Brevity Bookings
Last updated: 1 November 2026
Updated 1 November 2026: sections 1(e), 4 and 10(e) now cover questions sent through the enquiry form on our website. Updated 31 October 2026: section 1(a) clarified, and a new “Our ads” paragraph in section 3, with a matching line in section 4. These changes apply only to visits, sign-ups and enquiries after those dates. The Terms are unchanged (last updated 29 October 2026), and nothing changes for existing Account holders. On 31 October 2026 the rest of the policy was also rewritten in plainer language, with no change to what we collect, how we use it or who we share it with.
This Privacy Policy applies to all personal information collected by BrevitLab Operations Pty Ltd (ABN 52 700 825 332; ACN 700 825 332) trading as Brevity Bookings (we, us or our) via the website located at BrevityBookings.com (Website). Brevity Bookings is for owners of holiday and short-term rental properties and the people they give access to. Anyone can create an Account, but access to each property is private and controlled by that property's administrators. The platform provides a shared booking calendar, guest management, a financial ledger with Australian financial-year reporting, and cleaning and maintenance job tracking. Brevity Bookings does not hold client money or operate trust accounts. Where an owner chooses to take guest payments through the platform, the guest pays on a secure page run by Stripe and the money goes into the owner's own Stripe account; we never receive it. The platform is offered on a free plan with limited features and on a paid subscription basis. Promotional offers (including free introductory periods) and complimentary access may be provided at BrevitLab's discretion.
We comply with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs) in full.
The service is intended for use by adults only. You must be of legal age to form a binding contract in your jurisdiction to register for or use the platform. By registering, you confirm that you meet this requirement.
What we collect depends on how you use the Website. A person may create an Account without joining a property or buying a Subscription. Access to an existing property is granted only by that property's administrators, either by invitation or by approving a Booking Request; no one can join a property without an administrator granting access. A separate Booking Request form is available through a link an owner shares; sending it does not create an account or give access to the platform.
The Personal Information we collect depends on which of these categories applies to you:
(a) Account holder: a user who creates an Account, whether or not they later subscribe or run one or more properties. We collect: your full name and email address; your password, which is never stored in readable form; the session details that keep you signed in; the address of the rental property you manage (not your home address); documents and images you choose to upload (such as receipts, invoices, quotes and property photos), which may include other people's details, such as a tradesperson's name on an invoice; and, if you subscribe, Stripe's references for your customer record and subscription. We do not receive or store card numbers; Stripe handles card details directly. Whenever someone tries to log in to your account, or with an email address that is not registered with us, we record the email address used and the IP address, approximate country and browser of the attempt. We use this to protect accounts from repeated failed logins and to tell you about logins from a new location.
If you sign up through our public sign-up, we also hold the date your introductory full access ends and a record of the plan notices we send you. If renewal payments for your subscription fail and Stripe stops trying to collect them, we record when, because that decides when your account moves to the free plan. When you start a subscription from the free plan or introductory full access, we ask you to pick the main reason you upgraded from a short list. The answer is also stored with our payment processor, Stripe.
(b) Invited User: a user who has been granted access to a property by that property's administrators, whether by accepting an invitation or on approval of a Booking Request they submitted. An Invited User does not need to buy a Subscription. We collect: full name; email address; password (never stored in readable form); and the session details that keep you signed in. Login security details are handled as described in (a).
Record of accepting our terms. When you accept our Website Terms and acknowledge this Privacy Policy, we record which versions you accepted, when, and how (for example, at sign-up or when accepting an invitation). The record is linked to your account. Sending a Booking Request alone does not create one.
Guest payments and tax reporting. Where an owner connects a Stripe account so that guests can pay online, we collect the following.
(c) Booking Request (request only): a prospective guest who sends a Booking Request through a link an owner shares. Sending it does not give access to the platform; an administrator of that property must approve the request before any account is created, and the person may never become a user. We collect: full name; email address; phone number (optional); a message; and the IP address it was sent from, for security. We use this information only to deal with the request, and not for any other purpose without your consent.
(d) Referred or invited person: where an existing Owner/Member refers or invites you to a property, we collect your full name and email address from them (and, for referrals, an optional message about you), so that the property's administrators can decide whether to invite you and so we can deliver the invitation. If the referral or invitation is not taken up, this information is handled under the retention rules in section 6.
(e) Support contact: a person who contacts us at support@brevitybookings.com or through the enquiry form on our website. We collect your name and email address, your message (and, for the enquiry form, how many properties you have if you tell us), any files you attach, and a record of the conversation. Please do not send passwords, payment-card details, identity documents, or other Sensitive Information to support. Section 4 explains how an AI assistant helps our team with support messages, and how to ask for a person alone to handle your request.
