Privacy Policy

1. Who we are

OpenXpress is operated by VIBECODEIT PTY LTD (ABN 40 696 049 626), an Australian proprietary limited company trading as OpenXpress(“OpenXpress”, “we”, “us”, “our”). We are the entity responsible for handling personal information collected through the OpenXpress platform at openxpress.app and related services (the “Platform”).

We comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Spam Act 2003 (Cth), and the Notifiable Data Breaches scheme.

2. Definitions

• Buyer — a person attending or interested in an open home who completes a survey through the Platform.
• Agent — a real estate professional who holds an OpenXpress account and runs open-home surveys for properties they are authorised to market.
• Affiliated Partner — a real estate agent, mortgage broker, conveyancer, building inspector, or property-services provider that has entered into a written agreement with OpenXpress.
• Personal Information — has the meaning given by the Privacy Act 1988 (Cth): information or an opinion about an identified individual, or one who is reasonably identifiable.
• De-identified Data — information that has been altered so an individual is no longer reasonably identifiable, including by aggregation with other records.
• Vendor — a property owner who engages OpenXpress (directly or via an Affiliated Partner) for a marketing campaign.

3. Information we collect

3.1 From Buyers

• First name, last name (optional), email address, phone number (optional)
• Price opinion for the property and seriousness rating
• Buying timeline and finance status
• Property features you liked and free-text comments
• If you choose to make an offer: offer amount, buyer type, finance approval status, and offer conditions
• Communication preferences (which categories of email you opt in to)
• The open-home address and date you attended (collected via the survey link)

3.2 From Agents

• Full name, email address, phone number, agency name
• Account credentials (password is hashed; we never see it in plain text)
• Property addresses, listing details, open-home dates, and survey configurations you create
• Reports, AI summaries, and follow-up notes you generate or store on the Platform
• Billing information if you purchase paid products from us (handled by our payment processor; we never store full card numbers)

3.3 Collected automatically

• IP address, device type, browser, operating system, referring URL
• Pages viewed, features used, timestamps, and session duration
• Authentication cookies and session tokens (essential)
• Aggregated analytics (page-load metrics, feature uptake)

4. How we use information

We use Personal Information for the following purposes (APP 6):

• Operating the Platform — authentication, surveys, dashboards, reports, AI summaries, email delivery, and customer support.
• Sharing buyer responses with the conducting agent — the agent who created the open home receives the buyer's full survey response, including any contact details and comments the buyer provided.
• Communicating with you — transactional emails (e.g. account confirmations, post-event reports, reminders) and, where you have opted in, direct marketing.
• Building de-identified market insights — see section 6.
• Operating Vendor Campaigns and lead-referral products — see section 7.
• Improving the Platform — debugging, analytics, fraud prevention, and product development.
• Complying with the law — tax, accounting, regulatory, and lawful requests from authorities.

5. For Buyers — what happens to your survey data

You can complete an OpenXpress survey without providing your name, email, or phone number — only your price opinion and seriousness are required. If you choose to provide contact details, the following applies:

5.1 Who sees your response

• The agent conducting the open home receives your full response.
• OpenXpress staff may access your response for support, fraud-prevention, and compliance purposes.
• No one else receives your individually-identifiable response unless you opt in (see 5.3) or we are legally required to disclose it.

5.2 Communications you will receive by default

• If you provided your email and asked the agent for a follow-up, the agent may contact you directly outside the Platform — that contact is governed by the agent's own privacy practices.
• OpenXpress will not send you marketing email unless you opt in (5.3).
• OpenXpress may send you transactional email related to actions you take on the Platform (e.g. an offer confirmation if you submitted an offer).

5.3 Optional marketing opt-in

On the survey you can choose to receive property opportunities from OpenXpress and our Affiliated Partners. If you opt in, you consent to OpenXpress sending you (or arranging for our Affiliated Partners to send you, on our behalf) communications such as:

• New listings matching your suburb, price range, or stated preferences
• Off-market and pre-market property opportunities
• Vendor Campaign properties (homes whose owners have engaged us to reach buyers like you — see section 7)
• Property-services partner offers (e.g. mortgage brokers, conveyancers, building inspectors)
• Buyer-focused market reports and educational content

You can withdraw this consent at any time. Every marketing email contains a one-click unsubscribe link, or you can manage preferences at openxpress.app/unsubscribe.

5.4 How your data is shared

OpenXpress does not sell or rent your personal information as a dataset to third parties. However, if you opt in to property opportunities (section 5.3), we will actively use your contact details to send you marketing communications and may introduce you to Affiliated Partners when you express interest in a specific property or opportunity. See section 7 for full details on Vendor Campaigns and lead-referral products.

5.5 Your rights

• Access — request a copy of the personal information we hold about you.
• Correct — ask us to fix inaccurate or out-of-date details.
• Delete — ask us to delete your survey responses and contact details. We will action this within 30 days, except where retention is legally required.
• Withdraw consent — at any time, with no impact on the lawfulness of prior processing.
• Complain — see section 16 below.

To exercise any of these rights, email josh@jblventures.com.au with the subject line “Privacy Request” and the email address you used on the survey.

6. Aggregated and de-identified data

OpenXpress aggregates and de-identifies survey data to produce insights about the health, trends, and behaviour of the Australian property market. This is a primary purpose of the Platform and you are notified of it at the point of collection.

6.1 What we publish or share

• Average and median price opinion by suburb, postcode, region, state, or country
• Buyer sentiment (seriousness ratings, finance readiness, timelines) by area
• Most-loved property features by area or property type
• Open-home attendance and engagement metrics
• Trend reports comparing periods (week-on-week, month-on-month, year-on-year)

6.2 What is never included

Aggregated and de-identified outputs published or shared by OpenXpress never include a buyer's name, email address, phone number, free-text comments, individual offer amount, or any other field that could reasonably re-identify a person. Aggregations are produced at a granularity that prevents re-identification (e.g. minimum sample sizes per suburb).

