Cookie Policy

1. What cookies and similar technologies are

A cookie is a small text file that a website asks your browser to store on your device. When you return to the site, your browser sends the cookie back, allowing the site to recognize your browser and remember certain information about your visit. Cookies are widely used to make websites work, to make them work more efficiently, and to provide information to the website operator.

"Similar technologies" is a broad term for other methods of storing or reading information on your device. On this website we also use browser storage, specifically the sessionStorage feature built into your web browser. Unlike cookies, sessionStorage entries are not automatically sent to a server with every request, and they are erased by your browser as soon as you close the browser tab.

Cookies and storage can be described in several ways. A "first-party" cookie is set on the domain of the website you are visiting; a "third-party" cookie is set on a different organization's domain. A "session" cookie or storage entry lasts only for your current browsing session and is deleted when you close your browser or tab; a "persistent" cookie remains on your device for a set period or until you delete it. As explained in Section 4, some cookies used for analytics are set as first-party cookies on our own domain even though the data is shared with a third-party provider.

We group the cookies and storage we use into the following categories:

• Strictly necessary — required for the website to function and to record your privacy choices. These cannot be switched off through our banner, because the site would not work correctly or could not honor your preferences without them.
• Functional — support specific optional features you actively choose to use, such as remembering the activity from an interactive demo so it can accompany an inquiry you send us. This storage is created only when you use the relevant feature, is cleared when you close the browser tab, and is not used for cross-site tracking or advertising.
• Analytics — help us understand, on an aggregate basis, how visitors find and use the website so we can improve it. These are set only if you accept them.
• Marketing attribution — measure which of our own advertisements, campaigns and referral links brought you to this website, and whether a visit led to an inquiry, so we can judge where our marketing budget is working. These are set only if you accept them, and the provider is described in Section 4.
• We do not use these technologies to serve you personalized advertising on this website, to build advertising profiles about you for other companies, or to sell or share your personal information for cross-context behavioral advertising.

2. Your choices and consent

We use Google Consent Mode v2 to control analytics on this website. By default, analytics consent is set to "denied": the Google Analytics tag is not loaded, Google Analytics does not run, no analytics cookies are set, and no information is sent to Google, until you make a choice. The marketing-attribution scripts described in Section 4 are likewise not loaded, and set nothing on your device, until you make a choice.

When you first visit the website, we display a consent banner. If you accept, we set your choice to "granted" and load Google Analytics together with the marketing-attribution scripts described in Section 4. If you decline, they all stay blocked, and no analytics or attribution cookies are placed.

Cookies and storage that are strictly necessary to operate the site — such as the cookie that records your consent choice — function at all times, because they are essential to providing the website and to honoring your preferences. The functional browser storage described in this policy (ps:engagement and ps:sid) is different from analytics: it is created only if and when you actively use the interactive feature that relies on it — the on-site return-on-investment (ROI) calculator or the "Ask PropertyStack" assistant — holds nothing until then, and is erased when you close the browser tab. Because that storage is strictly necessary to provide a feature you have explicitly requested, it operates on that basis and is not used for analytics, advertising, or cross-site tracking.

One further item of session storage, ps:attr, works differently again: it is written on the first page of your visit rather than when you use a particular feature, because its only purpose is to remember how that visit began until you decide whether to contact us. It stays in your browser on our own domain, is never read by a third-party script, and is sent to us only if you submit one of our forms — in which case it is recorded with your inquiry so we know which campaign or link produced it. If you do not submit a form, it is erased when you close the tab and we never receive it.

You can change your mind at any time. A "Cookie settings" control on the website re-opens the consent banner so you can grant consent you previously declined, or withdraw consent you previously gave. Withdrawing consent stops further analytics and attribution collection through cookies and also stops the page-exit transmission of the engagement log described in Section 3; it does not delete data already collected, and you can remove existing cookies through your browser as described in Section 5.

Declining or withdrawing consent does not affect your access to the website. All content and features remain available to you either way.

The legal basis on which we rely for these technologies depends on the law that applies to you. Where the GDPR or UK GDPR applies, we rely on your consent for analytics and marketing-attribution cookies; for strictly necessary cookies, and for the functional storage that is strictly necessary to provide a feature you have explicitly requested, we rely on the necessity of operating the site or providing that feature and, where relevant, our legitimate interests. Under the Privacy Act 1988 (Cth) and the APPs, we handle any personal information collected through these technologies in accordance with our Privacy Policy. Under the CCPA/CPRA and other US state laws, we treat a decision to decline, and recognized opt-out signals, as instructions not to use non-essential technologies, including marketing-attribution technologies; we do not sell personal information, and we use attribution data only to measure our own marketing rather than to "share" personal information for cross-context behavioral advertising.

