Menu
Request access

Legal

Privacy policy

Last updated

This policy explains how 9F Pty Ltd (ACN 679 546 064) handles personal information in Atty, for people in Australia, New Zealand, the United Kingdom and the United States.

Atty is operated by 9F Pty Ltd (ACN 679 546 064), a company registered in New South Wales, Australia. We are responsible for the personal information described in this policy, and are its controller under UK data protection law. Contact us at hello@atty.house.

From you, when you use Atty:

  • Account: your name and email address; for each passkey, its public key, its name and when it was last used; and for each sign-in session, its browser, operating system and when it was last active.
  • Access requests: your email address, the address of the house you asked about, where you asked, and our decision.
  • Your house’s record: its address and map coordinates; details of the house, its rooms, systems and appliances, including serial numbers, meter identifiers and utility account numbers; tasks, readings, costs and notes; documents and photos; and contacts you add, such as a tradesperson’s name, phone number, email address and licence number.
  • Email sent to your house’s address: the sender, subject, message and attachments.
  • Ask and voice: your questions, files you attach, the answers, and transcripts of voice conversations in Ask’s chat. We don’t store voice recordings, or questions asked on a house guide, a key holder’s page or a panel.
  • Usage: which pages of the website and apps are visited, with the addresses, links and identifiers in them left out; the site that referred you, your country, browser, operating system and type of device; and how quickly pages load. It isn’t linked to your account.
  • Activity: a log of changes to your record, when they happened, and whether a person or Atty made them.
  • Product notes: notes you share about an appliance model.

From other sources:

  • Public information about your house’s address, such as past sale and rental listings, and about the appliance models in your record, including safety recalls.
  • Manuals and product pictures published by manufacturers and regulators. We keep copies and show them to households whose records include that product. Publishers can ask us to remove a copy at hello@atty.house.
  • Information other people add about you, such as a household that saves you as a contact or uploads a document naming you.

You need an email address to use Atty; everything else you add is up to you. We don’t ask for sensitive information, such as health information, but documents and photos can contain it, and we store and process them like any other document.

  • To provide Atty: keeping your record, signing you in, reading documents and filling in your record from them, answering questions, showing weather, giving access to the people you choose, and moving a house’s record when it changes hands.
  • To research your house and the things in it: finding public information about your address and appliance models, and matching safety recalls to your appliances. When you ask for access, we may research the house at the address you give before we answer, to see what Atty can find about it. What we find is about the house and stays with it; it never names you.
  • To email you: sign-in links, invitations, key offers, handovers, replies to access requests, changes to your account’s email address, and, only if you turn them on, safety recall notices and a daily or weekly summary.
  • To keep a house’s record: the building’s record stays with the house after your household hands it over or lets it go, for whoever holds it next.
  • To decide claims: our staff review the documents someone submits to claim a house that another household holds or has held.
  • To send letters: see Letters.
  • To keep Atty secure, prevent misuse and comply with the law.

If you’re in the UK, our legal basis is our contract with you for providing Atty and emailing you about it; our legitimate interests in researching your house, telling you about recalls, keeping houses’ records for their next holders, deciding claims, sending letters and keeping Atty secure; and legal obligation where the law requires something of us.

We don’t sell personal information, share it for advertising, or use it to build profiles of people. We don’t make decisions about you by automated means alone that have legal or similarly significant effects.

Our service providers, who process it for us:

  • Amazon Web Services (United States): stores all data, and sends and receives email.
  • Vercel (United States): runs the Atty website and apps, and measures how they are used.
  • OpenAI (United States): reads documents, photos and emailed attachments; answers questions in Ask and voice, and those asked on a house guide, a key holder's page or a panel, including the details of your house it looks up to answer them; processes voice audio; researches public information about your address and appliance models. OpenAI doesn’t use this data to train its models, and we ask it not to store its answers. It may keep what it receives for up to 30 days to check for abuse.
  • Mapbox (United States): receives addresses as you type them, and shows maps of your house’s location.
  • Open-Meteo (Switzerland): receives a house’s coordinates when it is added, to set its time zone, and an approximate location for weather.

Mapbox, and OpenAI when you use voice, connect directly to your browser, so they also receive your IP address.

