Privacy policy

Last updated: 2 November 2026

Xunmu is operated by Xunmu AI Pty Ltd (ABN 13 698 099 642) ("we", "us"). This policy explains what we collect when you use xunmu.com.au, why, who we share it with, and the choices you have. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

What we collect

• Your account details — name, email address, mobile number and a password (stored only in hashed form).
• Your mobile number — if you open a full report without an account, the Australian mobile number you verify by text message. We use it to count free reports, to text you the link to your report, and to contact you about that review: our team may call once to offer a free call with a partner conveyancer or solicitor, and won't call again if you say no. We pass it with your report to a partner conveyancer or solicitor only when you book a call or ask for an introduction. We never sell it.
• The contract you upload — the PDF itself and what we read from it. A contract for sale contains personal information about you and about other people, such as the vendor, agents and solicitors named in it.
• What you tell us about your purchase — for example the price, whether you are a first home buyer, and the type of property, which we use for the stamp duty estimate and to read the contract correctly.
• Payment records — that you paid, when, and how much. Card details are entered on Stripe's page and never reach our servers.
• Technical information — IP address, browser type and the time of requests, kept in server logs for security and to prevent abuse.

How we use it

• To review your contract and produce your report.
• To run your account, take payment, and respond when you contact us.
• To contact you about your contract review, as you agreed when you verified your mobile or signed up.
• To connect you with a licensed conveyancer or solicitor when you book a call or ask for one (see below).
• To find and fix problems, keep the service secure, and improve how accurately we read contracts.

We do not sell your personal information, and we do not use your contract to advertise to you.

Who we share it with

• Conveyancers and solicitors we work with. When you book a call or ask to speak with a conveyancer or solicitor, we pass your name, contact details and your contract review to a licensed conveyancer or solicitor so they can contact you. We tell you this at the point you choose it.
• OpenAI — the text and page images of your contract are sent to OpenAI's API to be read. Under OpenAI's API terms, content sent this way is not used to train their models.
• Cloudflare — stores your uploaded contract and serves the website.
• Railway — hosts our application and database.
• Stripe — processes your payment.
• Mailgun — sends our emails to you.
• Twilio — sends our text messages: your verification codes and notes about your review.
• Where the law requires it, or to establish or defend a legal claim.

Information sent overseas

Some of these providers process information outside Australia, mainly in the United States. By uploading a contract you consent to that transfer. We choose providers that commit to protecting information to a standard comparable to Australian law, but overseas recipients are not bound by the Australian Privacy Principles.

How long we keep it

We keep your uploaded contract and your report for 12 months after your last activity so you can come back to them, and then delete them. You can ask us to delete them sooner. Payment records are kept for the period tax law requires. Contracts uploaded without an account are kept only long enough for you to return and claim them.

Security

Contracts are stored in private storage that is not publicly accessible, connections to the site are encrypted, and access to contracts inside our team is limited to people who need it to provide or improve the service. No online service can promise perfect security; if a breach is likely to cause you serious harm we will tell you and the regulator as the law requires.

Your choices

• Ask for a copy of the personal information we hold about you, or for it to be corrected.
• Ask us to delete your account, your contracts and your reports.
• Tell us to stop contacting you, or that you do not want your details passed to a conveyancer or solicitor.

Email info@xunmu.com.au and we will respond within 30 days.

Cookies

We store a sign-in token in your browser so you stay logged in, and a token that lets you return to a contract you uploaded before creating an account. We also use Google Analytics and Google Ads conversion tracking, which set cookies to count visits and to tell us which ads led to an upload, a sign-up or a report unlock; they do not see the contents of your contract. You can block these cookies in your browser without affecting the service.

Complaints

If you think we have mishandled your information, email info@xunmu.com.au first so we can put it right. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

We will post any changes here and update the date at the top. If a change materially affects how we use information we already hold, we will tell you by email.

Questions? Email info@xunmu.com.au. See also our Privacy policy and Terms of service.