Privacy policy

Template. This page is a template. Have it reviewed by a lawyer before use.

VettedSale (ABN ) is operated by as a sole trader in Victoria, Australia. Contact: use the enquiry form.

This policy explains how VettedSale (“we”, “us”) collects, uses, stores and discloses personal information. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Even if we are a small business that would not otherwise be covered by the Act, we choose to follow the APPs.

1. What we collect

• Self-check answers. Your answers to the ten self-check questions, and the band and score we work out from them.
• Lead details. Name, agency, email, phone (optional), suburb and sales staff band, given when you ask for your full self-check results.
• Booking details. The review you chose, your name, role, agency, ABN (optional), email, phone, suburb, sales staff band, preferred time, meeting type and any notes.
• Review data. During a review: the agency's answers to the 18 checklist items, notes, a description of the evidence we were shown, owners, target dates, the written summary and report, and invoice and payment records.
• Text from uploaded documents. When an agency chooses PDF or Word files on a private Auto check link (for example its risk assessment, AML/CTF program, procedures or training records), the file is read in the agency's own browser. Only the text read from it is sent to us, along with the file name, type, size, page count and a SHA-256 fingerprint. The original file is not sent to us or stored.
• Agency details and identity information. Entered through a private upload link for verification: the legal and trading name, ABN, ACN, entity type, addresses, estate agent licence number, AUSTRAC enrolment number, whether the agency accepts cash, and the names, roles and emails of key people (principals, directors, the AML/CTF compliance officer and beneficial owners). Optionally, the text read from identity documents and supporting documents such as ASIC extracts, trust deeds and licences. The original files are not stored.
• Technical data. Your IP address, used briefly to limit repeated form submissions and failed console logins, and the dates and times shared report links are opened.

We do not ask for, and you should not send, identity documents or customer files belonging to the agency's own clients. We look at evidence during the meeting but do not keep copies unless we agree otherwise in writing.

2. Why we collect it

We use personal information to show you your self-check result, respond to your enquiry or booking, carry out and report on the gap review, issue invoices, arrange the 90-day follow-up where it is included, keep business and tax records, and protect the site from misuse. We do not sell personal information. We do not use it for unrelated marketing without your consent.

3. How it is stored

The site runs on Cloudflare Pages, and data is stored in a Cloudflare D1 database. Cloudflare is a US-based provider that runs data centres around the world. Your information may be stored or processed outside Australia, including in the United States and other countries where Cloudflare operates. We take reasonable steps under APP 8 to ensure overseas providers handle the information consistently with the APPs. You accept that it may be held overseas when you submit a form.

Reports are shared only through private, read-only links. Only a one-way hash of each link is stored, and links can be revoked at any time. The consultant console is protected by a passcode.

3A. Uploaded documents and Workers AI

We do not store uploaded files. The text read from them in your browser is stored in the D1 database. To suggest answers for the consultant, the text is processed by Cloudflare Workers AI, a large language model run by Cloudflare. Cloudflare states that it does not use customer inputs to train its models. AI suggestions are checked by the consultant and never change a review unless the consultant accepts them. D1 and Workers AI may store or process data outside Australia. If you upload identity documents for verification, only the text read from them is kept, and it is deleted after 90 days. Please do not upload files about your own customers.

The stored text and file details are deleted automatically 90 days after upload. The consultant can delete them sooner, and you can ask us to.

3AA. Checking a customer document in the agency portal

An agency user can check a customer's ID, company extract or trust deed against the customer record. The file is read in the user's browser and is never uploaded. Only its text is sent to our server and on to Cloudflare Workers AI, which picks out names, dates, numbers and owners. The text is used for that one check and is not stored by us. Only the details the user chooses to apply are saved, and only the last 4 characters of a document number are kept.

3B. Checking agency details

We check the ABN and ACN formats in your browser and on our server. If it is set up, we also look up the ABN on the Australian Business Register (ABN Lookup), a public government service. Only the ABN is sent, and the register's public details (entity name, status, GST registration and state) are compared with what was entered. Workers AI may compare uploaded document text with the details entered. A consultant reviews the details for the engagement; this is not a certification.

