About
Privacy Policy
Last updated 2 November 2026
1. Who we are and what this policy covers
Homepedia Assistant is operated by Homepedia Pty Ltd (ABN 44 643 057 354), referred to in this policy as "Homepedia", "we" or "us". We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
This policy covers:
- the tools website at assistant.homepedia.com.au/tools: the income tax estimate, home loan and savings calculators, rate tables, product pages, institution pages, people pages and the pages that explain our methods;
- the public API at assistant.homepedia.com.au/api/tools/v1;
- the MCP server at assistant.homepedia.com.au/mcp, which lets AI assistants such as ChatGPT and Claude use the same tools;
- the publisher portal at assistant.homepedia.com.au/tools/manager, where people who work for lenders, mortgage brokers and institutions publish information; and
- the error report form on rate tables and product pages.
Homepedia's other services, including the tax chat assistant on the home page of assistant.homepedia.com.au, our contact page and our tax and accounting services, are covered by the Homepedia privacy policy at https://homepedia.com.au/privacy-policy/.
Contact: info@homepedia.com.au · Postal address: Suite 201, 276 Pitt Street, Sydney NSW 2000
2. Summary
- You can use every tool without an account and without telling us who you are.
- The figures you enter are used to work out your result. We do not store them.
- The tools never ask for your Tax File Number, date of birth, identity document numbers or bank account details. Please do not enter them anywhere on the service.
- We use your IP address to limit how many requests one source can make. We store only a scrambled form of it that changes every day.
- When you use our tools inside ChatGPT, Claude or another AI assistant, we receive only the inputs the assistant sends for each tool call. We do not receive your conversation.
- Rates and product details come from the public product data that banks and lenders publish under the Consumer Data Right. That data describes financial products, not people.
- People who publish through the portal (lender staff, brokers and institution representatives) choose to have their professional details shown publicly. Section 5 explains what we collect from them, what is shown, and how to remove it.
3. People who use the tools
3.1 What you enter
| Tool | Typical inputs | What happens to them |
|---|---|---|
| Home loan calculator, savings and term deposit calculator (website) | Loan or deposit amount, interest rate, term, repayment or interest options | Worked out in your browser. The figures are not sent to us. |
| Income tax estimate (website) | Income year, residency, salary and other income, deductions, tax withheld, and yes/no answers such as HELP debt and private hospital cover | Sent to our server, used to calculate the estimate, returned to you and discarded. Not stored or logged. |
| Rate tables (website) | Product type, amount, loan-to-value ratio, term, loan purpose, repayment type, lender, sort order | Used to build the table. These choices form part of the page's web address, so they can appear in our hosting provider's request records like any web address (see 3.2). They are not linked to your identity. |
| API and MCP tools | The same kinds of inputs, plus state or postcode and preferred language when looking up verified staff | Used to produce the result, returned and discarded. Not stored. Our logs record only which tool was used, whether it succeeded, how long it took and whether the request came from a known AI platform. |
3.2 Information collected automatically
- IP address, for rate limiting. Each request's IP address is combined with a secret value and the date and turned into a short code (a keyed hash). Only that code is stored, with a count of requests. Because the date is part of the code, the same address produces a different code each day, and stored counts cannot be linked across days. Minute counts are deleted after about five minutes; daily counts shortly after the end of that day (UTC). The IP address itself is not written to our database or our logs.
- Hosting provider request records. Our hosting provider, Vercel, records basic information about each request, such as IP address, time, web address requested, response status and browser type, to run and secure the service. In our hosting account these records are available to us for one day. Vercel may keep its own records for longer under its privacy policy.
- Usage counts. We count tool calls and page views per day, by tool or page type. These counts contain no IP address, cookie, device identifier, browser type or inputs.
- Cookies. The tools pages set no cookies and use no analytics or advertising scripts. The publisher portal sets one sign-in cookie (see 5.1).
3.3 Error reports
Anyone can report that a rate looks wrong. The form asks for the rate, a reason and an optional short note. It does not ask for your name or contact details. Before a note is saved, we automatically remove anything that looks like an email address or phone number. Our staff read the note; the public page shows only that the rate has been reported. Please do not include personal information in the note.