3. The cookies and storage we use

The list below describes each cookie and browser-storage item this website may use, in the format: Name — Provider — Purpose — Duration — Category. Durations are indicative; actual expiry can vary slightly by browser, and you can delete these items at any time.

• ps_consent — PropertyStack (first-party cookie) — Remembers your analytics consent choice ("granted" or "denied") so we do not ask again on every visit and so we can honor your preference — 1 year (path=/, SameSite=Lax) — Strictly necessary.
• _ga — Google Analytics (first-party cookie set on this website's own domain; the data is shared with Google LLC as recipient) — Distinguishes individual browsers to measure how the website is used, as part of Google Analytics 4 — approximately 2 years — Analytics; set only after you accept analytics cookies.
• _ga_<id> — Google Analytics (first-party cookie set on this website's own domain; the data is shared with Google LLC as recipient) — Maintains Google Analytics 4 session state (the "<id>" is the measurement/property identifier) — approximately 2 years — Analytics; set only after you accept analytics cookies.
• _gid — Google Analytics (first-party cookie set on this website's own domain; the data is shared with Google LLC as recipient) — Distinguishes individual browsers for usage measurement, if used by Google Analytics — approximately 24 hours — Analytics; set only after you accept analytics cookies.
• HYROS attribution identifiers — HYROS Inc. (first-party cookies and browser storage set by the HYROS script on this website's own domain; the data is shared with HYROS Inc. as recipient) — Link the advertisement, campaign or referral link you clicked, including any click identifier carried in the landing-page address, to your later activity on this site, so we can attribute inquiries to the campaigns that produced them — up to approximately 1 year, depending on the identifier — Marketing attribution; set only after you accept cookies. The exact names the HYROS script uses may change as the provider updates it; you can view and delete them at any time through your browser as described in Section 5.
• ps:engagement — PropertyStack (browser sessionStorage, not a cookie) — Remembers your demo activity during a visit — the inputs and results of the on-site return-on-investment (ROI) calculator and a capped transcript of any conversation with the on-site assistant — so that, if you choose to contact us, this context can be sent with your inquiry to help us respond. If you submit a contact form, this stored demo activity is attached to and disclosed together with your submission (see our Privacy Policy for how we then handle it). In addition, where you have accepted analytics cookies, the engagement log may be transmitted to us when you leave or close the page; if you decline analytics cookies, this page-exit transmission does not occur — cleared automatically when you close the browser tab — Functional.
• ps:sid — PropertyStack (browser sessionStorage, not a cookie) — Stores a randomly generated session identifier that links your demo activity together for a single visit; it is not used to identify you across sites or sessions — cleared automatically when you close the browser tab — Functional.
• ps:attr — PropertyStack (browser sessionStorage, not a cookie) — Records how your visit began: the address of the first page you opened, any campaign or advertising click identifiers carried in that address (for example utm_source, utm_campaign, gclid or fbclid), the website that referred you, and the time of that first page. It is written once per visit and is sent to us only if you submit one of our forms, so that we can tell which campaign or link led to your inquiry; it is not read by any third-party script and is not used to track you across other websites — cleared automatically when you close the browser tab — Functional.
• hubspotutk — HubSpot, Inc. (first-party cookie set by the HubSpot tracking script on this website's own domain; the data is shared with HubSpot, Inc. as recipient) — Identifies your browser to HubSpot so that a form you submit can be linked to the visit that led to it, including the page or campaign that brought you here — approximately 6 months — Marketing attribution; set only after you accept cookies.
• __hstc, __hssc and __hssrc — HubSpot, Inc. (first-party cookies set by the HubSpot tracking script on this website's own domain; the data is shared with HubSpot, Inc. as recipient) — Record visit and session information used by HubSpot's website analytics: your first, current and most recent visit (__hstc, approximately 6 months), the current session (__hssc, 30 minutes) and whether you have restarted your browser (__hssrc, cleared when you close the browser) — Marketing attribution; set only after you accept cookies.
• __hs_do_not_track — HubSpot, Inc. (first-party cookie) — Set only if you decline cookies, or withdraw consent, after the HubSpot script has loaded; it tells that script to stop collecting. Because it is the record of your refusal, we do not delete it when you decline — approximately 6 months, or until you clear it — Strictly necessary.
• _fbp — Meta Platforms, Inc. (first-party cookie set by the Meta pixel on this website's own domain; the data is shared with Meta Platforms, Inc. as recipient) — Identifies your browser so that an inquiry you submit can be matched to the advertisement that brought you here, and so that the same inquiry, reported both from your browser and from our servers, is counted once rather than twice — approximately 3 months — Marketing attribution; set only after you accept cookies.
• _fbc — Meta Platforms, Inc. (first-party cookie set by the Meta pixel on this website's own domain; the data is shared with Meta Platforms, Inc. as recipient) — Stores the advertising click identifier contained in the address you arrived on, for the same attribution purpose — approximately 3 months — Marketing attribution; set only after you accept cookies.