People, depending on how Atty is used:

  • People you give access to: household members, key holders, anyone with a guide link, and panels. See Sharing access.
  • Whoever holds a house next: they receive the house’s record when it is handed over or claimed. See When a house changes hands.
  • Our staff: they can view the building details of any house, and read the documents submitted with a claim they are reviewing. Staff access is logged.
  • Other households: they see product notes you share, without your name.
  • People you contact through Atty: invitations, key offers and handovers show them your name and the house’s address or your household’s name.
  • Authorities, where the law requires it, and a buyer of our business if Atty is sold.

We are in Australia. Our service providers store and process personal information in the United States, under data processing terms that require them to protect it. Open-Meteo, in Switzerland, receives a house’s coordinates when the house is added.

If you’re in the UK, transfers to the United States rely on the UK’s International Data Transfer Addendum to the EU Standard Contractual Clauses, or on the UK Extension to the EU–US Data Privacy Framework, and transfers to Switzerland on the UK’s adequacy regulations. Contact us for a copy of the safeguards.

  • Your account: until you close it. Closing your account deletes your name, email address, passkeys and sign-in sessions.
  • Your household’s documents, costs and notes: until you delete them. A deleted document is erased after 30 days; other deleted items stay in our database until you ask us to erase them. Deleting a household erases its documents, costs, notes, Ask conversations and email records 30 days later; we keep a record that the household existed and who belonged to it.
  • A house’s record, including public information we found about it: kept with the house, including after it changes hands. Documents you remove from it are erased after 30 days. Rooms, appliances, systems, contacts, tasks, keys and panels you remove stay in its history.
  • Activity log: kept with the record it describes; entries about meter readings are deleted after a year.
  • Ask conversations: erased, with the files you attach, a day after the last message.
  • Email sent to your house’s address: the original message is deleted after 30 days; its sender, subject and text stay with your record, and its attachments become documents.
  • Access requests: deleted, with the address you gave, if we decline them, and otherwise 12 months after you ask. Public information we found about the house stays with the house.
  • Records of emails we send you: 90 days.
  • Household memberships, handovers, claims, letters and records of staff access: kept indefinitely.
  • Backups: deleted information can remain in backups for up to 35 days.

We post letters to houses, addressed to the householder, choosing addresses from information published by councils and other public bodies. We keep the address, the public information we used, whether the code in the letter was used and, if it was, the email address given with it. To stop letters to your address, email us; we keep your address on a do-not-send list indefinitely.

Atty sets one cookie to keep you signed in, which also remembers the last house you opened. A paired panel sets one cookie to stay paired and stores its light or dark setting in the browser. The map on a house’s Location page is provided by Mapbox, which stores an anonymous identifier in your browser, replaced every 24 hours, and saves map images so they load faster. The atty.house website sets no cookies.

Atty counts page visits and measures how quickly pages load without cookies or storing anything in your browser.

We don’t use advertising or analytics cookies, and neither we nor any other company track your activity across websites through Atty. Atty works the same way whether or not your browser sends a Do Not Track signal.

To ask about your personal information, contact us at hello@atty.house.

A house’s record stays with the house. Where the law gives you a right to have information erased, we remove what identifies you and keep the facts about the building.

Australia: if we haven’t resolved your complaint within 30 days, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

New Zealand: you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

United Kingdom: you can also ask us to restrict or stop using your information. You can complain to us; we’ll acknowledge your complaint within 30 days and tell you the outcome. You can also complain to the Information Commissioner’s Office (ico.org.uk).

United States: depending on your state, you may have rights to access, correct and delete your information, and to opt out of its sale, targeted advertising and profiling. We don’t sell personal information or use it for targeted advertising or profiling, and we handle access, correction and deletion requests from everyone. If we decline a request, you can appeal by replying to our decision, and then contact your state’s attorney general. We won’t treat you differently for making a request. Nevada residents can send requests not to sell their information to the same address.

Information is encrypted between your device and Atty and when stored, and files are kept in private storage. There are no passwords: you sign in with a passkey or a link we email you.

Links in emails from Atty can sign you in or give you access, so anyone who can read your email can use them. Keep your email account secure, and register a passkey.

If a data breach is likely to cause you serious harm, we’ll tell you and the relevant regulators as the law requires.

Atty is not intended for children. If you believe a child under 13 has given us personal information, contact us and we’ll delete it.

When we change this policy, we update the date at the top. If a change materially affects how we handle your personal information, we’ll email you before it takes effect.