Legal · Current policy
Privacy policy
Effective: 4 September 2026 · Version 1.0
Who is responsible for Bidline
Bidline Pty Ltd (ACN 698 484 847) is responsible for Bidline and this privacy policy. On Google Play, the app is published through the developer account named “Mitsi” on behalf of Bidline Pty Ltd.
Information we collect
We collect the account information needed to operate Bidline: your name, email address, Bidline user ID, and account role. When you create or sign in to an account, the password you enter is sent through the Bidline API to Amazon Cognito for account creation or authentication. The six-digit code you enter to confirm your email is sent through the same route to Cognito for verification. Bidline does not write those passwords or confirmation codes to its application database or intentionally record them in application logs. Amazon Cognito processes them as Bidline's authentication service provider, and AWS CloudTrail records operation metadata with those secret fields redacted. When you place an offer, we collect its amount, deposit, settlement period, and any optional conditions. When you report a listing, we collect the listing identifier, selected reason, any optional details you provide, the app surface and build, and a reference for the report. If you join the marketing-site waitlist, we collect your name, email address, selected role, region, any information you choose to provide about live property supply or demand, and campaign source.
Searches and service records
Search text you enter, including suburb text, is sent to our backend to return matching public listings. We process that text for the search request and do not save it as a profile or search-history record. We record actions and audit or compliance events needed to operate and protect the service, including the responsible user ID and role, the affected record, timestamps, correlation information, and the disclosure version shown for relevant actions.
Operational logs and website rate limiting
For Android app requests, API Gateway access logging is disabled. AWS retains limited operational Lambda logs, X-Ray trace metadata, and authentication-operation metadata under their configured service retention settings. These records do not intentionally store complete request bodies, search text, passwords, confirmation codes, source IP addresses, or user-agent headers, and the authentication service redacts password and confirmation-code fields. The marketing-site waitlist separately processes a source IP for rate limiting. Its active counter and any exceeded-limit diagnostic expire under their configured service retention settings. If a Cloudflare Turnstile security check is displayed on that form, your browser connects to Cloudflare and Bidline sends Cloudflare the resulting token and source IP to verify the request; Cloudflare may process that information outside Australia.
How we use and disclose information
We use this information to authenticate users, provide listing and offer features, handle waitlist applications and requested product updates, receive and investigate reports, maintain service integrity, provide support, and meet legal obligations. We do not sell personal information or share it with advertisers. AWS processes core service information for us as our cloud provider. Slack processes limited operational notifications for account and evidence review and content-report moderation. Those notifications can include an account email and role, an internal Bidline account identifier used in review-action values, an evidence summary, or a report reference, reason, subject identifier, and app surface. We do not send the optional free-text report details to Slack. We may also disclose information where required by law or to protect users and the service.
Analytics and advertising
The current Bidline Android app contains no advertising, product-analytics, or crash-reporting SDK. It does not send app data to PostHog or Sentry. First-party audit and compliance records described above are operational records, not advertising or behavioural analytics.
Where information is stored and how it is protected
Bidline's core backend and stored app data are hosted on AWS in Sydney, Australia (ap-southeast-2). Limited operational notification information described above is processed by Slack and may be processed or stored outside Australia where Slack or its service providers operate. Information sent between the app, our backend, and these service providers is encrypted in transit using HTTPS/TLS. No online service can guarantee absolute security.
Retention and account deletion
You can delete your account in the app or follow our account-deletion instructions. Your active account, sign-in, private profile, and uploaded verification data are removed. Some placed offers, published listing records, and audit or compliance records may need to remain to preserve record integrity and meet Australian legal and record-keeping obligations; Bidline removes the direct account identity from those records. Limited operational review or moderation notifications already sent to Slack may retain the account email, role, internal Bidline account identifier, and other limited review metadata for service safety, moderation, or legal purposes. A minimised email suppression entry may also retain the address after a provider bounce or complaint so we do not send unwanted or undeliverable messages. The account-deletion page describes these categories. Retention depends on the type of record and the applicable purpose or obligation; we do not apply or promise one fixed period for every record.
Access, correction, and contact
You can ask for access to or correction of your personal information, ask a privacy question, or raise a concern by emailing support@keenshift.ai. We handle eligible requests and any notifiable data breach in accordance with applicable Australian privacy law.
Material changes will be published here with a new effective date and any notice required by law.