Agency details and text from identity documents are held for 90 days after they are submitted, then deleted. If the consultant accepts the details, they are copied into the client record and kept with the client's other records (see Retention).

3C. Agency portal

If your consultant invites your agency to the portal, we store the records your agency enters there: your AML/CTF program and risk assessment, customer due diligence records, monitoring and red flag notes, suspicion and report register entries, staff and training records, and calendar items. For identity documents, the portal keeps only the document type and the last four characters of the number, never the full number or a copy of the document. Each agency can see only its own records; your consultant can view them read-only. Portal passcodes are stored only as a salted PBKDF2 hash. We do not lodge reports with AUSTRAC for you. Portal records are kept for seven years after they were last updated (the AML/CTF record-keeping period), then deleted, unless you ask us to delete them earlier and the law allows it. You can export your full file at any time.

3D. Sanctions screening

The portal and console screen names (and dates of birth, if entered) against the DFAT Consolidated List, a public list published by the Department of Foreign Affairs and Trade. We download the list from DFAT and match names on our own systems, so the names you screen are not sent to DFAT or anyone else. A possible match is a prompt for human review, not a finding.

3E. Self-serve accounts

When you create an account we collect your name, work email, agency name and, if you give it, your ABN. We look the ABN up on the Australian Business Register to fill in your entity details. Each user's name, email, role (owner, compliance officer or staff) and last sign-in time are stored with the agency's account. Passwords are never stored: we keep only a salted PBKDF2 hash. If email is set up, we use Resend to send email confirmation, invite and password reset links. To stop abuse we record your IP address against sign-up and sign-in attempts for up to an hour.

The account owner can remove users at any time. To delete the whole account, email us: we delete the agency's users, records and any review data, except records we must keep by law (for example tax invoices). We may suspend an account that breaches the Terms.

4. Email (Resend)

If email notifications are turned on, the details of a self-check or booking are sent to us through Resend, an email delivery service that may process data in the United States. If notifications are off, no email is sent.

4A. Reminder emails and Cloudflare security checks

Owners and compliance officers of an agency receive reminder emails about their own records (for example a task that is due or an ID that is expiring) and, unless they turn it off under Account, a weekly summary. Our forms may use Cloudflare Turnstile to tell people from automated abuse; Turnstile processes technical information about your browser and connection. We use Cloudflare Web Analytics, which counts page views without cookies.

5. Disclosure

We disclose personal information only to the service providers named above, to our professional advisers (for example an accountant), where you have agreed, or where the law requires or authorises it. We do not report on your agency to AUSTRAC or any other regulator, except where the law requires it.

6. Retention

Agency details and text from identity documents submitted for verification are deleted 90 days after submission. Text from uploaded documents is deleted 90 days after upload (see section 3A). Self-check leads that do not become clients are deleted within 24 months. Agency portal records are kept for seven years (see section 3C). Client review data, reports and invoices are kept for seven years to meet tax and business record obligations, then deleted or de-identified. You can ask us to delete information earlier if we do not need to keep it by law.

7. Access and correction

You can ask for access to the personal information we hold about you, or ask us to correct it, by using the enquiry form. We will respond within 30 days. If we refuse, we will tell you why in writing and how to complain.

8. Cookies

The public site sets no cookies and uses no analytics or advertising trackers. The consultant console uses a single cookie, agc_session. It is strictly necessary to keep the consultant logged in, is HttpOnly, and expires after 12 hours. The agency portal uses a single cookie, agc_portal, which is strictly necessary to keep the agency signed in, is HttpOnly, and expires after 12 hours. The site remembers your light or dark mode choice in your browser's local storage. That choice is not sent to us.

9. Complaints

To complain about how we handled your personal information, use the enquiry form. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

10. Changes

We may update this policy. The current version is always on this page.

Last updated: 19 October 2026.