Privacy & Security

How RiskyMate handles data, privacy and access

I run RiskyMate and take the handling of your information seriously. Here is who can see your records, where they are kept and what happens when you leave. A real person reviews privacy and access concerns.

Systems we use

Application hosting

RiskyMate is hosted securely online. Public pages and authorised customer portals are separated by account access controls.

Operational database

Account, property, job and activity records are stored in our managed operational database.

Private files

Photos, reports and documents are kept in private storage. Only authorised people can access the records they need.

Sign-in

Production uses RiskyMate's first-party passwordless email sign-in. Short-lived codes go to the authorised email address. Active sessions are checked before protected portal data is returned.

Operational email

Transactional messages (invitations, appointments, job notices and similar) are sent through Resend from RiskyMate's verified sender. Provider acceptance is not the same as inbox delivery.

Stripe

Not in use. No payment details are collected. We'll update this page before any paid plan starts.

Xero

Not connected. Any future connection will be optional and listed here first.

How access works

Joining RiskyMate

You need an invitation or a verified link to an agency, property, tenancy or contractor. Ticking a role on a form is not enough to get access.

What each person sees

An agency, Portfolio Manager, owner, tradie and renter see only the parts of a property or job record relevant to them.

Job-scoped contractor access

Contractors receive the information reasonably required for assigned work, scope, access, appointments and evidence return, not the whole portfolio.

Tenancy-linked renter access

Renters see visits, access and actions that affect their linked home. RiskyMate is not used to build renter reputation scores, blacklists or cross-property suitability ratings.

Who makes decisions

RiskyMate can send reminders and move information to the right person. A person still decides whether to approve costs, arrange repairs or sign off on safety work.

Privacy

Principles

Collect what is needed

Only information reasonably necessary for an authorised property, account, support or compliance workflow should be collected or uploaded.

Only your records

Your login should show the properties, jobs and records you have permission to use, not another customer’s.

Keep private records private

Authenticated access, private evidence storage and authorised document delivery, not public document links.

Give data an end point

When the purpose ends, personal information is reviewed for deletion or de-identification unless a continuing authorised reason applies.

A real person at the other end

When you contact RiskyMate about your account, access, privacy or a problem with the platform, your request can be reviewed by a real person. We do not use AI to make decisions about these matters.

Details

Where your data is stored+

RiskyMate runs on Cloudflare. Property, job and account records are kept in Cloudflare's database service, and documents and photos in private Cloudflare file storage, shown only to signed-in people with access, never through public links. Cloudflare runs worldwide, so information may be processed or stored outside Australia. Sign-in codes and app emails are sent by Resend, which may also process them outside Australia. Fonts are loaded from Google, which receives your IP address. We take reasonable steps to make sure these providers handle personal information in line with the Australian Privacy Principles.

Privacy complaints+

Email adam@riskymate.com. We aim to respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Australian privacy framework+

RiskyMate is designed to follow the Privacy Act 1988 (Cth) and Australian Privacy Principles where they apply, and to use those principles as the baseline for service privacy. Controls are built around data minimisation, purpose limitation, role-based access, security, access and correction, accountable complaint handling and incident response.

Information an authorised workflow may require+

Depending on the workflow, this may include identity and account details, property and authority information, contractor business and verification information, messages, source documents, photos, reports, evidence, audit history and security or diagnostic information. Renter information is only to be used where reasonably necessary for an authorised property, communication, safety or access workflow. RiskyMate is not intended to create renter reputation scores, blacklists, cross-property histories or tenancy-suitability ratings.

Collection and onboarding+

Only information reasonably necessary for an approved purpose should be collected or uploaded. Agency imports should contain the minimum information required for controlled setup. Bank details, identity documents, health information, unnecessary financial information, renter case notes and other sensitive material should not be submitted unless expressly requested for a lawful and necessary workflow.

How information may be used+

Information may be used to authenticate participants, connect authorised people and properties, route approvals and communications, support contractor work, maintain audit history, protect the service and operate the RiskyMate workflow. RiskyMate does not sell personal information.

Automation and human control+

Automated processes may support record organisation, reminders, routing and workflow administration. They do not replace human decision-making, professional judgement, statutory duties or licensed trade work. Deletion, de-identification, legal holds and incident decisions are not treated as unattended automated decisions; they require a defined trigger and accountable review. RiskyMate compliance portals and workflows are AI-free.

Access and disclosure controls+

Access is tied to the active organisation, tenancy, property, relationship or assigned job. Contractors should receive only information reasonably required for assigned work, and renters should receive only the tenancy and property information linked to their active renter access. Approved providers may process information for hosting, authentication, storage, communications, monitoring and professional support. Disabled or future integrations are not treated as permission to disclose production information.

Retention, deletion and recovery+

RiskyMate does not use a single "keep everything forever" rule. Each information category should have a purpose, an accountable owner, a review trigger and an end point. When the active purpose ends, information is assessed for deletion or permanent de-identification unless a continuing authorised, legal, security, dispute or record reason applies. Backup and recovery copies have a separate life cycle from live service data.

Security incidents and data breaches+

Suspected privacy or security incidents are contained, assessed, documented and remediated. Where the Notifiable Data Breaches scheme applies, required assessment and notification steps are taken. Do not send passwords, sign-in codes or secret credentials through a support form.