The Privacy Act defines types of information, including Personal Information and Sensitive Information.
Personal Information means information or an opinion about an identified individual or an individual who is reasonably identifiable. If the information does not disclose your identity or enable your identity to be ascertained, it will in most cases not be classified as Personal Information and will not be subject to this Privacy Policy.
Sensitive Information is defined in the Privacy Act as including information or opinion about such things as an individual's racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record or health information.
We do not request or require Sensitive Information. Free-text fields (such as booking comments or maintenance descriptions) are intended for operational property matters, and we ask that you do not submit Sensitive Information through them. If we ever propose to collect Sensitive Information in the future, we will only do so with your express consent and in accordance with the Privacy Act, and we will update this Privacy Policy before doing so.
We collect Personal Information from you whenever you enter it on the Website or give it to us in any other way.
Sometimes another person gives us your Personal Information: for example, where an Owner/Member enters booking or contact details for a guest or family member, refers or invites another person to the property (see section 1(d)), uploads a document that contains another person's details, or records a guest review naming its author. Where this happens, we require the Owner/Member to warrant that the information is accurate and given with the person's knowledge and consent, and we will take reasonable steps to make you aware that we hold it.
Because the platform gives private, account-based access to property and financial records, it is not practicable for us to deal with you anonymously or by pseudonym.
Cookies and analytics. We use one cookie, which keeps you signed in. It is essential, so it cannot be turned off while you use the platform. We do not use marketing, advertising or tracking cookies, cross-site tracking or marketing pixels. We use Vercel Web Analytics for anonymous site statistics; it uses no cookies and cannot identify you.
Our ads. We track which of our online ads lead to visits to our website and to new accounts. We do not use cookies for this, and we do not send any information to advertising platforms.
We also keep our own daily counts of visits to our public pages (and from which of our ads, if any), sign-ups started and sign-up email links opened. These counts use no cookie or browser storage, and they are numbers only: nothing that identifies you is stored with them. Your IP address and browser type are used only in the moment, to limit repeated requests and leave out automated visits, and are not stored.
We collect Personal Information to provide you with the Services, to operate and secure the Website, and (where you have opted in) to keep in touch with you about developments in our business.
Where we use de-identified and aggregated data to understand how the platform is used and to improve the Services, we first remove or change anything that could identify a person or a property, keep that data apart from the original records with access restricted to authorised personnel, and never try to re-identify it. Data treated this way is no longer Personal Information, so the retention and deletion rules in section 6 do not apply to it. This paragraph does not cover the sign-up milestone record described next, and nothing in it limits your rights under the Privacy Act 1988 (Cth) or the Australian Privacy Principles.
Understanding how new accounts use the service. For each account created through our public sign-up, we keep a small record of milestones so that we can see where new owners get stuck and improve the service. It holds the week the account was created, whether it had introductory full access, the ad that led to the sign-up, if any (section 3), how long after sign-up it first reached each key step (setting up multi-factor authentication, creating a property, recording a first stay, recording a first guest payment, reaching the end of introductory full access and whether it had subscribed by then, and starting a subscription), the number of guest payments recorded, an estimated saving in marketplace fees, and any upgrade reason you chose. It is linked to your account while the account exists. We report it only as totals (by week and by ad), and it is not used to make decisions about you or to send you marketing. Accounts joined by invitation, and accounts with complimentary access, are not included. When your account is deleted, the link to you is removed and only the unlinked milestone figures remain.
Plan emails. We email account holders about their plan: for example, before introductory full access ends, when an account moves to the free plan, before the first charge for a subscription started during introductory full access, and before a promotional price ends. These emails tell you what is changing and when, and how to manage your plan.
Apart from the disclosures to Stripe and the Australian Taxation Office described below, we usually disclose Personal Information only to the service providers who help us run the Website (see section 10). We take reasonable steps, suited to the data and the service, to check those providers, limit what they receive, and require appropriate privacy and security safeguards. Authorised maintenance and support staff may also see your Personal Information in the normal course of their work.
We use the record of your acceptance of our terms to show which documents applied to an account, to ask for agreement to material changes, and as an audit trail for compliance and disputes. Property owners and administrators who manage members can see it for members of their own property; other guests and administrators of other properties cannot.
