Privacy
This page explains what happens to the documents you upload and the information we hold about you. It is written to be read, not to be survived — if anything here is unclear, ask us and we’ll fix the wording.
Home Decoded is operated by Winlex (ABN 25910096373), in New South Wales, Australia. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Your documents
We never keep your documents. They're deleted the moment your report is ready. Your report quotes short excerpts from them and is stored until you delete it — we mask personal names where detected, and we never store the full text.
Concretely, here is the whole lifecycle:
- Your browser uploads each PDF directly to private storage using a short-lived signed link. The files do not pass through our website at any point.
- The analysis job downloads them, extracts the text and renders scanned pages as images, and sends that content to Anthropic for analysis.
- When your report is ready, the uploaded files are deleted. If a job fails or is abandoned, an automatic sweep deletes them anyway — nothing is left behind because something went wrong.
- The extracted full text is never written to a database or a log. It exists in memory during the run and nowhere else.
What your report keeps
Your report contains short verbatim quotes from your documents, with page numbers. That is the entire point of the product — a finding without its quote is just an assertion — so we cannot store your report without storing those excerpts. It also holds the property address, because a report that does not say which property it is about is not much use.
Where we detect personal names in extracted content, we mask them before the report is stored. This is best-effort detection, which is why we say “where detected” rather than promising it catches everything. Your report is kept until you delete it, and you can delete it at any time.
Who else touches your information
We use other companies to run the service. The important distinction is which of them can see your documents and which only see an account:
| Who | What they do | Sees documents? |
|---|---|---|
| Anthropic | Document analysis (the AI model)Receives extracted text and page images for the duration of the analysis. | Yes |
| Supabase | Accounts, database, and temporary document storageHolds your uploaded PDFs in a private bucket until your report is ready. | Yes |
| Trigger.dev | Runs the analysis jobHolds document content in memory while the analysis runs. Nothing is retained. | Yes |
| Vercel | Website hostingYour documents upload straight to storage and never pass through our web host. | No |
| Stripe | PaymentsReceives your payment details directly. We never see or store your card number. | No |
Some of these providers process data outside Australia, including in the United States. By uploading documents you consent to that transfer. Payment card details go straight to Stripe and never reach us — we never see or store a card number.
Your documents are not used to train AI models
Anthropic analyses your documents and does not use them to train its models. We do not keep a copy to train anything of our own either — there would be nothing to train on, because we delete them.
What else we hold
- Your account — email address and sign-in records.
- Your credit balance and purchase history, so we can tell you what you have and reconcile a payment if something goes wrong.
- Usage records — how many tokens an analysis used, what it cost us, how long it took. Numbers only. No document content can appear here by design.
- Messages you send us through the contact form, so we can reply.
- How you first found us — the campaign tag on the link you clicked, or the website that linked to us, recorded once when you first arrive. No advertising network, no tracking script, no profile of you built anywhere. It tells us which channel is worth our time and nothing else.
Email you can turn off, and email you cannot
We may email you when you have unused credits sitting idle. Every one of those carries an unsubscribe link, and turning it off is immediate and permanent. Sign-in links and “your report is ready” are a different thing — they are the service you paid for, so they keep coming.
Sending a report to your conveyancer
If you use the button to send a report to a professional, we email it to the address you type, with your address as the reply-to so they answer you rather than us. We do not keep their address for anything else and we never contact them ourselves. The report contains short quoted excerpts from your documents, so send it only to someone you want reading them.
Your rights
You do not need to ask us for most of this. Any report can be deleted from its own page, and your account page will close your account and remove your reports outright. For anything else — a copy of what we hold, or a correction — email contact@homedecoded.com.au and we’ll action it.
Two things deletion does not remove, because we cannot honestly claim otherwise. Your payments stay with Stripe: those are financial records we are required to keep. And a message you sent us through the contact form stays in our inbox, unlinked from your account, so a conversation you are still in the middle of does not vanish mid-thread.
If you think we’ve mishandled your information, tell us first — we’d rather fix it. If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Security
Documents are held in a private bucket that is not publicly readable, reachable only through short-lived signed links. Database access is restricted per-user at the database level, so one customer’s reports are not reachable from another customer’s session. No system is perfectly secure, and we will tell you promptly if a breach affects you.
Changes
If we change this page in a way that affects what happens to your documents, we’ll say so rather than quietly updating the date.
Last updated 20 August 2026.