Brevity Bookings
Last updated: 6 October 2026
This Privacy Policy applies to all personal information collected by BrevitLab Operations Pty Ltd (ABN 52 700 825 332; ACN 700 825 332) trading as Brevity Bookings (we, us or our) via the website located at BrevityBookings.com (Website). Brevity Bookings lets people create an Account directly, while access to each property remains private and controlled by that property's administrators. It is designed for owners of holiday and short-term rental properties and the people they give access to. The platform provides a shared booking calendar, guest management tools, a financial ledger with Australian financial-year reporting, and cleaning and maintenance job tracking. Brevity Bookings is not a marketplace, does not facilitate or process payments between property owners and guests, and does not hold client money or trust accounts. The platform is offered on a paid subscription basis. Promotional offers (including free introductory periods) and complimentary access may be provided at BrevitLab's discretion.
We comply with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs) in full.
The service is intended for use by adults only — you must be of legal age to form a binding contract in your jurisdiction to register for or use the platform. By registering, you confirm that you meet this requirement.
The kind of Personal Information we collect from you will depend on how you interact with the Website. A person may create an Account without joining a property or purchasing a Subscription. Access to an existing property is granted only by that property's administrators — either by invitation or by approving a Booking Request; no one can join a property without an administrator granting access. A separate Booking Request form is available via an owner-shared link; submission of that form does not create an account or grant access to the platform.
The Personal Information we collect and hold about you will depend on which of the following categories applies to you:
(a) Account holder — a user who creates an Account, whether or not they later subscribe or administer one or more properties. We collect: full name; email address; password (stored in hashed form using bcrypt — never stored as plain text); cookies and session identifiers (authentication session token); the address of the rental property being administered (a free-text field describing the managed property, not the individual's personal home address); documents and images you choose to upload to the platform — such as receipts, invoices, quotes, and maintenance or property photos — which may contain personal information about third parties (for example, a tradesperson's name and contact details on an invoice); and, where you subscribe, a Stripe customer and subscription reference ID (we do not receive or store card numbers — Stripe handles payment card data directly). When a login is attempted on your account (successfully or unsuccessfully), we record the IP address, approximate country, and browser (user-agent) of the attempt, together with the email address used, in a security audit log; this data is used for rate limiting, account-lockout protection, and to alert you by email to logins from a new location. This applies to any login attempt, including attempts made using an email address that is not registered with us.
(b) Invited User — a user who has been granted access to a property by that property's administrators, whether by accepting an invitation or on approval of a Booking Request they submitted. Property access does not require that user to purchase a Subscription. We collect: full name; email address; password (stored in hashed form using bcrypt — never stored as plain text); and cookies and session identifiers (authentication session token). Login security data is handled as described in (a).
Legal acceptance evidence for account holders. When an Owner/Member or Guest User accepts our Website Terms and acknowledges this Privacy Policy, we record the version identifier for each document, the date and time, and the acceptance source and method (for example, an unchecked affirmative checkbox during registration, invitation acceptance, or a later re-acceptance). The record is linked to the account; request-only Booking Requests do not create this evidence.
(c) Booking Request (request only) — a prospective guest who submits a Booking Request via an owner-shared link. Submission does not grant platform access; an administrator of that property must approve the request before any account is created, and the person submitting the request may never become a user. We collect: full name; email address; phone number (optional); IP address (logged for rate-limiting and audit trail purposes); and a free-text message. This information is held solely for the purpose of processing the request and will not be used for any other purpose without your consent.
(d) Referred or invited person — where an existing Owner/Member refers or invites you to a property, we collect from the referrer your full name and email address (and, for referrals, an optional message about you), so that the property's administrators can decide whether to invite you and so we can deliver the invitation. If the referral or invitation is not taken up, this information is handled in accordance with the retention rules in section 6.
(e) Support contact — a person who contacts us at support@brevitybookings.com. We collect your name and email address, the content of your message, any files you choose to attach, and the conversation metadata needed to respond and maintain an audit trail. Please do not send passwords, payment-card details, identity documents, or other Sensitive Information through the support channel. Section 4 explains how an AI assistant helps our team with support messages, and how to ask for a person alone to handle your request.
