Brevity Bookings
Last updated: 8 August 2026
This Privacy Policy applies to all personal information collected by BrevitLab Operations Pty Ltd (ABN 52 700 825 332; ACN 700 825 332) trading as Brevity Bookings (we, us or our) via the website located at BrevityBookings.com (Website). Brevity Bookings is a private, invite-only web application designed for owners of holiday and short-term rental properties. The platform provides a shared booking calendar, guest management tools, a financial ledger with Australian financial-year reporting, and cleaning and maintenance job tracking. Brevity Bookings is not a marketplace, does not facilitate or process payments between property owners and guests, and does not hold client money or trust accounts. The platform is currently operating as a free beta service ahead of a planned paid launch.
We comply with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs) in full.
The service is intended for use by adults only — you must be of legal age to form a binding contract in your jurisdiction to register for or use the platform. By registering, you confirm that you meet this requirement.
The kind of Personal Information we collect from you will depend on how you interact with the Website. Anyone may self-register as an Owner/Member to manage their own property. Access to an existing property is gated by that property's administrators: a Guest User account may be created by accepting an invitation from an existing Owner/Member, or by self-registering on a property's login page — in either case, access to the property's calendar and records is granted only if and when a property administrator approves the membership. A separate Booking Request form is available via an owner-shared link; submission of that form does not create an account or grant access to the platform.
The Personal Information we collect and hold about you will depend on which of the following categories applies to you:
(a) Owner/Member — a user who self-registers, optionally subscribes, and administers one or more properties. We collect: full name; email address; password (stored in hashed form using bcrypt — never stored as plain text); cookies and session identifiers (authentication session token); the address of the rental property being administered (a free-text field describing the managed property, not the individual's personal home address); documents and images you choose to upload to the platform — such as receipts, invoices, quotes, and maintenance or property photos — which may contain personal information about third parties (for example, a tradesperson's name and contact details on an invoice); and, once billing is activated, a Stripe customer and subscription reference ID (we do not receive or store card numbers — Stripe handles payment card data directly). When a login is attempted on your account (successfully or unsuccessfully), we record the IP address, approximate country, and browser (user-agent) of the attempt, together with the email address used, in a security audit log; this data is used for rate limiting, account-lockout protection, and to alert you by email to logins from a new location. This applies to any login attempt, including attempts made using an email address that is not registered with us.
(b) Guest User — a user who joins a property either by accepting an invitation from an existing Owner/Member, or by self-registering on the property's login page. A self-registered account is created immediately but remains pending — with no access to the property's calendar or records — unless and until a property administrator approves it. We collect: full name; email address; password (stored in hashed form using bcrypt — never stored as plain text); and cookies and session identifiers (authentication session token). Login security data is handled as described in (a).
(c) Booking Request (request only) — a prospective guest who submits a Booking Request via an owner-shared link. Submission does not grant platform access; an Owner/Member must approve the request before any account is created, and the person submitting the request may never become a user. We collect: full name; email address; phone number (optional); IP address (logged for rate-limiting and audit trail purposes); and a free-text message. This information is held solely for the purpose of processing the request and will not be used for any other purpose without your consent.
(d) Referred or invited person — where an existing Owner/Member refers or invites you to a property, we collect from the referrer your full name and email address (and, for referrals, an optional message about you), so that the property's administrators can decide whether to invite you and so we can deliver the invitation. If the referral or invitation is not taken up, this information is handled in accordance with the retention rules in section 6.
(e) Waitlist subscriber — a visitor who joins the pre-launch waitlist on our public website. We collect: email address; your name (optional); the number of properties you manage (self-reported); and, where our hashing key is configured, a salted one-way hash derived from your IP address (used solely for abuse prevention — the IP address itself is not stored). Joining the waitlist does not create an account and grants no access to the platform. This information is used only for the communications described in section 5 and is handled in accordance with the retention rules in section 6.
The Privacy Act defines types of information, including Personal Information and Sensitive Information.
Personal Information means information or an opinion about an identified individual or an individual who is reasonably identifiable. If the information does not disclose your identity or enable your identity to be ascertained, it will in most cases not be classified as Personal Information and will not be subject to this Privacy Policy.
Sensitive Information is defined in the Privacy Act as including information or opinion about such things as an individual's racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record or health information.
We do not request or require Sensitive Information. Free-text fields (such as booking comments or maintenance descriptions) are intended for operational property matters, and we ask that you do not submit Sensitive Information through them. If we ever propose to collect Sensitive Information in the future, we will only do so with your express consent and in accordance with the Privacy Act, and we will update this Privacy Policy before doing so.
