Privacy Policy

1. About EnBright and this policy

This Privacy Policy explains how EnBright Capital Pty Ltd (ACN 685 093 805, ABN 98 685 093 805) (“EnBright”, “we”, “us”, “our”) collects, holds, uses and discloses personal information through the EnBright Collect mobile application (“EnBright Collect” or “the App”) and the EnBright Collect website, in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and other applicable laws.

EnBright Collect is a professional data capture and workflow tool for Nationwide House Energy Rating Scheme (NatHERS) assessments of existing Australian homes, used by accredited NatHERS assessors and authorised data collectors. It captures property data, photographs, video and evidence to support NatHERS energy ratings, and operates under the NatHERS scheme’s accreditation terms and CSIRO’s terms for the AccuRate Enterprise rating engine, which impose additional obligations on how assessment information is collected, retained and shared.

In this policy, “personal information” has the meaning given in the Privacy Act.

2. Who this policy applies to

This policy applies to three categories of individuals whose information we may handle:

• Assessors and data collectors (“Platform Users”). Accredited NatHERS assessors and authorised data collectors (a role subject to NatHERS pathway requirements) who use the App to capture property assessment data. Platform Users are our direct customers.
• Property owners, tenants and occupants (“Property Subjects”). Individuals whose homes are being assessed. Consent is captured before assessment data collection begins, as required by clauses 2.1 to 2.3 of the NatHERS Technical Note for existing homes.
• Website visitors. Individuals who visit the EnBright Collect website or marketing pages.

If you are a Property Subject, the assessor who visits your property collects your information using EnBright Collect on our systems. This policy describes how that information is handled once it is captured.

3. Information we collect

3.1 Platform User information

• Account details: name, email address, phone number, NatHERS accreditation details (accrediting organisation and member number), business name, ABN and business address, and a photograph of the accreditation card.
• Authentication information: sign-in credentials and, where enabled, multi-factor authentication codes.
• Assessment activity: properties assessed, assessment dates, time spent and submission quality scores.
• Device information: device model, operating system version, App version and a randomly generated device identifier.
• Subscription and payment information, processed by our payment provider (section 9).

3.2 Property assessment information

During an assessment, the App captures the following information about the property:

• Property address, year of construction, climate zone and property type.
• Building characteristics: wall construction, floor coverings, window and glazing types, ceiling fixtures, insulation, heating, cooling and hot water equipment, solar PV and other construction details.
• Building geometry and floor plans, including room dimensions, wall positions and window and door locations captured by LiDAR 3D scanning on supported devices.
• Equipment details: brand, model, capacity and efficiency information, including data extracted from appliance nameplates using on-device text recognition.
• Free-text field notes recorded by the assessor, which may incidentally include identifying details.

This information describes the property rather than a person, but combined with the address it relates to an identifiable household, and we protect it accordingly.

3.3 Consent and identification information

• Property owner and tenant names, contact details, signatory role and digital signatures, captured on the prescribed NatHERS Client Information and Consent Form.
• A conflict of interest acknowledgement.
• The optional data use consent choices described in section 7, where offered and given.

3.4 Photographs, video and embedded metadata

• Assessors capture photographs and video of building elements: exterior facades, room interiors, equipment nameplates, roof spaces and supporting documents such as invoices. Videos are recorded without audio.
• Photographs include embedded metadata (EXIF), including GPS coordinates, timestamp, capture direction and device details. We collect and retain this metadata as part of the evidence record. This is how the App meets the photo metadata and geolocation requirements in Table 1 of the NatHERS Technical Note for existing homes, and how we verify that evidence was captured at the assessed property.
• Capture is directed at the building, but photographs and video may inadvertently include personal information such as the faces of occupants, personal documents, mail or family photographs. Assessors are required to minimise such capture. Access to evidence is restricted as described in section 10, and a Property Subject may ask us to review and restrict a specific image (section 14).

3.5 Location information

• As described in section 3.4, evidence photographs carry embedded GPS coordinates that form part of the assessment record and are transmitted to and stored on our systems with the evidence they belong to.
• The App also reads the device’s heading and location briefly, on the device, to correct compass bearings to true north during capture. That reading is processed on the device and is not stored or transmitted separately from the photograph metadata described above.

3.6 Voice dictation

Assessors may dictate field notes using on-device speech recognition. Speech is transcribed on the device. No audio recording is created, stored or transmitted.

3.7 Technical information and diagnostics

A diagnostic log is kept on the device to assist with troubleshooting. It is not transmitted automatically. The current release of the App does not include third party analytics, advertising or crash reporting services.

3.8 Website visitors

When you visit the EnBright Collect website we collect usage information through cookies and similar technologies, including through Google Analytics, together with standard server information such as IP address and browser type. If you contact us through the website we collect the details you provide, such as your name and email address.

