Privacy Policy

This Privacy Policy explains how Setli Pty Ltd (Setli, we, us or our) collects, holds, uses, discloses, protects, retains and deletes personal information when you use or interact with Setli services.

It applies to personal information collected through www.setli.com.au, the Setli web platform and progressive web app (PWA), the Setli Rentals Android application, the Setli Rentals iOS application, property or room listing pages, account and payment features, communications, customer support and other services we make available from time to time (together, the Services).

Setli is an Australian company and this policy is intended to meet the requirements of the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where privacy laws in another jurisdiction apply to a particular individual or processing activity, we will also handle personal information in accordance with those applicable laws.

This Privacy Policy should be read together with any collection notice, consent request, cookie notice or other privacy disclosure presented when a particular feature collects information.

The kinds of personal information we collect depend on how you use the Services. We may collect and hold:

• Identity and contact information, such as full name, email address, telephone number and postal or residential address.
• Account information, such as login credentials, account type, profile details, preferences and account status.
• Property, room and tenancy information, such as property and room details, rent amount and frequency, tenancy dates, occupancy information, listings, lease-related information and information provided by hosts, landlords, tenants or housemates.
• Payment and transaction information, such as rent and expense payment records, platform fees, refunds, security deposit records, receipts, payout information and other transaction history. Payment card details are processed by our payment provider and Setli does not intentionally store complete payment card numbers.
• Rewards and referral information, such as referral relationships, eligible transactions, reward balances, cashback and cash-out records.
• Maintenance, task and household information, such as maintenance requests, tasks, reminders, household expense information and communications associated with those matters.
• Content you provide, including messages, support enquiries, forms, uploaded documents, photographs, attachments, listing information and other content submitted through the Services.
• Communications information, including email, SMS and customer-support communications and records of notices sent through the Services.
• Technical and device information, such as IP address, device type, operating system, browser type, app version, device identifiers, push-notification tokens, language, time zone and information about how the Services are accessed.
• Usage and diagnostic information, such as pages or screens viewed, interactions with features, timestamps, application events, error logs, crash information and analytics information.
• Cookie and similar technology information from the website or web application, subject to applicable consent requirements.
• Any other information you voluntarily provide when creating an account, using the Services, contacting us or interacting with a feature.

Sensitive information

Sensitive information has the meaning given in the Privacy Act and can include information about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union or professional association membership, sexual orientation, criminal record and certain biometric information. Setli does not generally seek to collect sensitive information. If sensitive information is reasonably necessary for a function or activity, or is incidentally included in material you submit, we will handle it in accordance with applicable law and, where required, with your consent.

We usually collect personal information directly from you when you register, create or manage an account, create a property or room, enter a tenancy, make or receive a payment, submit an expense, use maintenance or task features, participate in referrals or rewards, contact support, complete a form, upload content or otherwise use the Services.

We may also collect personal information:

• from another Setli user where it is reasonably necessary to operate a shared rental, property or tenancy relationship, such as when a host or tenant invites another person or provides information relevant to a tenancy;
• from payment processors, communications providers, hosting providers, analytics providers and other service providers that support the Services;
• automatically from devices, browsers, app software, server logs, cookies, software development kits (SDKs) and similar technologies; and
• from publicly available sources or other lawful sources where permitted by law.

Where it is reasonable and practicable, we collect personal information directly from the individual concerned. If we receive personal information about you from another person, we will take reasonable steps, where required, to make you aware of the relevant collection circumstances.

We may use cookies and similar technologies to provide essential website functionality, maintain sessions, remember preferences, understand use of the Services, improve performance and measure the effectiveness of communications or marketing. Essential cookies may be used where necessary for the operation or security of the Services.

Where required by applicable law, we will obtain consent before using non-essential analytics, advertising, marketing or social-media cookies or similar technologies. You can manage available cookie preferences using our cookie controls or your browser settings. Blocking some cookies may affect functionality.

The Setli Android and iOS applications may request access to device functions only where a feature requires them. Depending on the features you use and the version of the app, this may include:

• Notifications, so that Setli can deliver payment, tenancy, maintenance, task, security or account-related alerts.
• Camera, photos or files, where you choose to capture or upload property images, maintenance evidence, receipts, documents or other attachments.
• Device and app information used for security, authentication, fraud prevention, diagnostics, crash reporting and service improvement.

You can control many device permissions through your Android or iOS settings. If you deny a permission, the feature that relies on that permission may not function. Setli does not use a device permission for a purpose materially different from the purpose disclosed when permission is requested.