Access, correction, deletion review and complaints+

A person may request access to or correction of personal information, review an access relationship, request export or account closure, or ask for deletion/de-identification review. Identity and authority may be verified first. A deletion request does not override a lawful or legitimate requirement to retain a record; the request receives human review and the reason for the outcome should be documented.

Cookies, adults and changes+

Essential cookies or similar storage may support authentication, security, preferences and session continuity. RiskyMate is intended for adults. Material policy changes are versioned and published.

Data lifecycle

Collect

Collect only what is reasonably required for the authorised account, property, work or support purpose.

Use

Keep the information attached to the purpose and role that justified collecting it, on the property, job, tenancy or business record that owns it.

Review

When the active purpose changes or ends, review whether the information still supports a property record, legal obligation, security requirement or legitimate participant record right.

Delete or de-identify

Remove personal information or permanently de-identify it when there is no continuing authorised reason to retain it. A documented legal or incident hold can pause that step where required.

Security

Passwordless authentication

Short-lived sign-in codes are delivered to the authorised email address; sessions are checked before protected portal data is returned. Codes are single-use and retained only as keyed hashes.

Role-based access

Agency, Portfolio Manager, landlord or rental provider, contractor and renter workspaces expose the information and actions required for that role. Contractor access is limited to assigned work; renter access is limited to linked tenancy and property records.

Private storage

Application records and documents are kept in protected storage and returned through authorised application routes rather than public file links.

Evidence and audit history

Operational events and completion material stay connected to the relevant property or work record so authorised users can see what happened, when it happened and what still needs review.

Public and private records

Public pages do not display private property records. Demo accounts should not appear in a normal customer portal. Optional integrations do not receive customer information unless they are enabled.

Who is responsible

RiskyMate stores the records and follow-ups. The authorised owner, agent or qualified tradie is still responsible for their decisions.

Terms at a glance

Authorised people only

Access is for authorised adults acting within a property, organisation or job they are authorised to manage.

Human responsibility stays in place

RiskyMate organises the work. It does not replace legal duties, qualified inspections, trade responsibility or professional judgement.

One accountable record

Approvals, access, evidence and history should be recorded against the relevant property workflow rather than treated as authority on their own.

Not an emergency service

Urgent repairs, safety risks and emergencies require prompt human action through the appropriate service or authority.

Full terms

Fees+

Agencies are free until 31 January 2027. Landlords and self-managed rental providers pay $5 per property a month from the start. Any future paid pricing will be confirmed in writing before billing. Tradie, renters and property owners invited by their agency are free. We'll give every agency written notice by 1 December 2026, and at least 60 days' written notice of any later price change. Full details are on the pricing page.

Cancellation+

There is no lock-in contract. You can cancel at any time by emailing adam@riskymate.com or by asking through Help in your account. There are no cancellation fees. Paid plans end at the end of the month you cancel, and unused whole months on an annual plan are refunded. When you cancel, your data is handled as set out in the privacy section above. After you leave, you keep read-only access for 60 days to export your data.

Changes+

We'll give at least 30 days' notice of material changes.

Eligibility and authority+

Any invited participant must be at least 18, provide accurate information and use RiskyMate only for lawful property workflows they are authorised to manage. Organisation participants must have authority to act for that organisation.

What RiskyMate is for+

RiskyMate organises property records, workflow dates, approvals, contractor coordination, evidence and history. It does not provide legal advice, certify compliance, replace qualified inspections or remove the responsibilities of landlords or rental providers, Portfolio Managers, contractors or other participants.

Accounts and role access+

Authorised users must keep access secure and use only organisations, properties, jobs and files made available to their role. Private links and access controls must not be bypassed or shared. Landlords / Rental providers and Portfolio Managers remain responsible for authority, notices, approvals and management decisions. Contractors remain responsible for licensing, insurance, safety and workmanship.

Data and privacy+

A participant must have authority and an appropriate basis to provide information used in a workflow and should provide only information reasonably necessary for that purpose. Privacy handling is described in the Privacy section. Suspected unauthorised access, lost devices, misdirected information or security incidents should be reported promptly.

Work, access and urgent matters+

A recorded approval does not create authority the decision-maker does not otherwise hold. Scope, spending limits, entry arrangements and current requirements must be checked by the responsible participant before work proceeds. Potential urgent repairs require prompt human attention. RiskyMate is not an emergency service.

Contractor work and third-party tools+

Contractors may use job information only for assigned work and remain responsible for their own licensing, insurance, safety, workmanship and lawful handling of information. Personal, renter, access, evidence or confidential information must not be placed into unauthorised messaging, storage or other services.

Access, suspension and records+

We'll give notice before restricting access unless it's urgent to protect people or data. Account closure, export and deletion review remain subject to lawful retention and other participants' legitimate record rights.

Australian consumer rights+

Nothing in these terms excludes rights or remedies that cannot lawfully be excluded, including applicable Australian Consumer Law rights. Limitations apply only to the extent permitted by law.

Company and governing law+

Company details and ACN are set in registration status. These terms are governed by the laws of Victoria, Australia.