We collect Personal Information from you whenever you input such information into the Website or provide it to us in any other way.
In some cases, Personal Information may be provided to us by a third party — for example, where an Owner/Member enters booking details or contact information on behalf of a guest or family member, refers or invites another person to the property (see section 1(d)), uploads a document that contains another person's details, or records a guest review naming its author. Where this occurs, we require the Owner/Member to warrant that the information is accurate and provided with the individual's knowledge and consent, and we will take reasonable steps to make you aware that your information has been collected.
Because the platform provides private, account-based access to property and financial records, it is not practicable for us to deal with you anonymously or by pseudonym.
Cookies and analytics. We use one essential cookie: a secure, httpOnly session cookie used solely for authentication purposes. This cookie is necessary for the platform to function and cannot be opted out of while using the service. We do not use marketing, advertising, or third-party tracking cookies, and we do not deploy any cross-site tracking technologies or marketing pixels. We also use Vercel Web Analytics to collect aggregate, anonymised site-usage statistics. Vercel Web Analytics is cookieless and does not collect personally identifiable information. It is not possible to identify you personally from our use of these analytics.
We collect Personal Information to provide you with the Services, to operate and secure the Website, and — where you have opted in — to keep in touch with you about developments in our business.
Where we use de-identified and aggregated data to understand how the platform is used and to improve the Services, personal identifiers, entity names, property addresses and guest contact details will be removed or replaced, and financial amounts and dates will be rounded or offset, so that individuals and properties cannot reasonably be re-identified. We will not attempt to re-identify such data, and it will be stored separately from the original records with access restricted to authorised personnel. This paragraph describes our use of data that has genuinely ceased to be Personal Information — the retention and deletion commitments in section 6 below apply to your Personal Information, not to data that has been de-identified under this paragraph. Nothing in this paragraph limits your rights under the Privacy Act 1988 (Cth) or the Australian Privacy Principles.
We customarily only disclose Personal Information to our service providers who assist us in operating the Website. All service providers who receive Personal Information are required to handle that information in a manner consistent with the Australian Privacy Principles. Your Personal Information may also be accessed from time to time by maintenance and support personnel acting in the normal course of their duties.
If you join our pre-launch waitlist, we will send you an announcement when the product opens, and we may from time to time send you direct marketing about Brevity Bookings and other BrevitLab Operations Pty Ltd products and services — for example product updates, offers, or a community newsletter. Submitting the waitlist form is your express opt-in to these communications: the form states this purpose at the point of collection, and we record the date and the page from which each consent was given. We will never give your details to third parties for their marketing. Every marketing email we send will include a simple means of opting out, such as an unsubscribe link, and you can also ask us to remove you at any time using the contact details in section 11.
For any direct marketing beyond the scope described above, we will only send it where you have provided explicit opt-in consent through a clear affirmative action, such as ticking an unchecked consent box, and we will keep a record of each consent provided, including the date and method. We do not use Sensitive Information in direct marketing activity. You may withdraw any marketing consent at any time, and we will process such requests within 14 business days and provide confirmation of the withdrawal.
We store your Personal Information using industry-standard security measures, including encryption in transit, bcrypt password hashing, secure session management, and rate limiting on authentication endpoints.
Your Personal Information is retained for as long as your account remains open. This does not depend on how often you use the platform: where you hold an active subscription, we retain your information for as long as that subscription continues, whether or not you actively use the platform. Downgrading a subscription, or pausing an individual property, does not on its own start any deletion clock.
If your subscription is cancelled or lapses and is not resumed within 12 months, we will delete or de-identify the Personal Information associated with your account. We will email you before this happens, so you have the opportunity to resume your subscription or export your records first.
You can also ask us to close your account or property at any time. On explicit closure, we retain your data for 30 days — so you can reactivate, download records you still need, or simply change your mind — and after that period we delete or de-identify it.
The only exception is our own business records of any subscription payments you have made to us (for example, the amount, date and invoice reference). We are required to keep those for our own taxation purposes for a minimum of 5 years under the Taxation Administration Act 1953 (Cth), Schedule 1, Division 382. Those records are held by us and by our payment processor; they do not include your booking calendar, guest details, or property ledger.
