Vallotta
Privacy

How we handle your details.

Last updated 12 June 2026 · Consent version V4

Vallotta is a property intelligence service for the Northern Beaches local government area in New South Wales. This policy explains what we collect when you request a report, why we collect it, and what we do with it. It is written to comply with the Australian Privacy Act 1988 (Cth) as amended by the Privacy and Other Legislation Amendment Act 2024.

What we collect

  • Your email address — you give it to us when you ask for a report.
  • The property the report was generated for, including its street address and lot or DP identifier.
  • The intelligence payload and the narrative our system generates for that property, held as a cached report tied to your email.
  • Server log data: your IP address, your browser user-agent, and the time of the request. Your IP is also used as the key for a short-window per-IP rate limit on the request form, so a single client cannot flood the service.

Vallotta is intended for adults (16+). If you are under 16 and have submitted your email by mistake, write to privacy@vallotta.com.au and we will delete it on confirmation.

Why we collect it

We use your email to deliver the report you asked for. With the specific consent you record at the form, we may also contact you about:

  1. Vallotta product updates,
  2. an offer to acquire your property, and
  3. related property services.

These three categories are the only purposes you have consented to. We do not contact you about anything else and we do not pass your email to any third party for their own marketing.

The property and report data are kept so that we can serve a cached copy if you return, and so we can improve our regulatory caveat library when the underlying planning data changes. The server logs let us detect abuse, debug failures, and meet our security obligations.

Where it lives

Some of the services we use are based outside Australia. Where this involves personal information leaving the country, the service and the country are named here. We choose AU-region hosting where it is available, and we do not send your email address or IP to services that do not need them.

  • Your email, consent record, and cached report are stored in a managed database in the Sydney (Australia) region.
  • The narrative section of every report is generated by an AI service in the United States(Anthropic's Claude). We send the planning payload and the prompt only — never your email or IP address.
  • Website hosting, transactional email, and bot-protection on the form are handled by established providers in the United States. They see only what their job needs: your IP for hosting and the bot-check, and your email address plus the report for delivery.
  • Aerial imagery embedded in the report is served by NSW SIX Maps. Only the lot's bounding box is sent — not your email, IP, or report content.

Cookies, analytics, and advertising

Separately from the report flow above, the website uses two third-party tools that set cookies and send usage data to the United States. We use them to understand how people find us and to measure our advertising.

  • Google Analytics 4 (Google LLC, United States) sets analytics cookies and records the pages you view, so we can see how the site is used. It does not receive your email address.
  • Meta Pixel and Conversions API (Meta Platforms, Inc., United States) measure the ads that bring people to the site. The Pixel sets advertising cookies in your browser. When you submit the report form, we also send Meta your email address as a one-way hash (irreversible — never in readable form), along with your IP address and browser, so Meta can match the visit to the ad you saw.

These tools are not needed to receive your report — blocking them with your browser's tracking protection, an ad-blocker, or Google's and Meta's own opt-outs has no effect on it.

How long we keep it

  • Email records and consent timestamps: 24 months from the date of consent or your last interaction, whichever is later. After that we delete the email, or — if you have re-engaged — we record renewed consent and reset the clock.
  • Cached reports: kept while the underlying planning data is current. Older versions are purged when our report-version identifier increments.
  • Server logs: 90 days, rolling.

How automated decisions are made

Parts of every report are generated automatically rather than written by a person. We name them here so you can decide how much weight to give the output.

  • The narrative — the readable prose that describes your land, what you can do today, the building envelope, the LMR upzoning context (where applicable), and the neighbourhood — is written by Anthropic's Claude language model from a structured payload of public planning data.
  • LMR (Low and Mid-Rise Housing) eligibility and the regulatory caveats applied to your lot are derived by rule-matching against the same public planning data and the published NSW planning controls. Each caveat that fires is shown in the report.
  • These outputs are not human-reviewed per submission. They are informational — they do not refuse you a service, set a price, or make a decision about you.
  • If you want a specific output reviewed (or removed), write to privacy@vallotta.com.au and we'll come back to you within 30 days.

Who else sees it

The infrastructure providers described under Where it lives — for data storage, AI narrative generation, website hosting, email delivery, and bot-protection — each see only the limited data named there, and only to perform that function for us.

The analytics and advertising tools described under Cookies, analytics, and advertising — Google and Meta — receive site-usage data as set out in that section, and nothing more.

We do not sell your personal information. Beyond the analytics and advertising measurement described above, we do not pass your information to any third party for marketing.

Your rights

Under the Privacy Act, as amended in 2024, you can:

  • ask us what personal information we hold about you;
  • ask us to correct it if it is wrong;
  • ask us to delete it;
  • withdraw your consent at any time — reply STOP to any email from us, or write to privacy@vallotta.com.au.

We will respond to written requests within 30 days. There is no fee.

Complaints

If you believe we have mishandled your personal information, you can complain to the Office of the Australian Information Commissioner (OAIC):

We ask that you write to us first so we have the chance to put the issue right.

Changes to this policy

We update this page when we change a practice. A substantive change to what you have consented to will trigger a fresh consent prompt the next time you request a report, and the consent version above will be incremented.

Contact

Privacy questions and requests: privacy@vallotta.com.au.