The Privacy Act defines types of information, including Personal Information and Sensitive Information.
Personal Information means information or an opinion about an identified individual or an individual who is reasonably identifiable. If the information does not disclose your identity or enable your identity to be ascertained, it will in most cases not be classified as Personal Information and will not be subject to this Privacy Policy.
Sensitive Information is defined in the Privacy Act as including information or opinion about such things as an individual's racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record or health information.
We do not request or require Sensitive Information. Free-text fields (such as booking comments or maintenance descriptions) are intended for operational property matters, and we ask that you do not submit Sensitive Information through them. If we ever propose to collect Sensitive Information in the future, we will only do so with your express consent and in accordance with the Privacy Act, and we will update this Privacy Policy before doing so.
We collect Personal Information from you whenever you input such information into the Website or provide it to us in any other way.
In some cases, Personal Information may be provided to us by a third party — for example, where an Owner/Member enters booking details or contact information on behalf of a guest or family member, refers or invites another person to the property (see section 1(d)), uploads a document that contains another person's details, or records a guest review naming its author. Where this occurs, we require the Owner/Member to warrant that the information is accurate and provided with the individual's knowledge and consent, and we will take reasonable steps to make you aware that your information has been collected.
Because the platform provides private, account-based access to property and financial records, it is not practicable for us to deal with you anonymously or by pseudonym.
Cookies and analytics. We use one essential cookie: a secure, httpOnly session cookie used solely for authentication purposes. This cookie is necessary for the platform to function and cannot be opted out of while using the service. We do not use marketing, advertising, or third-party tracking cookies, and we do not deploy any cross-site tracking technologies or marketing pixels. We also use Vercel Web Analytics to collect aggregate, anonymised site-usage statistics. Vercel Web Analytics is cookieless and does not collect personally identifiable information. It is not possible to identify you personally from our use of these analytics.
We collect Personal Information to provide you with the Services, to operate and secure the Website, and — where you have opted in — to keep in touch with you about developments in our business.
Where we use de-identified and aggregated data to understand how the platform is used and to improve the Services, personal identifiers, entity names, property addresses and guest contact details will be removed or replaced, and financial amounts and dates will be rounded or offset, so that individuals and properties cannot reasonably be re-identified. We will not attempt to re-identify such data, and it will be stored separately from the original records with access restricted to authorised personnel. This paragraph describes our use of data that has genuinely ceased to be Personal Information — the retention and deletion commitments in section 6 below apply to your Personal Information, not to data that has been de-identified under this paragraph. Nothing in this paragraph limits your rights under the Privacy Act 1988 (Cth) or the Australian Privacy Principles.
We customarily only disclose Personal Information to our service providers who assist us in operating the Website. We take reasonable steps appropriate to the data and service to assess those providers, limit the information they receive, and require appropriate privacy and security safeguards. Your Personal Information may also be accessed from time to time by authorised maintenance and support personnel acting in the normal course of their duties.
We use legal acceptance evidence to identify which published documents applied to an account, administer material-version re-acceptance, and maintain a compliance and dispute-resolution audit trail. Authorised property owners and administrators with member-management access may view this evidence for members of their own property; it is not exposed to other guests or to administrators of unrelated properties.
Support messages sent to support@brevitybookings.com are managed in BrevitLab Alpha, BrevitLab's internal support system, which we operate ourselves. Support email is forwarded by Cloudflare Email Routing to Amazon Web Services in its Sydney region, where Amazon Simple Email Service (Amazon SES) receives and sends support email and Amazon S3 stores incoming support email and attachments. BrevitLab Alpha is hosted on Vercel and keeps support conversations in a Neon Postgres database. These providers are described in section 10.
Attachments you send to support are automatically scanned for malware and held in restricted storage. We do not open an attachment unless it is necessary to respond to your request.
AI assistant for support. Every support reply is reviewed, approved and sent by a person. We use an AI assistant to help our support team sort support messages into categories, write internal notes and prepare draft replies. The AI assistant cannot send email or publish anything to you: a person reads each draft, changes it where needed and decides whether to send it. The AI assistant does not make decisions about you (see section 12). The AI assistant is provided by xAI and Cursor (Anysphere, Inc.) and runs on computers in the United States; section 10(e) describes this overseas disclosure.
