Brevity Bookings
Last updated: 1 September 2026
This Privacy Policy applies to all personal information collected by BrevitLab Operations Pty Ltd (ABN 52 700 825 332; ACN 700 825 332) trading as Brevity Bookings (we, us or our) via the website located at BrevityBookings.com (Website). Brevity Bookings lets people create an Account directly, while access to each property remains private and controlled by that property's administrators. It is designed for owners of holiday and short-term rental properties and the people they give access to. The platform provides a shared booking calendar, guest management tools, a financial ledger with Australian financial-year reporting, and cleaning and maintenance job tracking. Brevity Bookings is not a marketplace, does not facilitate or process payments between property owners and guests, and does not hold client money or trust accounts. The platform is offered on a paid subscription basis. Promotional offers (including free introductory periods) and complimentary access may be provided at BrevitLab's discretion.
We comply with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs) in full.
The service is intended for use by adults only — you must be of legal age to form a binding contract in your jurisdiction to register for or use the platform. By registering, you confirm that you meet this requirement.
The kind of Personal Information we collect from you will depend on how you interact with the Website. A person may create an Account without joining a property or purchasing a Subscription. Access to an existing property is granted only by that property's administrators — either by invitation or by approving a Booking Request; no one can join a property without an administrator granting access. A separate Booking Request form is available via an owner-shared link; submission of that form does not create an account or grant access to the platform.
The Personal Information we collect and hold about you will depend on which of the following categories applies to you:
(a) Account holder — a user who creates an Account, whether or not they later subscribe or administer one or more properties. We collect: full name; email address; password (stored in hashed form using bcrypt — never stored as plain text); cookies and session identifiers (authentication session token); the address of the rental property being administered (a free-text field describing the managed property, not the individual's personal home address); documents and images you choose to upload to the platform — such as receipts, invoices, quotes, and maintenance or property photos — which may contain personal information about third parties (for example, a tradesperson's name and contact details on an invoice); and, where you subscribe, a Stripe customer and subscription reference ID (we do not receive or store card numbers — Stripe handles payment card data directly). When a login is attempted on your account (successfully or unsuccessfully), we record the IP address, approximate country, and browser (user-agent) of the attempt, together with the email address used, in a security audit log; this data is used for rate limiting, account-lockout protection, and to alert you by email to logins from a new location. This applies to any login attempt, including attempts made using an email address that is not registered with us.
(b) Invited User — a user who has been granted access to a property by that property's administrators, whether by accepting an invitation or on approval of a Booking Request they submitted. Property access does not require that user to purchase a Subscription. We collect: full name; email address; password (stored in hashed form using bcrypt — never stored as plain text); and cookies and session identifiers (authentication session token). Login security data is handled as described in (a).
Legal acceptance evidence for account holders. When an Owner/Member or Guest User accepts our Website Terms and acknowledges this Privacy Policy, we record the version identifier for each document, the date and time, and the acceptance source and method (for example, an unchecked affirmative checkbox during registration, invitation acceptance, or a later re-acceptance). The record is linked to the account; request-only Booking Requests do not create this evidence.
(c) Booking Request (request only) — a prospective guest who submits a Booking Request via an owner-shared link. Submission does not grant platform access; an administrator of that property must approve the request before any account is created, and the person submitting the request may never become a user. We collect: full name; email address; phone number (optional); IP address (logged for rate-limiting and audit trail purposes); and a free-text message. This information is held solely for the purpose of processing the request and will not be used for any other purpose without your consent.
(d) Referred or invited person — where an existing Owner/Member refers or invites you to a property, we collect from the referrer your full name and email address (and, for referrals, an optional message about you), so that the property's administrators can decide whether to invite you and so we can deliver the invitation. If the referral or invitation is not taken up, this information is handled in accordance with the retention rules in section 6.
(e) Waitlist subscriber — a visitor who joins the pre-launch waitlist on our public website. We collect: email address; your name (optional); the number of properties you manage (self-reported); and, where our hashing key is configured, a salted one-way hash derived from your IP address (used solely for abuse prevention — the IP address itself is not stored). Joining the waitlist does not create an account and grants no access to the platform. This information is used only for the communications described in section 5 and is handled in accordance with the retention rules in section 6.
