How Certlyn handles personal information.

Last updated 24 October 2026. This policy explains what Certlyn Technologies Pty Ltd (ABN 29 702 866 957) (“we”, “us”) collects through the Certlyn service and website, why, who it is shared with, and the choices you have. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Who this covers

Certlyn is used by building certification firms (“firms”) to run their projects, and by their clients — owners, applicants and builders — through a client portal. This policy covers everyone whose information passes through it: the people at a firm, their clients, and visitors to this website.

A firm decides what it records about its own clients and projects. For that information the firm is the organisation responsible under privacy law, and we hold it on the firm’s behalf and on its instructions. Questions about what a particular firm holds about you are best put to that firm first.

What we collect

From firms: the firm’s name, ABN, addresses, phone, email, logo and stamp; each certifier’s name, registration number and expiry, insurance details, email, phone, Planning Portal login email and signature image; sending-address and payment settings, including bank details printed on invoices.
About clients and projects, entered by a firm or by the client: names, contact details and postal addresses of applicants, owners and builders; site addresses and land details; the documents uploaded for a project and their details; inspection dates, outcomes, notes and photographs; certificates, reports and letters the firm issues; quotes and invoices.
From visitors to this website: what you enter in the “Register your interest” form — name, firm, email, phone and message.
Automatically: a sign-in session cookie, and a record of actions taken in the service (who did what, when) kept as an audit log. We do not run advertising or analytics trackers.

Why we collect it

To provide the service: to record projects, produce certificates, reports and invoices, book and record inspections, and let clients see and contribute to their own project.
To send the emails the service sends: portal invitations, notifications a firm chooses to send, reminders about outstanding documents or unpaid invoices where a firm has switched them on, password resets.
To keep the service secure and to keep an accurate record of what was done, which certifiers are required to hold.
To respond when you register your interest or contact us.

Who we share it with

We do not sell personal information. We share it only with the providers that run the service, and only as far as they need it:

Hosting and database (Vercel and Supabase) — where the service runs and its data and documents are stored.
Email delivery (Resend) — to send the emails described above.
Card payments (Stripe) — when a client pays an invoice by card. Card details are entered on Stripe’s own pages and never reach Certlyn.
AI assistance (Google Gemini or Anthropic, whichever the firm’s key is for) — where a firm has switched it on. It is sent project details and document titles only, never the documents themselves. Anthropic’s API does not use what it is sent to train its models; on Google’s free tier, Google may use it to improve its products.
Cloud backup (Dropbox or Microsoft OneDrive) — only if a firm connects its own account, and only into that account.
NSW Planning Portal — when a firm reports an inspection or certificate, as it is required to by law.

Some of these providers store or process data outside Australia. Where they do, we rely on their contractual commitments to protect it to a standard at least equivalent to Australian law.

How it is kept

Each firm's data is separated from every other firm's by rules enforced in the database itself, not only by the screens.
Access is by password, with optional two-factor sign-in for certifiers. Connections are encrypted.
Documents are stored privately and reached only through short-lived links issued to signed-in users.
The audit log is append-only: entries cannot be edited or removed once written.
The people who operate Certlyn open a firm's projects through the hosting platform only when the firm asks them to, for example for support, and that access is covered by the same confidentiality as everything else we hold.

How long it is kept

Project records are kept for as long as the firm keeps them, because certifiers are required to retain their records for years. A project a firm deletes is recoverable for thirty days, after which it and every document in it are permanently removed. When a firm’s agreement ends, its access ends unless it pays for records access; without it, its data may be deleted except where the law requires it to be kept. Messages sent through the “Register your interest” form are emailed to us and not stored in the service.

Your rights

You can ask to see the personal information we hold about you, and to have it corrected. Where it was entered by a firm about its client, we will usually refer the request to that firm, which holds the relationship with you. If you believe we have mishandled your information, tell us and we will look into it; if you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner.

Cookies

Certlyn uses only the cookies needed to keep you signed in. There are no advertising or tracking cookies.

Changes

We will update this policy when the service changes in a way that affects it, and show the date at the top. Material changes will be notified to firms by email.

Contact

Privacy questions and requests: customerservice@certlyn.com.au.