Before the AI assistant sees a message sent to support@brevitybookings.com, BrevitLab Alpha automatically replaces personal details in the text of the message with placeholders. This happens in Sydney, before anything is sent to the AI assistant. The details it looks for include names, email addresses, phone numbers, street addresses, property names known to our system, booking references, payment card and bank details, government identifiers, dates of birth, links that contain access tokens, and access codes. When a person sends a reply, our system puts the real details back so that the reply makes sense to you. Our system never puts payment card, bank, government identifier or date-of-birth details back into a draft.
Attachments are never shared with the AI assistant, whether they are sent to support@brevitybookings.com or to one of our assistant addresses. A person alone handles a support message, and the AI assistant is not shown it, if the message contains an attachment, appears to disclose a sensitive matter (for example health, bereavement, financial hardship or a legal matter), contains text that appears to be trying to instruct an AI, or cannot be processed safely by our system.
Masking is automated and is not perfect. It can miss some personal details (most often an unusual name or nickname written without context), and it cannot always recognise information you write about your circumstances in ordinary sentences. Anything it misses may be seen by the AI assistant and its provider. Please include only the personal information we need to help you.
If you would prefer a person alone to handle your support request, write “no AI” in the subject line or the body of your email to support@brevitybookings.com. From then on, a person alone handles that conversation and the AI assistant is not shown it. This does not apply to email you send directly to one of our assistant addresses (see the next paragraph).
Our AI assistants also have their own email addresses, which we do not publish. If you email one of our assistant addresses directly, rather than support@brevitybookings.com, the assistant reads the text of your email as you wrote it, without masking, and the “no AI” request above does not apply. To have your message masked, or handled by a person alone, please write to support@brevitybookings.com instead.
We will update this policy before we change the AI assistant's provider, let it see attachments or unmasked support messages sent to support@brevitybookings.com, or let it send anything to you. We use support information only to respond to the request, operate and improve support, maintain security, and meet our legal obligations.
We will only send you direct marketing about Brevity Bookings and other BrevitLab Operations Pty Ltd products and services where you have provided explicit opt-in consent through a clear affirmative action, such as ticking an unchecked consent box, and we will keep a record of each consent provided, including the date and method. We will never give your details to third parties for their marketing. Every marketing email we send will include a simple means of opting out, such as an unsubscribe link, and you can also ask us to remove you at any time using the contact details in section 11. We do not use Sensitive Information in direct marketing activity. You may withdraw any marketing consent at any time, and we will process such requests within 14 business days and provide confirmation of the withdrawal.
We store your Personal Information using industry-standard security measures, including encryption in transit, bcrypt password hashing, secure session management, and rate limiting on authentication endpoints.
Your Personal Information is retained for as long as your account remains open. This does not depend on how often you use the platform: where you hold an active subscription, we retain your information for as long as that subscription continues, whether or not you actively use the platform. Downgrading a subscription, or pausing an individual property, does not on its own start any deletion clock.
If your subscription is cancelled or lapses and is not resumed within 12 months, we will delete or de-identify the Personal Information associated with your account. We will email you before this happens, so you have the opportunity to resume your subscription or export your records first.
You can also ask us to close your account or property at any time. On explicit closure, we retain your data for 30 days — so you can reactivate, download records you still need, or simply change your mind — and after that period we delete or de-identify it.
The only exception is our own business records of any subscription payments you have made to us (for example, the amount, date and invoice reference). We are required to keep those for our own taxation purposes for a minimum of 5 years under the Taxation Administration Act 1953 (Cth), Schedule 1, Division 382. Those records are held by us and by our payment processor; they do not include your booking calendar, guest details, or property ledger.
Your own record-keeping obligations are separate from ours. Booking and financial records you create in the platform are your business records, not ours — if you need to keep them for your own tax obligations (the ATO generally expects 5 years), you must export them before deletion: during the 30-day window on explicit closure, or before the 12-month deletion following a cancelled or lapsed subscription described above (we will email you first). We do not retain them on your behalf beyond that. Session cookies and session identifiers are rotated and overwritten in the ordinary course of platform operation. Security audit-log entries (including login IP addresses, approximate country, and browser details) are retained while the relevant property remains active, as they are integral to ongoing account-security monitoring. Personal Information submitted with a Booking Request that is not approved, and referral or invitation details that are not taken up, will be retained for no longer than 12 months. Information submitted during an incomplete Account registration is retained only for a limited period.