(f) Support contact — a person who contacts us at support@brevitybookings.com. We collect your name and email address, the content of your message, any files you choose to attach, and the conversation metadata needed to respond and maintain an audit trail. Please do not send passwords, payment-card details, identity documents, or other Sensitive Information through the support channel.
The Privacy Act defines types of information, including Personal Information and Sensitive Information.
Personal Information means information or an opinion about an identified individual or an individual who is reasonably identifiable. If the information does not disclose your identity or enable your identity to be ascertained, it will in most cases not be classified as Personal Information and will not be subject to this Privacy Policy.
Sensitive Information is defined in the Privacy Act as including information or opinion about such things as an individual's racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record or health information.
We do not request or require Sensitive Information. Free-text fields (such as booking comments or maintenance descriptions) are intended for operational property matters, and we ask that you do not submit Sensitive Information through them. If we ever propose to collect Sensitive Information in the future, we will only do so with your express consent and in accordance with the Privacy Act, and we will update this Privacy Policy before doing so.
We collect Personal Information from you whenever you input such information into the Website or provide it to us in any other way.
In some cases, Personal Information may be provided to us by a third party — for example, where an Owner/Member enters booking details or contact information on behalf of a guest or family member, refers or invites another person to the property (see section 1(d)), uploads a document that contains another person's details, or records a guest review naming its author. Where this occurs, we require the Owner/Member to warrant that the information is accurate and provided with the individual's knowledge and consent, and we will take reasonable steps to make you aware that your information has been collected.
Because the platform provides private, account-based access to property and financial records, it is not practicable for us to deal with you anonymously or by pseudonym.
Cookies and analytics. We use one essential cookie: a secure, httpOnly session cookie used solely for authentication purposes. This cookie is necessary for the platform to function and cannot be opted out of while using the service. We do not use marketing, advertising, or third-party tracking cookies, and we do not deploy any cross-site tracking technologies or marketing pixels. We also use Vercel Web Analytics to collect aggregate, anonymised site-usage statistics. Vercel Web Analytics is cookieless and does not collect personally identifiable information. It is not possible to identify you personally from our use of these analytics.
We collect Personal Information to provide you with the Services, to operate and secure the Website, and — where you have opted in — to keep in touch with you about developments in our business.
Where we use de-identified and aggregated data to understand how the platform is used and to improve the Services, personal identifiers, entity names, property addresses and guest contact details will be removed or replaced, and financial amounts and dates will be rounded or offset, so that individuals and properties cannot reasonably be re-identified. We will not attempt to re-identify such data, and it will be stored separately from the original records with access restricted to authorised personnel. This paragraph describes our use of data that has genuinely ceased to be Personal Information — the retention and deletion commitments in section 6 below apply to your Personal Information, not to data that has been de-identified under this paragraph. Nothing in this paragraph limits your rights under the Privacy Act 1988 (Cth) or the Australian Privacy Principles.
We customarily only disclose Personal Information to our service providers who assist us in operating the Website. We take reasonable steps appropriate to the data and service to assess those providers, limit the information they receive, and require appropriate privacy and security safeguards. Your Personal Information may also be accessed from time to time by authorised maintenance and support personnel acting in the normal course of their duties.
We use legal acceptance evidence to identify which published documents applied to an account, administer material-version re-acceptance, and maintain a compliance and dispute-resolution audit trail. Authorised property owners and administrators with member-management access may view this evidence for members of their own property; it is not exposed to other guests or to administrators of unrelated properties.
Support messages sent to support@brevitybookings.com are managed in Chatwoot, our customer-conversation system of record. We operate a self-hosted Chatwoot Community Edition instance rather than Chatwoot's hosted cloud service. A local, fail-closed bridge on our controlled operations host connects Chatwoot to Bree, our constrained Hermes support profile. At the current dry-run stage, that bridge is approved only for deterministic event validation, redaction, routing, audit, and controlled synthetic or private-note tests. It is not approved to send real customer content to a generative-AI provider, publish a customer-visible reply, or make payment, account-access, privacy, security, deletion, or other high-risk decisions. We will update this policy and our vendor review before any generative-AI provider is permitted to receive real support content. We use support information only to respond to the request, operate and improve support, maintain security, and meet our legal obligations.