We collect, hold, use and disclose personal information for purposes reasonably necessary to operate Setli and provide the Services, including to:

• create, authenticate and administer accounts;
• provide shared-rental, property, tenancy, rent, expense, maintenance, task, rewards, referral, calendar, payment and reporting features;
• process and reconcile transactions, payments, refunds, payouts, fees, rewards and security deposit records;
• facilitate communications between authorised users in connection with a property, tenancy or shared household;
• generate receipts, rental histories, tenant records and other requested service outputs;
• provide customer service and respond to enquiries, complaints and requests;
• send transactional, service, security and administrative communications by email, SMS, push notification or in-app message;
• protect the security and integrity of accounts, users, transactions and the Services; detect or investigate suspected fraud, misuse, unauthorised access or illegal activity;
• monitor, maintain, troubleshoot, analyse and improve the Services and develop new features;
• comply with legal, regulatory, taxation, accounting, dispute-resolution and record-keeping obligations; and
• send direct marketing where permitted by law and in accordance with your choices.

Direct marketing

Where permitted by law, we may use contact information to send information about Setli features, services or updates that we reasonably consider may be relevant to you. Marketing communications will include a method to opt out, such as an unsubscribe link or preference control. You can also contact us to withdraw from marketing. Service, transactional and security communications may still be sent where necessary to operate your account or provide the Services.

Where the GDPR, UK GDPR or another law requiring a legal basis applies, Setli may process personal data on one or more of the following bases, depending on the circumstances: performance of a contract with you; steps taken at your request before entering a contract; compliance with a legal obligation; our legitimate interests or the legitimate interests of another person, where those interests are not overridden by your rights; consent, where consent is required; and the establishment, exercise or defence of legal claims.

Where processing is based on consent, you may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

We may disclose personal information only where reasonably necessary for the purposes described in this policy, where you direct or consent to the disclosure, or where permitted or required by law. Recipients may include:

• other authorised Setli users involved in the same property, room, tenancy, expense, task or maintenance matter, to the extent necessary for the feature being used;
• payment and financial-technology service providers, including Stripe, for payment processing, payouts and related financial functions;
• cloud infrastructure and hosting providers, including Amazon Web Services (AWS);
• communications providers, including providers used for transactional email, SMS or push notifications, such as Twilio and relevant Apple or Google notification services;
• application, analytics, authentication, crash-reporting and mobile infrastructure providers, which may include Google Firebase or related Google services where enabled;
• customer-support and communications platforms, which may include Intercom where enabled;
• professional advisers, auditors, insurers, contractors and other service providers who need information to provide services to Setli;
• government agencies, regulators, law-enforcement bodies, courts or other persons where disclosure is authorised or required by law; and
• a purchaser, investor or successor in connection with a genuine or proposed corporate transaction, subject to appropriate confidentiality and privacy protections.

Service providers are expected to handle personal information only for authorised purposes and to apply appropriate privacy and security protections consistent with their role and applicable law. Setli remains responsible for its own privacy obligations and takes reasonable steps when selecting and managing service providers.

Payments through Setli are processed using third-party payment infrastructure. Stripe may collect and process payment credentials, bank information, identity information and transaction information in accordance with its own privacy terms and legal obligations. Setli receives information necessary to administer transactions, such as transaction status, identifiers, amount, fee information and limited payment-method information. Setli does not intentionally store complete payment card numbers.

Setli takes reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Measures may include encryption in transit and, where appropriate, at rest; authentication and access controls; role-based access restrictions; logging and monitoring; secure cloud infrastructure; software and dependency maintenance; backups; and security review practices appropriate to the nature of the information and Services.

No method of electronic transmission or storage is completely secure. If we become aware of an eligible data breach, we will assess and respond to it in accordance with the Notifiable Data Breaches scheme under the Privacy Act and other applicable breach-notification laws, including notifying affected individuals and regulators where required.

We retain personal information for as long as reasonably necessary to provide the Services, maintain legitimate business and transaction records, resolve disputes, enforce agreements and comply with legal, taxation, accounting, fraud-prevention and regulatory obligations. Different categories of information may therefore be retained for different periods.

As a general rule, records that form part of our business, financial, transaction or client records may be retained for up to seven years, or longer where a law, dispute, investigation or legitimate legal need requires it. Information that is no longer required will be deleted, destroyed, anonymised or de-identified where reasonable and permitted by law.

Deleting your Setli account

You may request deletion of your Setli account and personal information associated with it. Where an in-app Delete Account function is available, you may use that function. You may also request deletion outside the app by emailing contact@setli.com.au with the subject “Account deletion” and enough information for us to verify the account and request.

When an account-deletion request is completed, we will delete or de-identify personal information associated with the account unless we must or are permitted to retain particular information for reasons such as legal or regulatory compliance, taxation and accounting, transaction integrity, security, fraud prevention, dispute resolution or the establishment, exercise or defence of legal claims. Where information must be retained, access will be limited and the information will not be used for unrelated purposes.

Deleting an account may also affect access to rental histories, transaction records, receipts, rewards, tenancy records or other features. Where another user is legally or operationally entitled to retain a record of a shared transaction or tenancy, deletion of your account does not necessarily require deletion of that other user’s independent record, but we will minimise or de-identify information where appropriate and legally possible.