Your own record-keeping obligations are separate from ours. Booking and financial records you create in the platform are your business records, not ours — if you need to keep them for your own tax obligations (the ATO generally expects 5 years), you must export them before deletion: during the 30-day window on explicit closure, or before the 12-month deletion following a cancelled or lapsed subscription described above (we will email you first). We do not retain them on your behalf beyond that. Session cookies and session identifiers are rotated and overwritten in the ordinary course of platform operation. Security audit-log entries (including login IP addresses, approximate country, and browser details) are retained while the relevant property remains active, as they are integral to ongoing account-security monitoring. Personal Information submitted with a Booking Request that is not approved, and referral or invitation details that are not taken up, will be retained for no longer than 12 months; self-registered accounts that are never approved for property access may also be deleted after 12 months. Waitlist entries are retained for no longer than 12 months from the date you joined, after which they are deleted automatically.
All of the deletion and de-identification described above is carried out in accordance with APP 11.2. More generally, whenever we no longer require your Personal Information for the purpose for which it was collected, we will take reasonable steps to destroy, anonymise, or de-identify it, even outside the specific circumstances described in this section.
These retention rules interact with your Subscription — see our Terms & Conditions for the contractual detail on cancellation, lapse, and closure.
The Australian Privacy Principles and the Privacy Act apply in full to our handling of your Personal Information. In particular:
Where you would like to obtain such access or correction, please contact us in writing using the contact details set out at the bottom of this Privacy Policy. We will respond to your written request within 30 calendar days of receipt. If we require additional time, we will notify you in writing and provide a revised timeline. To verify your identity, we may require email verification or responses to security questions before processing your request.
If the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act) applies to us, then in the event of an eligible data breach that is likely to result in serious harm to any individual whose Personal Information is involved, we will assess the breach promptly upon becoming aware of it and notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable. Our notification will include details of the nature of the breach, the Personal Information involved, the steps we have taken in response, and any recommended protective actions you should consider.
If you have a complaint concerning the manner in which we maintain the privacy of your Personal Information, please contact us using the contact details set out at the bottom of this policy. All complaints will be considered by our Privacy Officer, and we may seek further information from you to clarify your concerns. If we agree that your complaint is well founded, we will, in consultation with you, take appropriate steps to rectify the problem. If you remain dissatisfied with the outcome, you may refer the matter to the OAIC at www.oaic.gov.au.
We use third-party service providers to operate the Website and deliver our services. Some of these providers are incorporated in the United States of America (US), and some process or store your Personal Information on servers located outside Australia. In accordance with Australian Privacy Principle 8 (APP 8), we disclose the following:
(a) Sydney-hosted, US-incorporated vendors (Neon, Vercel, Upstash). Our database (Neon), hosting and file storage (Vercel), and rate-limiting infrastructure (Upstash) are each physically hosted on servers located in Sydney, Australia. However, each of these vendors is incorporated in the United States. Accordingly, data held in their custody may be subject to compelled disclosure under the United States Clarifying Lawful Overseas Use of Data Act 2018 (CLOUD Act) or other applicable US law, regardless of the physical location of the servers. We disclose the US domicile of these vendors in the interests of transparency and in accordance with our obligations under APP 8.
(b) US-processed vendor (Resend). Transactional emails are delivered via Resend, a US-incorporated company whose servers are located in the United States. In the course of delivering transactional emails, Resend processes Personal Information including names, email addresses, and booking-related content on servers physically located in the United States. This constitutes a disclosure of Personal Information to an overseas recipient for the purposes of APP 8.
(c) Future vendor — payment processing (Stripe). Once billing is activated, payment processing will be handled by Stripe, a US-incorporated company. Stripe will process payment-related data on servers located in the United States. We do not transmit or store payment card details — those are handled directly and exclusively by Stripe. This will constitute a further disclosure of Personal Information to an overseas recipient under APP 8.
(d) APP 8 compliance, data processing agreements, and third-party terms. Before disclosing your Personal Information to an overseas recipient, we take reasonable steps to ensure that the overseas recipient does not breach the Australian Privacy Principles in relation to that information, including by executing or accepting the Data Processing Agreement published by each vendor listed above, requiring them to handle your Personal Information in a manner consistent with applicable data-protection law. Where we are unable to ensure such compliance, we will seek your consent prior to disclosure, unless an exception under the Privacy Act applies. Your use of the Website is also subject to the applicable terms and conditions of each third-party service provider listed in this clause, including Neon, Vercel, Upstash, Resend, and Stripe. We encourage you to review those terms before using the Website. By using the Website, you acknowledge that some of your Personal Information may be transferred to, processed, or stored by the vendors described in this clause, including in the United States, in accordance with this clause.
If you have any queries, if you seek access to or correction of your Personal Information, or if you have a complaint about our privacy practices, you can contact us at: support@brevitybookings.com.