4. How we collect information

We collect personal information:

• from Platform Users directly, when they create and operate their account;
• from Property Subjects through the assessor during the assessment, including through the in-app consent form, a secure pre-visit consent link sent before the visit, or a paper consent form recorded in the App;
• from publicly available and government sources used to prepare an assessment, such as property databases, climate zone registries and the GEMS appliance efficiency register, which we use to pre-fill property and equipment details; and
• from website visitors through the website as described in section 3.8.

Where it is lawful and practicable, you may deal with us anonymously or under a pseudonym, for example when making a general enquiry. Anonymity is not practicable for an assessment itself, because NatHERS certification and the prescribed consent form require the identity of the parties.

5. Why we collect, hold, use and disclose information

Platform User information:

• to provide and operate the App and associated services;
• to verify identity and accreditation and to secure accounts;
• to manage subscriptions and accounts;
• to provide customer support and communicate service and product updates; and
• to generate aggregated, de-identified analytics about platform usage.

Property assessment information:

• to conduct the assessment and produce NatHERS ratings and certificates through CSIRO’s AccuRate Enterprise system;
• to apply scheme default values and calculate the submission quality score;
• to obtain, record and act on the consents the NatHERS scheme requires;
• to verify that assessment evidence is genuine, including confirming that photographs were captured at the assessed property;
• to store evidence for audit compliance, including the seven year retention required under clause 3.8 of the NatHERS Technical Note for existing homes;
• to maintain audit trails and meet our quality assurance and audit obligations under the NatHERS scheme and at law; and
• for the research and product improvement purposes described in section 7, where the relevant consent has been given.

We also use personal information to respond to enquiries, complaints and requests to access or correct information, and to comply with our legal obligations.

We do not use personal information for advertising. We do not track users across other applications or websites. We do not sell, rent or trade personal information or assessment data.

6. Consent for the assessment, and how to withdraw it

An assessment cannot proceed to certification without a signed consent on the prescribed NatHERS Client Information and Consent Form. The App enforces this: submission is blocked until consent has been captured and, where a tenant occupies the property, tenant consent has not been refused.

By signing the consent form, the client and any tenant consent to their information being used to produce the assessment and certificate, and to the downstream sharing that certification requires. In particular, assessment information is processed through CSIRO’s AccuRate Enterprise system, and CSIRO may share assessment data and the resulting certificate or rating report with the NatHERS Administrator and the relevant Assessor Accrediting Organisation for quality assurance, investigation and audit purposes. CSIRO’s own privacy collection notice applies to information held in its systems.

Consent can be withdrawn by contacting us using the details in section 16. We will record the withdrawal, stop further processing that depends on the withdrawn consent, and explain any limits on what can be unwound, for example where an assessment has already been submitted for certification and records have been provided to CSIRO or the NatHERS Administrator. Withdrawal does not affect the validity of a NatHERS assessment already issued.

7. Data use, research and de-identified information

Data is central to what EnBright does, and this section explains exactly how assessment data may be used beyond the individual assessment.

The optional data use consent. Separately from the consent required for the assessment, the App may offer property owners and tenants an optional data use consent. This offer:

• is voluntary, is never pre-selected, and declining it has no effect on the assessment;
• is granular, and each purpose can be withdrawn at any time; and
• is confirmed by a receipt sent to the email address provided.

The purposes currently offered are:

• Improving our assessment tools, including the software models that help recognise building elements in photographs, using de-identified data;
• Housing resilience and energy performance research, using de-identified data;
• Performance benchmarking across assessments, using de-identified data; and
• Tailored home upgrade recommendations for the property owner, which uses their identified assessment data for their own benefit.

What de-identification means. Before assessment data is used for research, benchmarking or model improvement, the property address and the identity of the owner, tenant and occupants are removed so that the data no longer relates to an identifiable individual. We do not attempt to re-identify de-identified data, and we require the same of anyone we work with.

Model training safeguards.Where classification selections are used to improve our recognition models, only selections the assessor personally made and confirmed as an on-site observation are eligible. Subjective fields, such as wall colour or window covering fit, and any selection marked “not sure” are never used for training.

Third parties.We do not share assessment data with lenders, valuers or any other commercial third party. If we offer such sharing in future, it will occur only with the individual’s separate express consent given at the time, naming the recipient and purpose, and this policy will be updated first.

8. Disclosure of information

We disclose personal and assessment information only as follows:

• CSIRO (AccuRate Enterprise):assessment information is submitted to CSIRO’s AccuRate Enterprise system to calculate the rating and produce the certificate.
• The NatHERS Administrator and Assessor Accrediting Organisations: these bodies receive assessment information and certificates through the certification, quality assurance and audit chain described in section 6.
• Between data collector and assessor: when a data collector submits an assessment, the evidence package is shared with the assessor who commissioned it. Both parties are bound by NatHERS accreditation obligations.
• Reference lookups:equipment brand and model details may be checked against the GEMS (Greenhouse and Energy Minimum Standards) registry, and construction parameters against CSIRO’s material library, for efficiency and material lookups. These lookups contain product and property parameters only and do not include personal information.
• Service providers: trusted providers that host and process data on our behalf under contract, including Amazon Web Services for application hosting, databases, evidence storage and email delivery, Stripe for billing of business customers, and the website providers named in section 9. These providers act on our instructions.
• Legal requirements: where required or authorised by Australian law, regulation or court order, and to professional advisers and regulators where necessary.