Routine support conversations, private notes, drafts, attachments, and the associated support audit metadata are kept in our live support systems for no longer than 12 months after the conversation's most recent resolution, then deleted or de-identified. Reopening a conversation resets that period from its next resolution. We apply this through a monthly retention review, initially manual while automated enforcement and read-back are completed. Records removed from live systems may remain in isolated, protected disaster-recovery backups for up to a further 90 days before those backups expire. Backups are not used as an ordinary support archive; if one is restored, expired retention and deletion requests must be re-applied before normal operation. If a support record is reasonably required for an unresolved complaint, security incident, legal claim, or statutory obligation, we retain only the information needed for that purpose until it is resolved or the applicable period ends, and then delete or de-identify it. Copies of masked support text, notes and drafts held by the AI assistant's provider are kept as described in section 10(e).
All of the deletion and de-identification described above is carried out in accordance with APP 11.2. More generally, whenever we no longer require your Personal Information for the purpose for which it was collected, we will take reasonable steps to destroy, anonymise, or de-identify it, even outside the specific circumstances described in this section.
Legal acceptance evidence is retained with the associated account for the periods described above. When the account is deleted, the linked evidence is deleted with it; where an account must instead be de-identified to preserve legally required operational or financial records, the evidence no longer carries the person's name or contact details.
These retention rules interact with your Subscription — see our Terms & Conditions for the contractual detail on cancellation, lapse, and closure.
The Australian Privacy Principles and the Privacy Act apply in full to our handling of your Personal Information. In particular:
Where you would like to obtain such access or correction, please contact us in writing using the contact details set out at the bottom of this Privacy Policy. We will respond to your written request within 30 calendar days of receipt. If we require additional time, we will notify you in writing and provide a revised timeline. To verify your identity, we may require email verification or responses to security questions before processing your request.
If the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act) applies to us, then in the event of an eligible data breach that is likely to result in serious harm to any individual whose Personal Information is involved, we will assess the breach promptly upon becoming aware of it and notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable. Our notification will include details of the nature of the breach, the Personal Information involved, the steps we have taken in response, and any recommended protective actions you should consider.
If you have a complaint concerning the manner in which we maintain the privacy of your Personal Information, please contact us using the contact details set out at the bottom of this policy. All complaints will be considered by our Privacy Officer, and we may seek further information from you to clarify your concerns. If we agree that your complaint is well founded, we will, in consultation with you, take appropriate steps to rectify the problem. If you remain dissatisfied with the outcome, you may refer the matter to the OAIC at www.oaic.gov.au.
We use third-party service providers to operate the Website and deliver our services. Some of these providers are incorporated in the United States of America (US), and some process or store your Personal Information on servers located outside Australia. In accordance with Australian Privacy Principle 8 (APP 8), we disclose the following:
(a) Sydney-hosted, US-incorporated vendors (Neon, Vercel, Upstash, Amazon Web Services). Our database (Neon), hosting and file storage (Vercel), and rate-limiting infrastructure (Upstash) are each physically hosted on servers located in Sydney, Australia. BrevitLab Alpha, our support system, also uses Neon for its database and Vercel for hosting in Sydney, and uses Amazon Web Services in its Sydney region (ap-southeast-2) to send and receive support email (Amazon SES) and to store support email and attachments, which are scanned for malware (Amazon S3). Email travels over the public internet, so support email sent to or from us may pass through networks and mail servers outside Australia before it reaches, or after it leaves, these Sydney-hosted services. However, each of these vendors is incorporated in the United States. Accordingly, data held in their custody may be subject to compelled disclosure under the United States Clarifying Lawful Overseas Use of Data Act 2018 (CLOUD Act) or other applicable US law, regardless of the physical location of the servers. We disclose the US domicile of these vendors in the interests of transparency and in accordance with our obligations under APP 8.