4. Analytics and other third-party services

Our web-analytics service is Google Analytics 4, provided by Google LLC, and it runs only after you accept analytics cookies. Although Google LLC is a third-party recipient of the analytics data, the Google Analytics cookies (_ga, _ga_<id> and, if used, _gid) are set as first-party cookies on this website's own domain. This means that a browser setting which blocks only third-party cookies may not prevent them; to stop them, decline analytics on our banner or use the "Cookie settings" control, or delete the cookies through your browser as described in Section 5. We use Google Analytics to understand, in aggregate, how visitors find and use the site — for example pages viewed, approximate location derived from IP address, device and browser type, and referral source — so we can improve it. We retain Google Analytics event data for up to 14 months. We do not use Google Analytics for advertising personalization on this site.

Information collected through Google Analytics is processed by Google in accordance with its own terms. You can learn more from the "Google Privacy Policy", the "How Google uses information from sites or apps that use our services" notice, and Google's guidance on how Google Analytics uses cookies. You can also install the Google Analytics Opt-out Browser Add-on to prevent your data from being used by Google Analytics.

We also use HYROS, an advertising-attribution service provided by HYROS Inc. (United States), which runs only after you accept cookies. HYROS measures which of our own advertisements, campaigns and referral links bring visitors to this website, and which of those visits result in an inquiry, so that we can judge which marketing spend is working. To do that, the HYROS script may record the landing-page address you arrived on — including any advertising click identifier contained in it — the pages you view on this site, whether you submitted a form, and identifiers it stores in first-party cookies or browser storage on our own domain. We use HYROS to measure our own marketing only: we do not use it to serve you personalized advertising on this website, to build advertising profiles about you for other companies, or to sell or share your personal information for cross-context behavioral advertising. Information collected through HYROS is processed by HYROS Inc. in accordance with its own terms. If you decline cookies, or withdraw consent through the "Cookie settings" control, the HYROS script is not loaded.

Where they are enabled, we also use HubSpot's website tracking script, provided by HubSpot, Inc., and the Meta pixel, provided by Meta Platforms, Inc. (United States). Both run only after you accept cookies, and both are there to tell us which page, campaign or advertisement produced an inquiry. The HubSpot script sets the hubspotutk, __hstc, __hssc and __hssrc cookies listed in Section 3 and links a form you submit to the visit that led to it, so that our team can see that context on your record in our CRM. The Meta pixel sets the _fbp and _fbc cookies listed in Section 3 and reports that an inquiry was submitted. If you decline cookies, neither script is loaded; if you withdraw consent after accepting, we instruct both to stop collecting and we expire the cookies they set, except for the cookie in which HubSpot records your refusal.

Separately from those cookies, when you submit one of our forms we report that conversion to Meta from our own servers as well, so that inquiries from visitors whose browsers block the pixel are still counted. That report includes an irreversibly hashed (SHA-256) form of the contact details you submitted, together with your IP address and browser user-agent string, which Meta uses only to match the conversion to an advertisement; both reports carry the same identifier so that one inquiry is counted once. Because this report follows from the inquiry you chose to send us rather than from anything stored on your device, it is not controlled by the cookie banner. Our Privacy Policy describes this processing and your rights over it.

Separately, the website offers an optional on-site assistant ("Ask PropertyStack"), which is powered by ElevenLabs Inc. If you choose to use the assistant, your voice and/or text conversation is streamed to ElevenLabs to operate the live demo. This is a data transfer rather than a cookie, and it happens only when you actively use the assistant. Our AI providers process this data solely to provide the service to us; we do not permit them to use it to train their general-purpose models. The website is hosted on infrastructure provided by Vercel Inc. Our use of these service providers, and the personal information involved, is described in our Privacy Policy.