We do not sell, rent or trade personal information or assessment data to third parties.

9. Overseas disclosure and international transfers

App and assessment data is stored in Australia. The App’s backend systems, databases and evidence storage operate in Amazon Web Services’ Sydney region, and our cloud configuration prevents those systems from operating outside that region. CSIRO has stated that AccuRate Enterprise data is stored on Microsoft Azure infrastructure in Australia. On-device recognition (text recognition, object detection and room detection) runs on the device; property photographs are not sent to external AI services for analysis.

Some supporting services involve overseas processing:

• Website hosting and content delivery:the EnBright Collect website runs on Cloudflare’s globally distributed network, which means website visitor information may be processed in multiple countries, including the United States, the European Union and Singapore.
• Website email: website contact emails are delivered through Resend, which processes data in the United States.
• Website analytics: Google Analytics may process website usage data on servers outside Australia, including in the United States.
• Billing: Stripe, a global payment processor, may process billing contact and payment details outside Australia under its own compliance obligations, including PCI-DSS.

We take reasonable steps, as required by APP 8, to ensure overseas recipients handle personal information consistently with the APPs.

10. Security and storage

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure, including:

• Encryption in transit: all data is encrypted in transit using TLS.
• Local-first storage with device encryption: assessment data is stored locally on the device in an encrypted database and synced to our servers when connected. The App will not operate with an unencrypted assessment store. Sign-in tokens are held in the operating system’s secure storage (iOS Keychain, Android Keystore).
• Account security: support for multi-factor authentication and automatic sign-out after 30 minutes of inactivity.
• Evidence integrity: evidence records are held in write-once storage that prevents alteration or deletion during the retention period, protecting the integrity of assessment evidence, with server-side encryption.
• Access controls: role-based access on a need-to-know basis. Assessment data is accessible to the assessing assessor, any data collector they commissioned, and the EnBright staff who need it to operate and support the service.
• On-device processing: recognition of building elements, nameplate text and room geometry runs on the device.

No security measure is absolute. Section 15 describes what we do if a data breach occurs.

11. Data retention

We retain data according to the following schedule:

The App displays the retention window that applies to each assessment. When retention periods expire, an automated process destroys expired records and permanently de-identifies surviving certificate data. Evidence held in write-once storage is put permanently beyond use by destroying the encryption keys that protect it, which renders it permanently unreadable.

12. Direct marketing

We do not use assessment data or Property Subject information for direct marketing. Platform Users may receive service and product communications relating to their account and can opt out of non-essential communications at any time.

13. Rights of Property Subjects

If your property has been assessed using EnBright Collect:

• your consent was captured before assessment data collection began, per clauses 2.1 to 2.3 of the NatHERS Technical Note for existing homes;
• you may request access to the assessment data held about your property, and correction of inaccurate data, by contacting us;
• you may withdraw the assessment consent as described in section 6, and any data use consent purpose as described in section 7, at any time, and withdrawal does not affect the validity of a NatHERS assessment already issued; and
• you may ask us to review and restrict access to a photograph or video that captures your personal information.

14. Access, correction and deletion

You may request access to, or correction of, the personal information we hold about you. Platform Users and Property Subjects can start a request from the “Manage my data” screen in the App, or by contacting us using the details in section 16. Platform Users may also access, correct or delete their account information at any time and may request an export of their assessment data in a structured format. We will verify your identity before acting on a request.

We aim to respond substantively within 30 days. A complete response covers information held in our own systems and, where applicable, an explanation of information held by CSIRO or the NatHERS Administrator through the certification chain, part of which may need to be directed to those bodies. If we refuse access or correction in the limited circumstances the Privacy Act allows, we will give you written reasons and the complaint mechanisms available to you.

Some information cannot be deleted on request during its retention period, because the NatHERS scheme and our record-keeping obligations require us to retain it. Where that applies we will tell you, and we will restrict further use of the information where we can.

15. Data breaches

We maintain a data breach response plan. If a data breach involving personal information is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. As an accredited NatHERS provider we also notify the NatHERS Administrator and the Australian Cyber Security Centre of cyber incidents affecting our systems within 24 hours.

16. Complaints and contact

If you have a question, or believe we have not handled your personal information in accordance with this policy or the APPs, contact our Privacy Officer:

We will acknowledge your complaint, investigate it and respond within 30 days. If you are not satisfied with our response, you may raise the matter with the NatHERS Administrator, or lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992.

17. Children

EnBright Collect is a professional tool for accredited assessors and is not directed at, or intended for use by, children.

18. Changes to this policy

We may update this policy from time to time. The current version, with its effective date, will always be available at the published policy address and from within the App. Material changes will be communicated by in-app notification and email to registered users at least 14 days before taking effect.