Privacy Policy

BrokerDash · Effective: 27 February 2026 · Last updated: 26 October 2026

1. Who we are

Steve Labs Pty Ltd (trading as "BrokerDash", "we", "us", "our") operates the BrokerDash platform, an AI-assisted document insights tool designed to assist Australian mortgage brokers in their review of borrower documents, and this website.

We are a data controller in respect of information about you (the broker, subscriber or website visitor) and a data processor in respect of personal information about your clients that you upload to the platform. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

BrokerDash provides indicative insights only and does not constitute verification, assessment, or credit decisioning. All outputs require independent broker review.

2. Information we collect

About you (the subscriber):

• Email address, name, and profile photo (supplied by WorkOS or Google at sign-in).
• Organisation or firm name where provided.
• Subscription plan, billing status, and Stripe customer ID (no card numbers are stored on our servers).
• Platform activity logs (sessions created, reviews run, feature usage) for security and service-quality purposes.

About your clients (applicant data you upload):

• Documents you upload (bank statements, payslips, identity documents, credit card statements, etc.).
• Information extracted from those documents (income, expenses, liabilities, transaction summaries).
• Any notes or corrections you add during review.

When you register interest on this website:

• Your name and business email (required), and your organisation, role, team size, whether you'd like a demonstration and any message you add (optional).
• Your consent to receive emails about the BrokerDash launch and early access, with the date it was given.
• Any referral or invitation code in the link you used, and the page you came from.

The register-interest form asks for business contact details only. Do not enter client information in it.

3. How we use information

• To provide the review, analysis, and reporting features of the platform.
• To authenticate you and manage your account.
• To operate our subscription billing via Stripe.
• To tell people who registered interest when BrokerDash launches and early access opens. You can opt out of these emails at any time.
• To detect, prevent, and respond to fraud, abuse, or security incidents.
• To comply with our legal and regulatory obligations.
• To improve the platform (using aggregated, de-identified usage data only).

We do not sell personal information, and we do not use applicant documents for advertising or profiling.

4. AI processing and automated decisions

Documents are read and analysed using Google Cloud services (Document AI and Vertex AI) configured for the Sydney region (australia-southeast1). We transmit uploaded document contents and related analysis context to these services for processing. How Google handles that data is governed by the Google Cloud terms applicable to our account and our contractual arrangements with Google, not by controls implemented in the BrokerDash application itself.

The outputs of the AI are assistive and must be independently reviewed by a qualified broker before being relied upon for credit assessment, lender submission, or any advice to a client. BrokerDash does not make lending decisions and the platform's outputs are not a substitute for your professional judgment or regulatory obligations (including responsible-lending inquiries).

5. Subprocessors and service providers

We engage the following third-party subprocessors to deliver the service and this website. Each is bound by contractual data-protection obligations and, where applicable, standard contractual clauses or equivalent mechanisms.

We will update this list before engaging any new subprocessor that processes personal information. Subscribers may contact us at hello@brokerdash.com.au to be notified of material changes.

6. Data residency and cross-border disclosure

We host the BrokerDash application, store primary borrower workspace data and run document reading and AI analysis within Australia (Sydney). Specifically:

• Application runtime: Google Cloud Run in australia-southeast1.
• Database and file storage: Supabase in ap-southeast-2 (Sydney).
• Document reading and AI analysis: Google Cloud Document AI and Vertex AI in australia-southeast1.
• Build artefacts and container images: Google Artifact Registry in Australia.

Some services involve limited cross-border disclosure of personal information under Australian Privacy Principle 8:

• WorkOS (sign-in) processes your email, profile, and session tokens in the United States.
• Stripe (billing) processes your subscription and payment data on its global infrastructure.
• Google Workspace (our business email) holds register-interest requests and other emails you send us on Google's global infrastructure.
• Firebase Hosting serves this website from a global content delivery network, which processes standard web request data.

By creating an account, uploading documents or registering interest, you consent to these cross-border transfers for the purposes described in this policy. We take reasonable steps to ensure overseas recipients handle personal information consistently with the APPs, typically through contractual data-protection obligations with each provider.

7. Data retention and deletion

• Borrower workspace data (uploaded documents, chat messages, AI analysis output, and borrower-identifying session fields): automatically deleted on a 12-hour schedule from workspace creation, unless you opt in to extended retention for a support investigation (up to 7 days by default).
• Review session records: after the workspace retention window, borrower-identifiable content is removed and the session is marked as purged. Non-borrower metadata (for example, session counts and timestamps) may persist for usage metrics.
• Account data: retained while your account is active and for up to 7 years after closure to meet financial-services record-keeping expectations.
• Billing records: retained for the period required by tax and accounting law (generally 7 years in Australia).
• Audit and security logs: retained for up to 2 years (operational counts and access events only, not borrower document content).
• AI usage telemetry: token counts and latency metrics retained for up to 2 years (no prompt or response text).
• Register-interest details: kept until you opt out or ask us to delete them, or until 12 months after launch if you have not become a customer.

8. Security

We take the security of personal information seriously. Controls we apply include:

• Encryption in transit (TLS) for data sent between your browser and our application.
• Encryption at rest provided by our primary infrastructure providers (Google Cloud, Supabase).
• Scoped, least-privilege access for staff and automated systems.
• Row-level security policies on the Supabase database.
• Sign-in delegated to WorkOS (Google, Magic Auth and passkeys). BrokerDash does not store passwords.
• Periodic review of access logs, subprocessors, and security posture.

No system is perfectly secure. In the unlikely event of a notifiable data breach, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

9. Your rights

Under the Privacy Act, you may:

• Request access to the personal information we hold about you.
• Request correction of inaccurate or out-of-date information.
• Request deletion of your account and associated data (subject to legal retention requirements).
• Opt out of launch emails at any time by replying to any email or contacting us.
• Withdraw consent to cross-border disclosure (note: this may mean we can no longer provide the service).
• Lodge a complaint with us, and escalate to the OAIC if you are not satisfied.

To exercise any of these rights, contact us at hello@brokerdash.com.au. We will respond within 30 days.

10. Broker obligations: client consent

By uploading client documents to BrokerDash, you represent and warrant that you have obtained all necessary consents, authorities, and permissions from the relevant client(s) for BrokerDash to collect, use, and disclose their personal information (including disclosure to the subprocessors listed above) for the purposes of generating indicative document insights and related services.

You are responsible for ensuring that your own privacy notices and client engagement documentation adequately describe your use of BrokerDash. We can provide a supplementary statement on request to help you meet this obligation.

11. Changes to this policy

We may update this policy from time to time. Material changes (new subprocessors, changes to data residency, expanded data collection) will be notified to active subscribers by email at least 14 days before taking effect. The "Last updated" date at the top of this page always reflects the current version.

12. Contact and complaints

For privacy questions, data-subject requests, or complaints, contact our Privacy Officer:

Steve Labs Pty Ltd
Email: hello@brokerdash.com.au

If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.