5. Managing cookies through your browser

In addition to our "Cookie settings" control, most web browsers let you view, manage, block and delete cookies and clear locally stored data through their settings. The exact steps vary by browser and device; consult your browser's help pages for instructions. You can typically choose to block all cookies, block only third-party cookies, delete cookies when you close the browser, or remove existing cookies individually.

Because ps:engagement, ps:sid and ps:attr are stored in your browser's sessionStorage, they are removed automatically when you close the tab, and you can also clear them at any time through your browser's tools for clearing site data.

Please note that strictly necessary cookies are essential to the site. If you block or delete the ps_consent cookie, we will not be able to remember your privacy choice, and you may be asked to make it again on your next visit. Blocking cookies more broadly may affect how some parts of the website function.

6. Global Privacy Control and Do Not Track

Some browsers and extensions can send an automated privacy signal, such as Global Privacy Control (GPC), that communicates a general preference not to have non-essential tracking or data "sale"/"sharing". Where such a signal is legally recognized as a valid opt-out (for example under the CCPA/CPRA and certain other US state laws), we treat it as a request to keep both analytics and marketing attribution disabled for your browser. Because this website does not use cookies to sell or share personal information for cross-context behavioral advertising, there is no such activity for the signal to stop.

"Do Not Track" (DNT) is an older browser setting for which the industry never adopted a common standard. As there is no consistent, agreed way to interpret DNT, we do not respond to DNT headers specifically. In practice, however, analytics on this website is disabled by default and runs only if you affirmatively accept it, so a visitor who has not opted in is already not tracked by our analytics cookies.

7. International data transfers

Some of the providers whose technologies are described above are located in the United States, including Google LLC (Google Analytics), HYROS Inc. and Meta Platforms, Inc. (advertising attribution and measurement), HubSpot, Inc. (website tracking; our CRM data itself is hosted in Australia) and Vercel Inc. (hosting). Where analytics or attribution cookies are accepted, information associated with those cookies may be transferred to and processed in the United States or other countries whose data-protection laws may differ from those of your home jurisdiction.

Where we or our providers transfer personal information across borders, we take steps designed to ensure it remains protected, consistent with the Australian Privacy Principles and, where applicable, the GDPR/UK GDPR (for example, by relying on appropriate safeguards such as Standard Contractual Clauses). Further detail on international transfers and the safeguards we use is set out in our Privacy Policy.

8. The PropertyStack product application

This Cookie Policy covers the marketing website only. The PropertyStack product application at app.mypropertystack.io is a separate environment used by customers and their authorized users, and it may use different cookies and technologies, together with additional sub-processors beyond those used for this website.

Product sub-processors include Kovena (Australia — payment processing for PS Pay), Twilio Inc. (United States — SMS and telephony), Twilio SendGrid (United States — transactional email), ElevenLabs Inc. (United States — AI voice and conversation features), Google LLC (United States — analytics) and Vercel Inc. (United States — web hosting), together with cloud infrastructure providers located in Australia and the United States. The authoritative, current list of product sub-processors accompanies our signable Data Processing Addendum (DPA), which is available on request from legal@propertystack.ai; we give customers at least 30 days' notice of new sub-processors, with a right to object. Customers should refer to the disclosures and agreements applicable to the product for details of cookies and data handling within the application.

9. Changes to this Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in the technologies we use, in our practices, or in legal or regulatory requirements. When we make changes, we will revise the "last updated" date above. Where required by law, we will also seek your renewed consent or provide additional notice.

We encourage you to review this policy periodically so that you stay informed about our use of cookies and similar technologies.

10. How to contact us

If you have any questions about this Cookie Policy or about our use of cookies and similar technologies, you can contact us at privacy@propertystack.ai. For legal notices you may use legal@propertystack.ai, and for security matters security@propertystack.ai. Privacy questions and requests are handled by our Privacy Officer, who can be reached at privacy@propertystack.ai.

You can also write to us at PropertyStack Software Pty Ltd, 315 Brunswick Street, Fortitude Valley QLD 4006, Australia; correspondence is handled most promptly through the email addresses above. This Cookie Policy is governed by the laws of Queensland, Australia, without prejudice to any mandatory data-protection rights you may have under the laws of your own country or region.