4. Using Homepedia Assistant inside ChatGPT, Claude or another AI assistant
When you connect Homepedia Assistant to an AI assistant, the assistant decides when to call one of our tools and sends us the inputs for that call, for example "taxable income 95,000, income year 2026–27". We receive those inputs and return a result. We do not receive your conversation, your account details or your chat history.
- Your conversation is handled by the provider of the assistant under its own terms and privacy policy, including what it does with the results we return:
- ChatGPT: OpenAI's privacy policy, https://openai.com/policies/privacy-policy/
- Claude: Anthropic's privacy policy, https://www.anthropic.com/legal/privacy
- IP address. Tool calls reach us from the provider's servers, so the IP address we see and use for rate limiting is normally the provider's, not yours.
- Information the provider attaches. ChatGPT can attach information to tool calls, such as language setting, approximate location, a browser-type hint and anonymised user, conversation and organisation identifiers. Our server does not read, use or store these values.
- How results are shown. The assistant may summarise, reorder or combine our results with other information. Section 6 of our Terms of Use explains this.
- Verified staff and brokers. The find_product_supporters tool returns professional details of people who have chosen to publish on Homepedia (see 5.2). It does not return their email address or phone number. The assistant can filter them by the state or postcode and the language you give it; the tool does not need your name or contact details.
- Disconnecting. You can remove Homepedia Assistant from the assistant's settings at any time. Because we do not store tool inputs, there is nothing of yours left with us to delete.
5. Publishers: lender staff, brokers and institution representatives
This section applies to people who register in the publisher portal.
5.1 What we collect
| Information | Detail |
|---|---|
| Registration and profile | Full name (as on your ID), work email address, job title, institution, one work postcode, languages you serve customers in, and optionally a work phone number and a short bio |
| A new institution you add | Its registered name, ABN, Australian Credit Licence number and type (for example broker or non-bank lender) |
| Credentials | The kind and number of each credential you add (for example an Australian Credit Licence, credit representative number, AFS licence, authorised representative number, tax agent registration or association membership), the name shown on the register and, for a membership, the association |
| Declaration | The words of the declaration you sign and when you signed it |
| Acceptance of these terms | Which version of the Terms of Use and this policy you accepted at registration, and when |
| Identity check | Who carried out the check, when, the result, any note, and when it lapses. We check a government photo ID, for example on a short video call. If we use an identity verification service for a check, we tell you which one before the check starts. Homepedia Assistant does not keep a copy of the ID document. |
| Institution check | The steps we take to check an institution (for example its ABN, licence and web domain on public registers), links to the register entries, who did each step and when |
| Authorisations | Who is authorised to publish for an institution, who nominated whom, and when |
| What you publish | Channel prices, corrections and products, with their conditions and dates, and our review of each |
| Documents | Files you upload to support a submission (PDF, PNG or JPEG, up to 4 MB each), or documents you email to us that we attach. Only our staff can open them. Please upload product documents, rate sheets and written confirmations only, not identity documents. |
| Sign-in | A one-time code sent to your work email. We store only scrambled (hashed) forms of the code, your email address and your IP address, and delete them within two days. Signing in sets a cookie that keeps you signed in for 30 days or until you sign out. |
| Reminders | A record of which reminder emails we have sent you, so we do not send the same one twice. We send at most one reminder email a day. |
| Activity record | A record of each review, approval, withdrawal and suspension, and who made it |
| Payments | See section 6 |
Homepedia verifies publisher identity and checks credential numbers against the official register. A broker must give a credit licence or credit representative number. The lenders on a broker's panel, and what a publisher says about a product, are declared by the publisher and are not independently verified by Homepedia.
5.2 What is shown publicly
Nothing you give us is shown publicly until we have checked your identity and your institution. After that, the following appear on your page at assistant.homepedia.com.au/tools/people, on your institution's page and, while channel pricing or other information you published on a product and we reviewed is current, on that product's page:
- your name, job title and institution;
- your area, shown as your state and work postcode (for example "NSW 2150");
- the languages you serve customers in;
- your bio, if you write one;
- your credentials with their numbers, the register we checked and the dates checked and lapsing;
- your verification level ("Identity verified" or "Confirmed by the institution") and its dates;
- what you have published and when you last confirmed it; for a broker, the lenders they say are on their panel;
- your work email and, if you give one, your work phone number.