Guest payments. We use the guest payment information in section 1 to let owners take payment for stays, to show the owner and the paying guest whether a booking has been paid, to record each payment in the property's ledger, and to stop a guest being charged twice. To set up each payment we give Stripe the amount and our references for the booking, the property and the payment. Stripe processes the payment for the owner, and acts on its own account when it checks an owner's identity and meets its own legal obligations; Stripe's handling of that information is governed by Stripe's privacy policy. Owners, and property administrators who can see bookings or the property's finances, can see the payment status and amount of each booking at their property.
Reporting to the Australian Taxation Office. Australian law requires us, as the platform through which guests pay for stays, to report those payments to the Australian Taxation Office under the Sharing Economy Reporting Regime. Twice a year (by 31 January and 31 July) we are required to report, for each owner whose Stripe account received guest payments: the tax reporting details described in section 1, the owner's email address, the address and kind of dwelling of each property, for each quarter the number of paid stays, the number of nights and the total amounts paid (including GST, shown separately), and the owner's Stripe account identifier as the account the payments went to (we do not hold bank account numbers). This disclosure is required by Australian law (APP 6.2(b)), so it cannot be opted out of for a stay a guest paid for through the platform. Bookings with no payment attached are not reported. Guests' names and contact details are not part of this report, and we use these tax reporting details only for this purpose.
Support. Support messages sent to support@brevitybookings.com are managed in BrevitLab Alpha, our own support system. Section 10 names the providers that carry and store support email. Attachments you send to support are checked for malware and kept with restricted access, and we open one only when we need to in order to help you.
AI assistant for support. Every support reply is reviewed, approved and sent by a person. An AI assistant helps our support team sort support messages, write internal notes and prepare draft replies. It cannot send anything to you or publish anything, and it does not make decisions about you (see section 12). It is provided by xAI and Cursor (Anysphere, Inc.) and runs in the United States; section 10(e) describes this overseas disclosure.
Before the AI assistant sees a message sent to support@brevitybookings.com, our system replaces personal details in it with placeholders. These include names, contact details, addresses, property names, booking references, payment card and bank details, government identifiers, dates of birth, and access links and codes. When a person sends you a reply, the real details are put back so that it makes sense, except payment card, bank, government identifier and date-of-birth details, which are never put back into a draft.
Masking is automated and is not perfect. It can miss some personal details (most often an unusual name or nickname), and it cannot always recognise information you write about your circumstances in ordinary sentences. Anything it misses may be seen by the AI assistant and its provider, so please include only the personal information we need to help you.
Attachments are never shared with the AI assistant, whichever of our addresses they are sent to. A person alone handles a support message, and the AI assistant is not shown it, if the message has an attachment, appears to involve a sensitive matter (for example health, bereavement, financial hardship or a legal matter), appears to be trying to instruct an AI, or cannot be processed safely.
If you would prefer a person alone to handle your support request, write “no AI” in the subject line or the body of your email to support@brevitybookings.com. From then on, a person alone handles that conversation and the AI assistant is not shown it.
Our AI assistants also have their own email addresses, which we do not publish. If you email one of our assistant addresses directly, rather than support@brevitybookings.com, the assistant reads your email as you wrote it, without masking, and a “no AI” request does not apply. To have your message masked, or handled by a person alone, please write to support@brevitybookings.com instead.
Questions sent through the enquiry form on our website are emailed to one of our assistant addresses, so they are handled in the same way: the assistant reads them as you wrote them, without masking, and the “no AI” request does not apply. The assistant only drafts a reply: a person reads every enquiry and decides what is sent. We do not store enquiry-form messages in our app. To have your question masked, or handled by a person alone, please write to support@brevitybookings.com instead.
We will update this policy before we change the AI assistant's provider, let it see attachments or unmasked messages sent to support@brevitybookings.com, or let it send anything to you. We use support information only to respond to you, run and improve support, keep the service secure, and meet our legal obligations.
We will only send you direct marketing about Brevity Bookings and other BrevitLab Operations Pty Ltd products and services where you have provided explicit opt-in consent through a clear affirmative action, such as ticking an unchecked consent box, and we will keep a record of each consent provided, including the date and method. We will never give your details to third parties for their marketing. Every marketing email we send will include a simple means of opting out, such as an unsubscribe link, and you can also ask us to remove you at any time using the contact details in section 11. We do not use Sensitive Information in direct marketing activity. You may withdraw any marketing consent at any time, and we will process such requests within 14 business days and provide confirmation of the withdrawal.
We protect your Personal Information with industry-standard security, including encryption in transit, passwords that are never stored in readable form, secure sign-in, and limits on repeated login attempts.