Subject to applicable law, you may request access to personal information Setli holds about you and request correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading. We may need to verify your identity before acting on a request. In some circumstances, the law permits or requires us to refuse access or correction, in which case we will generally explain the reason where we are allowed to do so.

Depending on where you live and which privacy law applies, you may also have rights to request deletion, restriction or objection to certain processing, portability of certain information, withdrawal of consent, or review of certain automated processing. You may exercise applicable rights by contacting us using the details in section 20.

Where practicable and lawful, you may interact with Setli without identifying yourself or by using a pseudonym. However, identification is generally required where it is necessary to create or secure an account, establish a tenancy or payment relationship, process payments, provide rental history features, comply with law, prevent fraud or otherwise deliver a feature that depends on knowing the relevant user.

The Services are not directed to children under 18 and Setli does not knowingly seek to create accounts for children. If we become aware that personal information has been collected from a child in circumstances where parental or guardian consent or another lawful basis is required and has not been obtained, we will take reasonable steps to delete or otherwise lawfully address that information. If you believe a child has provided personal information to Setli inappropriately, contact us promptly.

Setli is based in Australia, but some service providers and their systems may be located or operate outside Australia, including in the United States and other jurisdictions in which our cloud, payment, communications, support, analytics or technology providers operate. As a result, personal information may be disclosed to or processed in overseas locations.

Where we disclose personal information overseas, we take reasonable steps required by Australian Privacy Principle 8 and other applicable laws to ensure that overseas recipients handle personal information with appropriate protections. Depending on the circumstances, safeguards may include contractual protections, vendor security and privacy reviews, data-processing terms, standard contractual clauses or other approved transfer mechanisms.

Where the GDPR or UK GDPR applies to our processing, you may have rights including access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, objection to direct marketing, withdrawal of consent and the right to lodge a complaint with an applicable supervisory authority. These rights are subject to conditions and exceptions under applicable law.

If international transfer rules under the GDPR or UK GDPR apply, we will use an appropriate transfer mechanism where required, such as an adequacy decision, approved standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or another legally recognised safeguard.

Privacy laws in some United States jurisdictions may provide eligible residents with rights to know or access categories or specific pieces of personal information, correct inaccurate information, delete certain personal information, obtain a portable copy of certain information, and opt out of certain targeted advertising, sale or sharing activities where those concepts apply.

Setli does not sell personal information for money. Setli also does not use personal information for cross-context behavioural advertising in a manner that we understand would constitute a “sale” or “sharing” under applicable United States state privacy laws. If our practices change, we will update this policy and provide any required opt-out mechanisms.

These state-law rights and obligations apply only where the relevant law applies to Setli and to the individual concerned. Requests can be made using the contact details in section 20, and we may need to verify identity before completing a request.

Setli may use software to automate routine functions such as calculations, reminders, payment-status updates, notifications, fraud or security signals, and presentation of account or transaction information. These functions are designed to support operation of the Services and do not, by themselves, constitute a legal or tenancy decision by Setli.

As at the effective date of this policy, Setli does not intentionally arrange for a solely automated decision using personal information that could reasonably be expected to significantly affect an individual’s rights or interests in the sense contemplated by the Privacy Act amendments scheduled to commence on 10 December 2026. If our practices change so that such automated decisions are made, we will update this policy and provide the information required by applicable law.

If you have a complaint about how Setli has handled your personal information or complied with applicable privacy obligations, contact our Privacy Officer using the details below. We may ask for further information so we can understand and investigate the issue. We will consider the complaint and take appropriate steps to respond and, where a complaint is well founded, to rectify the issue.

If you are not satisfied with our response and the Australian Privacy Act applies, you may be entitled to complain to the Office of the Australian Information Commissioner (OAIC). If another privacy law applies, you may also have the right to complain to the relevant privacy or data-protection authority in your jurisdiction.

For questions, privacy rights requests, requests for access or correction, account-deletion requests, complaints or other privacy matters, contact:

• Privacy contact: Privacy Officer
• Company: Setli Pty Ltd
• Email: contact@setli.com.au
• Website: www.setli.com.au
• Business identifiers: ABN 12696026383 | ACN 696026383

We may update this Privacy Policy from time to time to reflect changes to our Services, technology, service providers, legal requirements or privacy practices. The current version will be published on our website and identified by its effective date or last-updated date. Where a change is material and applicable law requires additional notice or consent, we will provide that notice or obtain consent as required.

The privacy information submitted in Google Play, Apple App Store Connect and other app-distribution platforms is intended to describe the same underlying data practices set out in this policy. If a store disclosure and this policy appear inconsistent, please contact us so we can investigate and correct the disclosure or policy as appropriate. App-store disclosures may use different categories or terminology imposed by the relevant platform.