Privacy Policy

1. Introduction

Solar and Battery Leads (“we”, “us”, or “our”) is operated by [Entity Name], ABN [ABN Placeholder], based in Victoria, Australia.

We are committed to protecting the privacy of everyone who interacts with our Platform — including homeowners and property owners who submit enquiries (“Homeowners”) and the solar and battery installation businesses that purchase those enquiries (“Buyers”).

This Privacy Policy explains what personal information we collect, why we collect it, how we use and disclose it, how we protect it, and what rights you have. It applies to our website at solarandbatteryleads.com and all associated services.

This Policy should be read alongside our Terms of Service and Cookie Notice.

2. What Personal Information We Collect

2.1 Buyer / Account Data

When you register as a Buyer or manage your account, we collect:

• Full name and job title
• Business name, ABN, and business address
• Email address and phone number
• Payment information — payment transactions are processed by Stripe. We do not store raw card numbers, CVV codes, or full PAN data on our servers. Stripe provides us with a tokenised reference and limited metadata (e.g. card type, last four digits, expiry).
• Account preferences and activity logs

2.2 Homeowner / Lead Data

When a Homeowner submits an enquiry through one of our lead intake forms, we collect:

• Full name
• Phone number
• Email address
• Property address or postcode
• Project details (e.g. type of system, roof type, energy usage)
• Free-text notes provided in the enquiry form
• Date and time of submission

This information is held by us until the Lead is either purchased by a Buyer or purged in accordance with our data retention schedule (see Section 8).

2.3 Usage and Technical Data

When you use our Platform, we automatically collect certain technical data, including:

• IP address
• Browser type and version
• Operating system
• Pages visited and features used
• Time and date of access
• Referring URL
• Server access logs

2.4 Cookies and Local Storage

We use essential cookies and browser storage for authentication and session management. For full details, see our Cookie Notice.

3. Why We Collect Personal Information and Lawful Basis

We collect and use personal information for the following purposes:

• Account management and service delivery — to create and manage Buyer accounts, process payments, and provide access to the Platform. Legal basis: performance of a contract.
• Payment processing — to process credit purchases and maintain payment records. Legal basis: performance of a contract.
• Lead marketplace operation — to store Homeowner enquiry data, match it with relevant Leads, and facilitate its disclosure to purchasing Buyers. Legal basis: legitimate interests (facilitating the marketplace) / contract.
• Legal and regulatory compliance — to meet our obligations under Australian law, including tax record-keeping, responding to lawful requests, and enforcing our Terms. Legal basis: legal obligation.
• Platform improvement and analytics — to understand how the Platform is used, identify bugs or usability issues, and improve the service. Legal basis: legitimate interests.
• Security and fraud prevention — to detect, investigate, and prevent fraudulent, abusive, or unlawful activity on the Platform. Legal basis: legitimate interests / legal obligation.
• Communications — to send you transactional emails (e.g. purchase confirmations, account notices) and, where you have consented, product updates. Legal basis: legitimate interests / consent.

4. Who We Disclose Personal Information To

4.1 Buyers Who Purchase a Lead

When a Buyer purchases a Lead, the Homeowner's contact details are disclosed to that Buyer. At that point, the Buyer becomes an independent data controller for the disclosed data and is independently responsible for complying with the Privacy Act 1988 (Cth), the Australian Privacy Principles, and all other applicable laws in respect of that data.

We are not responsible for how Buyers use or manage Homeowner data after disclosure, although we do impose contractual obligations on Buyers regarding permitted use (see our Terms of Service).

4.2 Sub-processors and Service Providers

We engage the following sub-processors to help deliver the Platform. Each is bound by contractual data protection obligations:

• Supabase — database hosting and backend infrastructure (USA / EU). Our primary data store.
• Stripe — payment processing (USA). Handles all card data under PCI-DSS compliance.
• Resend — transactional email delivery (USA). Used to send account and purchase notifications.
• Twilio — SMS notifications (USA). Used to send optional lead alerts.
• GoHighLevel — CRM delivery when the CRM integration feature is enabled (USA). Homeowner contact details may be pushed to GoHighLevel on behalf of a Buyer who has enabled this feature.
• Anthropic (Claude AI) — AI-powered note cleanup and summarisation of Homeowner enquiry notes (USA). Note content may be transmitted to Anthropic's API for processing. We do not send identifying contact details (name, phone, email) to this service.