Your Personal Information is retained for as long as your account remains open. This does not depend on how often you use the platform: whether you hold an active subscription, are in introductory full access, have complimentary access or are on the free plan, we retain your information for as long as your account stays open, whether or not you actively use the platform. Downgrading or cancelling a subscription, letting it lapse, or pausing an individual property, does not on its own start any deletion clock. Records of the plan notices we send you are kept with your account and deleted with it.
If your subscription is cancelled or lapses, your account moves to the free plan. We do not delete your information because of that: it stays for as long as your account stays open, and you can export your records at any time.
You can also close your account or property at any time. On explicit closure, we retain your data for 30 days (so you can reactivate, download records you still need, or simply change your mind), and after that period we delete or de-identify it, except for the tax reporting records described below.
Tax reporting records after closure. Where guests paid for stays through the platform, closing an account or property does not delete the records we must keep for our Sharing Economy Reporting Regime reports to the Australian Taxation Office. We keep the owner's tax reporting details described in section 1, the owner's email address and Stripe account identifier, and, for each paid stay, the amount and date of the payment, Stripe's reference for it, any refund Stripe reports, the stay dates and number of nights, and the address and kind of dwelling of the property. We keep these records for at least 5 years after the due date of the report that includes them, or after the date we lodge it if that is later, as Australian tax law requires, and then delete them. We use them only to prepare, lodge and support those reports. They do not include guests' names or contact details.
Our other exception is our own business records of any subscription payments you have made to us (for example, the amount, date and invoice reference). We are required to keep those for our own taxation purposes for a minimum of 5 years under the Taxation Administration Act 1953 (Cth), Schedule 1, Division 382. Those records are held by us and by our payment processor; they do not include your booking calendar, guest details, or property ledger.
Your own record-keeping obligations are separate from ours. Booking and financial records you create in the platform are your business records, not ours. If you need to keep them for your own tax obligations (the ATO generally expects 5 years), you must export them before deletion, which means during the 30-day window after you close your account or property. We do not retain them on your behalf beyond that. Sign-in session details are replaced regularly as you use the platform. Login security records (IP address, approximate country and browser) are kept while the relevant property remains active, because we use them to protect accounts. Personal Information submitted with a Booking Request that is not approved, and referral or invitation details that are not taken up, will be retained for no longer than 12 months. Information submitted during an incomplete Account registration is retained only for a limited period.
Support conversations, notes, drafts and attachments, and the records that go with them, are kept for no longer than 12 months after the conversation was last resolved, then deleted or de-identified (reopening a conversation starts that period again). We check this every month. Deleted records may stay in protected backups for up to a further 90 days. We do not use backups as a support archive, and if we ever restore one, we re-apply every deletion that was due before using it. If a support record is reasonably required for an unresolved complaint, security incident, legal claim, or statutory obligation, we retain only the information needed for that purpose until it is resolved or the applicable period ends, and then delete or de-identify it. Copies of masked support text, notes and drafts held by the AI assistant's provider are kept as described in section 10(e).
All of the deletion and de-identification described above is carried out in accordance with APP 11.2. More generally, whenever we no longer require your Personal Information for the purpose for which it was collected, we will take reasonable steps to destroy, anonymise, or de-identify it, even outside the specific circumstances described in this section.
Legal acceptance evidence is retained with the associated account for the periods described above. When the account is deleted, the linked evidence is deleted with it; where an account must instead be de-identified to preserve legally required operational or financial records, the evidence no longer carries the person's name or contact details.
These retention rules interact with your Subscription; see our Terms & Conditions for the contractual detail on cancellation, lapse, and closure.
The Australian Privacy Principles and the Privacy Act apply in full to our handling of your Personal Information. In particular:
Where you would like to obtain such access or correction, please contact us in writing using the contact details set out at the bottom of this Privacy Policy. We will respond to your written request within 30 calendar days of receipt. If we require additional time, we will notify you in writing and provide a revised timeline. To verify your identity, we may require email verification or responses to security questions before processing your request.
If the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act) applies to us, then in the event of an eligible data breach that is likely to result in serious harm to any individual whose Personal Information is involved, we will assess the breach promptly upon becoming aware of it and notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable. Our notification will include details of the nature of the breach, the Personal Information involved, the steps we have taken in response, and any recommended protective actions you should consider.
If you have a complaint concerning the manner in which we maintain the privacy of your Personal Information, please contact us using the contact details set out at the bottom of this policy. All complaints will be considered by our Privacy Officer, and we may seek further information from you to clarify your concerns. If we agree that your complaint is well founded, we will, in consultation with you, take appropriate steps to rectify the problem. If you remain dissatisfied with the outcome, you may refer the matter to the OAIC at www.oaic.gov.au.