If you join our pre-launch waitlist, we will send you an announcement when the product opens, and we may from time to time send you direct marketing about Brevity Bookings and other BrevitLab Operations Pty Ltd products and services — for example product updates, offers, or a community newsletter. Submitting the waitlist form is your express opt-in to these communications: the form states this purpose at the point of collection, and we record the date and the page from which each consent was given. We will never give your details to third parties for their marketing. Every marketing email we send will include a simple means of opting out, such as an unsubscribe link, and you can also ask us to remove you at any time using the contact details in section 11.
For any direct marketing beyond the scope described above, we will only send it where you have provided explicit opt-in consent through a clear affirmative action, such as ticking an unchecked consent box, and we will keep a record of each consent provided, including the date and method. We do not use Sensitive Information in direct marketing activity. You may withdraw any marketing consent at any time, and we will process such requests within 14 business days and provide confirmation of the withdrawal.
We store your Personal Information using industry-standard security measures, including encryption in transit, bcrypt password hashing, secure session management, and rate limiting on authentication endpoints.
Your Personal Information is retained for as long as your account remains open. This does not depend on how often you use the platform: where you hold an active subscription, we retain your information for as long as that subscription continues, whether or not you actively use the platform. Downgrading a subscription, or pausing an individual property, does not on its own start any deletion clock.
If your subscription is cancelled or lapses and is not resumed within 12 months, we will delete or de-identify the Personal Information associated with your account. We will email you before this happens, so you have the opportunity to resume your subscription or export your records first.
You can also ask us to close your account or property at any time. On explicit closure, we retain your data for 30 days — so you can reactivate, download records you still need, or simply change your mind — and after that period we delete or de-identify it.
The only exception is our own business records of any subscription payments you have made to us (for example, the amount, date and invoice reference). We are required to keep those for our own taxation purposes for a minimum of 5 years under the Taxation Administration Act 1953 (Cth), Schedule 1, Division 382. Those records are held by us and by our payment processor; they do not include your booking calendar, guest details, or property ledger.
Your own record-keeping obligations are separate from ours. Booking and financial records you create in the platform are your business records, not ours — if you need to keep them for your own tax obligations (the ATO generally expects 5 years), you must export them before deletion: during the 30-day window on explicit closure, or before the 12-month deletion following a cancelled or lapsed subscription described above (we will email you first). We do not retain them on your behalf beyond that. Session cookies and session identifiers are rotated and overwritten in the ordinary course of platform operation. Security audit-log entries (including login IP addresses, approximate country, and browser details) are retained while the relevant property remains active, as they are integral to ongoing account-security monitoring. Personal Information submitted with a Booking Request that is not approved, and referral or invitation details that are not taken up, will be retained for no longer than 12 months. Information submitted during an incomplete Account registration is retained only for a limited period. Waitlist entries are retained for no longer than 12 months from the date you joined, after which they are deleted automatically.
Routine support conversations, private notes, drafts, attachments, and the associated Bree bridge audit metadata are kept in our live support systems for no longer than 12 months after the conversation's most recent resolution, then deleted or de-identified. Reopening a conversation resets that period from its next resolution. We apply this through a monthly retention review, initially manual while automated enforcement and read-back are completed. Records removed from live systems may remain in isolated, protected disaster-recovery backups for up to a further 90 days before those backups expire. Backups are not used as an ordinary support archive; if one is restored, expired retention and deletion requests must be re-applied before normal operation. If a support record is reasonably required for an unresolved complaint, security incident, legal claim, or statutory obligation, we retain only the information needed for that purpose until it is resolved or the applicable period ends, and then delete or de-identify it.
All of the deletion and de-identification described above is carried out in accordance with APP 11.2. More generally, whenever we no longer require your Personal Information for the purpose for which it was collected, we will take reasonable steps to destroy, anonymise, or de-identify it, even outside the specific circumstances described in this section.
Legal acceptance evidence is retained with the associated account for the periods described above. When the account is deleted, the linked evidence is deleted with it; where an account must instead be de-identified to preserve legally required operational or financial records, the evidence no longer carries the person's name or contact details.
These retention rules interact with your Subscription — see our Terms & Conditions for the contractual detail on cancellation, lapse, and closure.