4.3 Law Enforcement and Legal Requirements

We may disclose personal information to government authorities, regulators, or law enforcement agencies where required by law, court order, or to protect the rights, property, or safety of Solar and Battery Leads, our users, or the public.

4.4 Business Transfers

If we are involved in a merger, acquisition, asset sale, or other business restructure, personal information we hold may be transferred to a successor entity. We will take reasonable steps to ensure any successor is bound by equivalent privacy obligations.

5. Australian Privacy Principles (APPs)

We are committed to complying with the Australian Privacy Principles contained in Schedule 1 to the Privacy Act 1988 (Cth). In summary:

• Collection (APP 3, 4) — We collect personal information only by fair and lawful means, and only where it is reasonably necessary for our functions.
• Use and disclosure (APP 6) — We use and disclose personal information only for the primary purpose for which it was collected, or for directly related secondary purposes, or where you have consented.
• Data quality (APP 10) — We take reasonable steps to ensure personal information we hold is accurate, complete, and up to date.
• Security (APP 11) — We protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure.
• Access and correction (APP 12, 13) — You have the right to access personal information we hold about you and to request corrections. See Section 7 for how to exercise these rights.

6. Cross-Border Disclosure

Some of our sub-processors (listed in Section 4.2) are located outside Australia, primarily in the United States and the European Union. By using the Platform, you acknowledge that your personal information may be transferred to and processed in these countries.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient will handle the information in a manner consistent with the Australian Privacy Principles (APP 8). Our sub-processors are typically covered by binding contractual data protection obligations and, where applicable, recognised certification schemes (e.g. EU-US Data Privacy Framework for US-based processors).

GDPR Note: If you are accessing the Platform from within the European Economic Area (EEA), you may have additional rights under the EU General Data Protection Regulation (GDPR), including the right to object to processing based on legitimate interests, the right to data portability, and the right to lodge a complaint with a supervisory authority. For EEA-specific enquiries, please contact us at [Contact Email].

7. Your Privacy Rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you (APP 12).
• Correct personal information that is inaccurate, out of date, incomplete, or misleading (APP 13).
• Delete your personal information, subject to legal obligations that require us to retain certain records (e.g. tax and financial records).
• Complain about a breach of the APPs to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

To exercise any of these rights, please contact us at [Contact Email] with the subject line “Privacy Enquiry”. We will respond within a reasonable timeframe (generally 30 days). We may need to verify your identity before processing a request.

8. Data Retention

We retain personal information only for as long as necessary. Our retention schedule is as follows:

• Buyer account data — retained while your account is active, plus 7 years after account closure for tax and legal compliance purposes.
• Homeowner lead data (unsold) — Leads that have not been purchased are purged after [Retention Placeholder] days from the date of submission.
• Homeowner lead data (purchased) — Leads that have been purchased are retained in the purchasing Buyer's account indefinitely to support their ongoing access.
• Server access logs — retained for 90 days, then deleted.
• Payment and transaction records — retained for 7 years as required by Australian tax law.

When data is no longer required, we delete or anonymise it securely.

9. Security

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration, or disclosure. These measures include:

• Encryption of data in transit using TLS (HTTPS).
• Encryption of data at rest using AES-256 encryption.
• Role-based access controls limiting which team members can access personal data, on a need-to-know basis.
• Row-level security policies in our database layer.
• Regular internal security reviews.

No method of transmission over the internet or electronic storage is completely secure. While we take these obligations seriously, we cannot guarantee absolute security.

If you become aware of any security vulnerability or breach involving the Platform, please report it immediately to [Contact Email].

10. Children

The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have inadvertently collected such information, we will take steps to delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other reasons. When we update this Policy, we will revise the “Effective date” at the top of this page.

Where changes are material, we will notify registered Buyers by email. Your continued use of the Platform after any changes to this Policy constitutes your acceptance of the updated terms.

12. Contact and Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or how we handle your personal information, please contact our Privacy Officer:

• Email: [Contact Email] (subject: “Privacy Enquiry”)
• Website: solarandbatteryleads.com

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992

See also: Terms of Service · Cookie Notice