We use third-party service providers to run the Website and deliver our services. Some are incorporated in the United States of America (US), and some process or store your Personal Information outside Australia. In line with Australian Privacy Principle 8 (APP 8), they are:
(a) Sydney-hosted, US-incorporated vendors (Neon, Vercel, Upstash, Amazon Web Services). Our database (Neon), hosting and file storage (Vercel), and login and request limits (Upstash) are hosted in Sydney, Australia. BrevitLab Alpha, our support system, also uses Neon and Vercel in Sydney, and uses Amazon Web Services in its Sydney region to send, receive and store support email and attachments. Email travels over the public internet, so support email may pass through networks outside Australia on its way to or from us. Each of these vendors is incorporated in the US, so data they hold may be subject to US laws that can compel disclosure (such as the CLOUD Act), wherever the servers are. We name them in the interests of transparency and under APP 8.
(b) US-processed vendor (Resend). Our emails to you are sent through Resend, a US-incorporated company, on servers in the US. Resend processes names, email addresses and the content of those emails, such as booking details and account and plan notices. This is a disclosure of Personal Information to an overseas recipient for the purposes of APP 8.
(c) Global email-routing, edge, and security provider (Cloudflare). Cloudflare, a US-incorporated global network provider, receives email sent to support@brevitybookings.com and passes it on to our support system. The sender and recipient addresses, full message body, attachments, IP addresses and other delivery details may therefore be processed outside Australia. Cloudflare states that account and service metadata may be stored in the US or Europe. Its handling is governed by Cloudflare's terms and privacy materials for our account.
(d) US-processed vendor (Stripe). Payments are processed by Stripe, a US-incorporated company, on servers in the US. This covers Subscription payments and, where an owner takes guest payments, the owner's Stripe account (including Stripe's checks of the owner's identity) and each guest payment, as described in sections 1 and 4. Card details go only to Stripe; we never receive or store them. This is a disclosure of Personal Information to an overseas recipient under APP 8.
(e) US-processed AI assistant service (xAI and Cursor). Our AI support assistant (see section 4) is provided by xAI and Anysphere, Inc. (trading as Cursor), both based in the US, and runs on computers in the US. Cursor chooses which AI models serve the assistant, and that may change over time. We disclose to it the masked text of support messages that are cleared for it, together with the notes and draft replies it writes, and the full text of any email sent directly to one of our assistant addresses, including questions sent through the enquiry form on our website. We never disclose attachments to it. Because masking can miss some personal details, and email sent directly to an assistant address is not masked, this is a disclosure of Personal Information to an overseas recipient for the purposes of APP 8. The provider stores this information as part of providing the service. The provider's published terms do not state how long it keeps this information for this service; we will update this policy when it does. We have set up our account so that, according to the provider, our data is not used to train AI models.
(f) APP 8 compliance, data processing agreements, and third-party terms. Before disclosing your Personal Information to an overseas recipient, we take reasonable steps to ensure that the overseas recipient does not breach the Australian Privacy Principles in relation to that information. Depending on the data and service, those steps may include reviewing the provider's privacy and security practices, limiting what we disclose, controlling access, and agreeing to a Data Processing Agreement where one is available and appropriate. We review these arrangements from time to time and stop or change a disclosure if the safeguards are no longer adequate. Where we are unable to take reasonable steps, we will seek your consent before disclosure, unless an exception under the Privacy Act applies. Your use of the Website is also subject to the applicable terms and conditions of each third-party service provider listed in this clause, including Neon, Vercel, Upstash, Amazon Web Services, Resend, Cloudflare, Stripe, xAI and Cursor (Anysphere, Inc.). We encourage you to review those terms before using the Website. By using the Website, you acknowledge that some of your Personal Information may be transferred to, processed, or stored by the vendors described in this clause, including in the US, in accordance with this clause.
If you have any queries, if you seek access to or correction of your Personal Information, or if you have a complaint about our privacy practices, you can contact us at: support@brevitybookings.com.
We use automated decision-making in a few places. Each one uses personal information.
Our system makes, or does most of the work in making, some decisions that could reasonably be expected to significantly affect your rights or interests. They are:
If you have a question about any of these, contact us under section 11. If you want to raise a concern about how one applied to you, you can complain under section 9.
The AI assistant we use for support (see section 4) does not make decisions about you. It helps our team sort support messages and prepare draft replies, and a person reviews and approves every reply before it is sent to you.
If we start a new kind of automated decision-making that could significantly affect you, we will update this Privacy Policy first to describe it.