6.3 Who we share aggregated data with

We may share aggregated, de-identified insights with Affiliated Partners, vendors, media, researchers, government bodies, and the general public. Aggregated data, by definition, is no longer Personal Information under the Privacy Act and may be used without further consent.

7. Vendor Campaigns & lead-referral products

OpenXpress offers paid products to property owners (Vendors) and Affiliated Partner agents that draw on the buyer audience built through the Platform. These products include:

• Vendor Campaigns — a Vendor may pay OpenXpress to email a property opportunity to opted-in buyers in a relevant area. The Vendor never receives buyer contact details from us; only buyers who reply to the campaign or request more information establish a direct connection.
• Warm-lead referrals — when a buyer expresses interest in a campaign property or a particular suburb, OpenXpress may introduce that buyer to an Affiliated Partner agent. We disclose the buyer's contact details only after the buyer has expressed interest in being introduced.

These uses are covered by your opt-in under section 5.3. You can opt out at any time via the unsubscribe link in any marketing email or at /unsubscribe.

8. For Agents — your data and your obligations

When you create an OpenXpress account, you provide personal information that we use to operate your account, deliver service emails (e.g. event reminders, post-event reports, weekly digests if you have not unsubscribed), and contact you about the Platform.

You also become a recipient of buyer Personal Information through the dashboard for surveys you have created. You are responsible for handling that information in accordance with the Privacy Act 1988 (Cth), the Spam Act 2003 (Cth), and any applicable real estate industry codes.

By using OpenXpress, you acknowledge and agree that:

• Buyer responses you receive may only be used to follow up on the relevant property and the buyer's stated interests.
• You may not on-sell, share with other agencies, or import into a third-party CRM in a way that breaches the buyer's reasonable expectations or consent.
• Where a buyer has opted in to OpenXpress marketing, OpenXpress (and not you) holds the marketing relationship with that buyer and may communicate with them about properties — including properties listed by other agents.
• Aggregated, de-identified data derived from surveys you create remains the property of OpenXpress and may be used as described in section 6.

9. Disclosure of personal information

We disclose Personal Information to:

• Conducting agents — buyers' survey responses are visible to the agent who created the open home (see section 5.1).
• Affiliated Partners — only where you have opted in, and only at the point you engage with a specific opportunity (see section 7).
• Service providers — Supabase (database hosting, US/EU regions), Resend (email delivery, US), Vercel (web hosting, US/EU/AU regions), Mapbox (address autocomplete), and OpenAI (AI summary generation; before any text is sent we automatically remove email addresses, phone numbers, URLs, social-media handles, and street addresses from buyer comments, and we generalise the property address to suburb-level only — OpenAI never receives raw contact details, the full street address, or content that could reasonably re-identify an individual buyer).
• Authorities — where required or authorised by law, court order, or to protect our rights or the safety of others.
• Successors — in the event of a merger, acquisition, restructure, or insolvency, Personal Information may be transferred to the successor entity, subject to this Policy continuing to apply.

10. Cross-border data transfers

Some of our service providers store or process data outside Australia (primarily in the United States and European Union). Where this occurs, we take reasonable steps to ensure the recipient handles the information in a manner consistent with the APPs, including through contractual arrangements such as Data Processing Addenda and Standard Contractual Clauses.

11. Data security

We implement industry-standard security controls including TLS encryption in transit, encryption at rest, role-based access controls, row-level security in our database, hashed passwords, audit logging, and least-privilege service accounts. No online service can be guaranteed 100% secure; you use the Platform at your own risk.

12. Data retention

• Buyer survey responses (with PII) — retained for up to 36 months from collection or until you request deletion, whichever is sooner.
• Aggregated, de-identified data — retained indefinitely (it is no longer Personal Information).
• Agent account data — retained while the account is active and for up to 24 months after closure for billing, audit, and dispute-resolution purposes.
• Email logs and unsubscribe records — retained for at least 5 years to demonstrate Spam Act compliance.

13. Direct marketing & the Spam Act

We will only send you marketing communications where you have given us consent (express or, in limited cases, inferred from an existing customer relationship). Every marketing email identifies us as the sender and contains a functional unsubscribe link. We process unsubscribe requests within 5 business days, but in practice they take effect immediately. You can also unsubscribe at any time via /unsubscribe.

14. Cookies, analytics, tracking

We use essential cookies for authentication and session management, and a small number of analytics cookies to understand Platform usage. We do not use advertising or cross-site tracking cookies. You can disable non-essential cookies through your browser; this may impair some functionality.

15. Notifiable Data Breaches

If we become aware of an eligible data breach (one likely to result in serious harm to one or more individuals), we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable, in accordance with Part IIIC of the Privacy Act 1988 (Cth).

16. Complaints

If you believe we have breached the APPs or mishandled your Personal Information, please email josh@jblventures.com.au with the subject “Privacy Complaint”. We will acknowledge within 5 business days and respond substantively within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

17. Children

The Platform is intended for adults (18+) attending property open homes or working as licensed real estate professionals. We do not knowingly collect Personal Information from anyone under 18. If you become aware that a minor has provided information, please contact us and we will delete it.

18. Changes to this Policy

We may update this Policy from time to time. The “Last updated” date at the top of this page reflects the most recent version. For material changes that affect how we use your Personal Information, we will provide reasonable advance notice (e.g. via email or an in-Platform banner) before the change takes effect.

19. Contact

Privacy Officer
VIBECODEIT PTY LTD t/a OpenXpress
ABN 40 696 049 626
Email: josh@jblventures.com.au