Work email and phone. These are shown on your page and on product pages by default. When you enter them, we tell you that they will appear on your public Homepedia page and on product pages, that those pages can be indexed by search engines, and that you can hide either of them in the portal at any time. Our API and the AI tools that use it do not return your email or phone; they link to your page.
API and MCP server. Through the API and the MCP server, anyone who asks, including AI assistants, receives your name, institution, role, job title, area, languages, credentials, verification level and dates, channel prices, when you last confirmed them and a link to your page. Your work email and phone number are not returned through the API or the MCP server.
How people are listed. On a product page and through our API and MCP, people can be filtered by the user's state or postcode and by language. They are listed in a random order that changes daily. Homepedia does not assess or recommend one person over another.
Public pages can be found through search engines.
We publish these details because you ask us to: the point of registering is to be shown to customers as a verified person, and you agree to it when you register. You can change most of them in the portal at any time. Once an identity check has started, your name can only be changed through us.
5.3 Who else sees your information
- Homepedia staff who review registrations, checks, submissions, documents and payments.
- People your institution has authorised to publish for it. They can see everyone registered under the institution (name, title, status and check dates) and what each person has published. They can end a colleague's authorisation, nominate a colleague, withdraw anything published for the institution, or tell us a person does not work there, which suspends that person's account and pauses what they published until we review it.
- The lender whose products you publish on, through what is shown publicly. If a lender asks us to remove something about its products, we remove it.
5.4 Why we use it
- to check who you are, where you work and that your credentials are current;
- to publish what you choose to publish, labelled with who supplied it and when;
- to send sign-in codes, and reminders when a check or a published item is about to lapse;
- to handle questions, error reports, disputes and misuse;
- to charge and record fees, when fees apply;
- to keep a record of what was declared, published and reviewed.
Each submission goes through automatic checks (format, comparison rate, whether the value is in the usual range, how long it is valid, whether it matches an existing rate). New products, corrections and channel prices are then reviewed by a person before they go live. The one exception is an update to a product outside the Consumer Data Right that we have already reviewed and approved, made by a person authorised to publish for the institution that offers it, once that institution has passed our institution check. If the update passes the automatic checks, it goes live straight away, we check it afterwards, and we can take it down.
Our review covers identity, the business a publisher works for and credential numbers, as set out in 5.1. The lenders on a broker's panel and what a publisher says about a product are declared by the publisher and are not independently verified by Homepedia.
Automated steps. Checks and published items lapse automatically on their end dates; when they do, what depends on them stops showing until renewed. This is a date rule, not an assessment of you. The automatic checks on a submission look at the product information, not at you. Decisions to approve or decline a registration, a check or a submission are made by our staff.
5.5 Lapsing, withdrawing and closing your account
- Each identity check and credential lapses a year after it was checked, or sooner if the register says the licence ends sooner. When it lapses, its badge comes off your page and what depends on it stops showing.
- You can withdraw a credential or a published item in the portal at any time.
- To close your account, email info@homepedia.com.au from your work email. We take your page and everything you published out of public view straight away and then handle the rest as set out in section 11.
- Search engines and AI providers may keep cached copies of your public page or of our results for a time after your account closes. We do not control those copies. You can ask a search engine to remove an outdated page through its own removal tools.
6. Payments
Some publishers pay fees for identity checks, institution checks and product reviews. The fees and what they cover are shown before you pay. When fees apply:
- payment is made through Stripe Checkout. Your card details go directly to Stripe; we never see or store them;
- Stripe collects your billing name and address and, if you give it, your ABN, so it can issue a tax invoice;
- we keep a record of each order: what it was for, the amount, GST, its status, Stripe's reference numbers, when it was paid, and whether a promotion code was used;
- the person who pays does not have to be the person being checked.
7. When you email us
If you email info@homepedia.com.au, we keep your message and address so we can reply and keep a record of the enquiry.
8. How we use information, and what we do not do
We use the information described above only for the purposes set out in this policy, purposes related to them that you would reasonably expect, or where the law requires or allows it.
We do not sell personal information, use it for advertising or build profiles of people who use the tools. The tools do not send your inputs to any AI model, and we do not use your inputs or publishers' information to train AI models. Fees paid by publishers have no effect on the order of rate tables or lists of people, or on which Consumer Data Right products appear. Products outside the Consumer Data Right appear only after the institution pays for our review. Payment does not guarantee approval and does not affect order.