The Australian Privacy Principles and the Privacy Act apply in full to our handling of your Personal Information. In particular:
Where you would like to obtain such access or correction, please contact us in writing using the contact details set out at the bottom of this Privacy Policy. We will respond to your written request within 30 calendar days of receipt. If we require additional time, we will notify you in writing and provide a revised timeline. To verify your identity, we may require email verification or responses to security questions before processing your request.
If the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act) applies to us, then in the event of an eligible data breach that is likely to result in serious harm to any individual whose Personal Information is involved, we will assess the breach promptly upon becoming aware of it and notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable. Our notification will include details of the nature of the breach, the Personal Information involved, the steps we have taken in response, and any recommended protective actions you should consider.
If you have a complaint concerning the manner in which we maintain the privacy of your Personal Information, please contact us using the contact details set out at the bottom of this policy. All complaints will be considered by our Privacy Officer, and we may seek further information from you to clarify your concerns. If we agree that your complaint is well founded, we will, in consultation with you, take appropriate steps to rectify the problem. If you remain dissatisfied with the outcome, you may refer the matter to the OAIC at www.oaic.gov.au.
We use third-party service providers to operate the Website and deliver our services. Some of these providers are incorporated in the United States of America (US), and some process or store your Personal Information on servers located outside Australia. In accordance with Australian Privacy Principle 8 (APP 8), we disclose the following:
(a) Sydney-hosted, US-incorporated vendors (Neon, Vercel, Upstash). Our database (Neon), hosting and file storage (Vercel), and rate-limiting infrastructure (Upstash) are each physically hosted on servers located in Sydney, Australia. However, each of these vendors is incorporated in the United States. Accordingly, data held in their custody may be subject to compelled disclosure under the United States Clarifying Lawful Overseas Use of Data Act 2018 (CLOUD Act) or other applicable US law, regardless of the physical location of the servers. We disclose the US domicile of these vendors in the interests of transparency and in accordance with our obligations under APP 8.
(b) US-processed vendor (Resend). Transactional emails are delivered via Resend, a US-incorporated company whose servers are located in the United States. In the course of delivering transactional emails, Resend processes Personal Information including names, email addresses, and booking-related content on servers physically located in the United States. This constitutes a disclosure of Personal Information to an overseas recipient for the purposes of APP 8.
(c) Global email-routing, edge, and security provider (Cloudflare). Cloudflare, a US-incorporated global network provider, publishes our self-hosted support service and provides Email Routing for support@brevitybookings.com. Incoming support email is first received and processed by Cloudflare's mail servers before being forwarded to our self-hosted inbox. The sender and recipient addresses, full message body, attachments, IP addresses, and other delivery or traffic metadata may therefore be processed outside Australia through Cloudflare's global services; Cloudflare states that account and service metadata may be stored in the United States or Europe. Its handling is governed by the Cloudflare terms and privacy materials applicable to our account.
(d) US-processed vendor (Stripe). Payment processing is handled by Stripe, a US-incorporated company. Stripe processes payment-related data on servers located in the United States. We do not transmit or store payment card details — those are handled directly and exclusively by Stripe. This constitutes a further disclosure of Personal Information to an overseas recipient under APP 8.
(e) APP 8 compliance, data processing agreements, and third-party terms. Before disclosing your Personal Information to an overseas recipient, we take reasonable steps to ensure that the overseas recipient does not breach the Australian Privacy Principles in relation to that information. Depending on the data and service, those steps may include reviewing the provider's privacy, security and subprocessor practices; limiting the information disclosed; applying access controls; and executing or accepting a Data Processing Agreement where one is available and appropriate. We periodically review these arrangements and stop or change a disclosure if the safeguards are no longer adequate. Where we are unable to take reasonable steps, we will seek your consent prior to disclosure, unless an exception under the Privacy Act applies. Your use of the Website is also subject to the applicable terms and conditions of each third-party service provider listed in this clause, including Neon, Vercel, Upstash, Resend, Cloudflare, and Stripe. We encourage you to review those terms before using the Website. By using the Website, you acknowledge that some of your Personal Information may be transferred to, processed, or stored by the vendors described in this clause, including in the United States, in accordance with this clause.
If you have any queries, if you seek access to or correction of your Personal Information, or if you have a complaint about our privacy practices, you can contact us at: support@brevitybookings.com.