a reasonable period — usually within 30 days — and there is no charge for making a request.

Note that an agent you contacted holds their own copy of your enquiry. To have that copy accessed, corrected or deleted, you will need to ask them directly.

12. Children

Heritage Melbourne is intended for adults — buyers, vendors and property professionals. It is not directed at children and we do not knowingly collect their personal information.

13. Complaints

If you have a privacy concern, please contact us first at info@heritagemelbourne.com so we can resolve it. We will acknowledge your complaint, investigate it, and write to you with the outcome — normally within 30 days.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

14. Contact and changes

Heritage Melbourne Pty Ltd · ABN 50 699 399 043

Email: info@heritagemelbourne.com · Telephone: (03) 9000 0175

Post: PO Box 1178, Kensington VIC 3031

We may update this policy from time to time. The current version and effective date appear at the top of this page, and for material changes affecting how we use information about you we will take reasonable steps to let you know.

Heritage Melbourne Pty Ltd · ABN 50 699 399 043 · Version 2026-10-08 · Effective 8 October 2026