9. Who receives information
| Recipient | What | Where |
|---|---|---|
| Vercel Inc. (hosting) | All requests to the website, API, MCP server and portal (see 3.2) | Our application runs in Sydney, Australia. Vercel is a US company and may hold request records in the United States. |
| Supabase (database) | Everything we store, including publisher information, documents, rate-limit counts and usage counts | Stored in Sydney, Australia. Supabase is a US company; its staff may access the database from overseas to support and operate it. |
| Resend (email delivery) | Your work email address and the content of sign-in codes and reminder emails | Resend is a US company. Emails are processed outside Australia, for example in Japan or the United States. |
| Stripe (payments, when fees apply) | Payment, billing and invoice details | United States and other countries where Stripe operates |
| OpenAI, Anthropic or another AI assistant provider | Only when you use Homepedia Assistant through their product: they send us tool inputs and receive our results | Mainly the United States, under their own terms and privacy policies |
| The public | Publishers' details listed in 5.2 | Anywhere |
| Regulators, courts and law enforcement | Only where the law requires or authorises it | Australia |
10. Overseas disclosure
Some of the providers we use are based overseas or may handle information outside Australia: Vercel (hosting and request records, United States), Supabase (support access from overseas), Resend (email delivery) and Stripe (payments). Before we use a provider, we take reasonable steps to make sure it handles personal information consistently with the Australian Privacy Principles, including through the data processing terms in its contract with us.
When you use our tools inside an AI assistant, you are the one sending information to that provider, and its handling is governed by its own terms. Publishers' public details can be viewed from anywhere, including by AI assistants run by overseas providers.
11. How long we keep information
Under the Australian Privacy Principles we destroy or de-identify personal information once we no longer need it for a purpose allowed by law.
| Information | How long |
|---|---|
| Home loan and savings calculator inputs | Never leave your browser |
| Tax estimate, API and MCP tool inputs | Not stored; discarded once the result is returned |
| Rate table choices in web addresses | Only in the hosting provider's request records (one day in our hosting account; see 3.2) |
| Rate-limit counts (hashed IP) | Minute counts about five minutes; daily counts until shortly after the end of that day (UTC) |
| Our application logs (no inputs, no IP) | One day |
| Daily usage and page-view counts | Kept; they contain no personal information |
| Error report notes | 2 years after the report is closed |
| Sign-in codes and their hashed email and IP | Deleted within 2 days |
| Portal sign-in cookie | 30 days, or until you sign out |
| Publisher profile | While the account is open. After it closes, out of public view at once and deleted or de-identified within 90 days, except the records below |
| Registrations that never pass an identity check | Deleted 12 months after the last sign-in |
| Identity and institution check records, declarations, acceptance of these terms, authorisations, nominations and the activity record | 7 years after the account closes, so we can show who declared, published and reviewed what if a question is raised later |
| Uploaded documents | 2 years after the item they support stops showing or is declined. After that we keep only the file name, date and a digital fingerprint (hash) as part of the record above |
| Reminder email records | 12 months |
| Payment and invoice records | 5 years after the payment, to meet tax record-keeping rules. Stripe keeps its own records under its policies |
| Emails to info@homepedia.com.au | 2 years after the last contact |
12. Security
All connections use HTTPS. Database access is limited to our application and authorised staff. Sign-in codes are stored only in hashed form and expire after 10 minutes. Uploaded documents can be opened only by our staff. No system is completely secure; if a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner as the law requires.
13. Access and correction
Publishers can see and correct most of their details in the portal. Anyone can ask to see or correct the personal information we hold about them, or ask us to delete it, by emailing info@homepedia.com.au. We may need to confirm who you are first. We will respond within 30 days and do not charge for a request. If we refuse, we will tell you why and how to complain.
14. Children
Homepedia Assistant is a general information tool for adults in Australia. It is not directed at children under 13, and we do not knowingly collect personal information from them. The publisher portal is for adults acting in their work.
15. Changes to this policy
When we change this policy we update the date at the top of this page. If a change materially affects how we handle personal information, we say so on this page, and we email registered publishers before it takes effect.
16. Questions and complaints
Email info@homepedia.com.au or write to us at Suite 201, 276 Pitt Street, Sydney NSW 2000. We will respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner: https://www.oaic.gov.au/privacy/privacy-complaints, phone 1300 363 992.