(b) US-processed vendor (Resend). Transactional emails are delivered via Resend, a US-incorporated company whose servers are located in the United States. In the course of delivering transactional emails, Resend processes Personal Information including names, email addresses, and booking-related content on servers physically located in the United States. This constitutes a disclosure of Personal Information to an overseas recipient for the purposes of APP 8.
(c) Global email-routing, edge, and security provider (Cloudflare). Cloudflare, a US-incorporated global network provider, provides Email Routing for support@brevitybookings.com. Incoming support email is first received and processed by Cloudflare's mail servers before being forwarded to Amazon SES in Sydney for BrevitLab Alpha. The sender and recipient addresses, full message body, attachments, IP addresses, and other delivery or traffic metadata may therefore be processed outside Australia through Cloudflare's global services; Cloudflare states that account and service metadata may be stored in the United States or Europe. Its handling is governed by the Cloudflare terms and privacy materials applicable to our account.
(d) US-processed vendor (Stripe). Payment processing is handled by Stripe, a US-incorporated company. Stripe processes payment-related data on servers located in the United States. We do not transmit or store payment card details — those are handled directly and exclusively by Stripe. This constitutes a further disclosure of Personal Information to an overseas recipient under APP 8.
(e) US-processed AI assistant service (xAI and Cursor). Our AI support assistant (see section 4) is a Grok Bot, an AI agent product from xAI (United States). Its accounts, plans, privacy terms and data-processing terms are provided by Anysphere, Inc. (trading as Cursor), a US-incorporated company. The assistant runs on computers in the United States. Cursor chooses the AI models that serve the assistant, and that choice may change over time. We disclose to this service: the masked text of support messages that BrevitLab Alpha has cleared for the assistant, together with the notes and draft replies the assistant writes; and the full, unmasked text of any email sent directly to one of our assistant addresses. We never disclose attachments to it, whether they are sent to support@brevitybookings.com or to an assistant address. Because masking can miss some personal details, and email sent directly to an assistant address is not masked, this is a disclosure of Personal Information to an overseas recipient for the purposes of APP 8. The provider stores this information in its systems as part of providing the service. The provider's published terms do not state how long it keeps this information for this service; we will update this policy when the provider states a retention period. We have turned on the provider's “Privacy Mode” setting for our account. According to the provider, with Privacy Mode on, customer data is not used to train AI models. The provider also states that its AI assistant service requires data storage and does not support the provider's “Legacy Privacy Mode”.
(f) APP 8 compliance, data processing agreements, and third-party terms. Before disclosing your Personal Information to an overseas recipient, we take reasonable steps to ensure that the overseas recipient does not breach the Australian Privacy Principles in relation to that information. Depending on the data and service, those steps may include reviewing the provider's privacy, security and subprocessor practices; limiting the information disclosed; applying access controls; and executing or accepting a Data Processing Agreement where one is available and appropriate. We periodically review these arrangements and stop or change a disclosure if the safeguards are no longer adequate. Where we are unable to take reasonable steps, we will seek your consent prior to disclosure, unless an exception under the Privacy Act applies. Your use of the Website is also subject to the applicable terms and conditions of each third-party service provider listed in this clause, including Neon, Vercel, Upstash, Amazon Web Services, Resend, Cloudflare, Stripe, xAI and Cursor (Anysphere, Inc.). We encourage you to review those terms before using the Website. By using the Website, you acknowledge that some of your Personal Information may be transferred to, processed, or stored by the vendors described in this clause, including in the United States, in accordance with this clause.
If you have any queries, if you seek access to or correction of your Personal Information, or if you have a complaint about our privacy practices, you can contact us at: support@brevitybookings.com.
We use automated decision-making in a few places. Each one uses personal information.
Our system makes, or does most of the work in making, some decisions that could reasonably be expected to significantly affect your rights or interests. They are:
If you have a question about any of these, contact us under section 11. If you want to raise a concern about how one applied to you, you can complain under section 9.
The AI assistant we use for support (see section 4) does not make decisions about you. It helps our team sort support messages and prepare draft replies, and a person reviews and approves every reply before it is sent to you.
If we start a new kind of automated decision-making that could significantly affect you, we will update this Privacy Policy first to describe it.