substrataAI

Privacy Policy

The Substrata Group · Version 1.0 · Effective 14 October 2026

1. About this policy

This policy explains how the companies in the Substrata Group collect, use, share and protect personal information, and how you can access it, correct it or complain. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

2. Who we are

This policy applies to the companies below. In this policy "we", "us" and "our" means the company you deal with. When one of our companies shares personal information with another as this policy describes, that company is also bound by this policy.

  • DLP Solutions Pty Ltd (ABN 97 678 106 735), the parent company of the Substrata Group (thesubstratagroup.com).
  • Substrata AI Pty Ltd (ABN 71 701 599 037), trading as AI Construct Co (aiconstruct.co) and Substrata AI (ai.thesubstratagroup.com): building handover documents, maintenance schedules, capital works plans and manuals.
  • Substrata Platform Pty Ltd (ABN 99 663 001 330), trading as DLP Manager Platform: DLP Manager (dlpmanager.com, the DLP Manager web and mobile apps and the DLP Manager Help Centre).
  • Substrata Insurance Holdings Pty Ltd (ABN 47 683 951 055), which holds the Unlockt business (unlockt.io).
  • Substrata Insurance Services Pty Ltd (ABN 75 684 319 784), trading as Unlockt Insurance Services, an authorised representative (No. 1316562) of Ausure Pty Ltd (ABN 94 096 971 854, AFSL 238433).
  • Substrata Services Pty Ltd (ABN 31 684 929 922), which employs our staff, and Substrata IP Pty Ltd (ABN 97 663 001 321), which owns our intellectual property.

Unlockt and Ausure. When Unlockt Insurance Services arranges insurance or gives insurance advice, it acts as an authorised representative of Ausure Pty Ltd, and Ausure's privacy policy also applies to that activity: ausure.com.au/privacy-terms.

3. The personal information we collect

What we collect depends on how you deal with us.

  • Customers and their staff (developers, builders, strata and building managers, owners corporation committee members, quantity surveyors and insurers): name, role, organisation, business contact details, messages and files you send us, account and sign-in details, and billing details. Card payments are handled by our payment providers; we do not store full card numbers.
  • People named in building documents. Drawings, specifications, operation and maintenance manuals and warranties often name consultants, contractors, installers and suppliers and give their business contact details. We record these so the people who run the building know who installed and who services each asset.
  • Owners, residents and tenants using DLP Manager: name, email, phone number, lot or unit, defect reports, photos and videos, access arrangements, messages, and signatures where a form asks for one.
  • Insurance clients of Unlockt: what we need to advise on, arrange and manage insurance, including the names and contact details of the people we deal with, and building, policy, premium and claims information. We collect sensitive information (for example, health information in a claim) only with consent and only where it is needed.
  • People who contact our support teams or use a help centre: name, email, your question, files you upload, and your conversations with our AI assistant.
  • Website and app visitors: device and usage information, such as pages viewed, browser and device type, approximate location from your IP address and the site that referred you (see section 9).
  • Investors and prospective investors: name, email, organisation, and a record of what you view and download on our investor site and in our data room.
  • Job applicants and contractors: the information in your application and from referees you nominate.

You can browse our websites and ask general questions without telling us who you are. For most services we need to know who you are.

4. How we collect it

  • From you, when you fill in a form, create an account, use our apps, email or call us, or meet us.
  • From your organisation or our customers. For example, a developer gives us the building's documents, a builder or building manager adds you to DLP Manager, or a strata manager gives Unlockt details for an insurance renewal.
  • From others, such as insurers and underwriting agencies, the quantity surveyor who reviews our work, integration partners you connect us to (such as Procore), and public sources such as ASIC and business registers.
  • Automatically, through cookies and similar technology on our websites and apps (section 9).

If you give us personal information about someone else, please make sure they know about this policy.

5. How we use it

  • to provide our services: producing handover documents, maintenance schedules, capital works plans and manuals; running DLP Manager; advising on and arranging insurance; and supporting you;
  • to manage accounts, billing and our relationship with you;
  • to send you service messages about your account and our services;
  • to keep our systems and your information secure and to detect misuse;
  • to improve our products, including by analysing how they are used;
  • to create de-identified, aggregated information (section 7);
  • to send you marketing where you have agreed or would reasonably expect it, with a way to opt out (section 10); and
  • to meet our legal and regulatory obligations, including financial services, tax and record-keeping requirements.

If you don't give us the information we ask for, we may not be able to provide the service.

6. How we use artificial intelligence

We use AI in some of our products. People remain responsible for what we deliver.

  • AI Construct and Substrata AI. We use Google's Gemini models, through Google Cloud's Vertex AI, to read construction documents and identify assets, quantities and maintenance details. Our team reviews the results. Where certification is part of the engagement, an independent quantity surveyor reviews and certifies the documents before they are issued as certified.
  • Titan, our AI assistant. Titan answers questions in the DLP Manager Help Centre, from our published help articles, and in some of our other apps. It uses Google's Gemini models through the Gemini API. We keep Titan conversations for a limited time so we can check and improve its answers. If you use voice, your speech is sent to Google's speech service, or to your browser's own speech recognition, to turn it into text. We receive the text, not the audio.
  • Training. Google does not use the content we send to Vertex AI or the paid Gemini API to train its models. We do not use your documents or personal information to train AI models.

Decisions made with the help of computer programs. Our software helps prepare documents and advice about buildings, such as asset registers, maintenance schedules, capital works plans and building risk reports. These outputs are about buildings rather than individuals, and our people review them before they are used. We do not use a computer program to make, or to do something substantially and directly related to making, a decision that could significantly affect your rights or interests. If that changes, we will update this section first, including the kinds of personal information used and the kinds of decisions involved. If you have a question about how a decision was made, contact our Privacy Officer (section 14).

7. De-identified information and benchmarks

We combine information from many buildings into benchmarks, such as typical maintenance costs and asset lifespans. Before information is used this way we remove personal information and anything that identifies a customer or a building, so it is no longer personal information. Documents we receive through an integration such as Procore are used only to produce that customer's deliverables.

8. Who we share it with

  • other companies in the Substrata Group, to provide and support our services;
  • service providers, such as cloud hosting and databases, AI services, email delivery, customer support, analytics, customer relationship management, accounting and payment processing, who may use it only to provide services to us;
  • the independent quantity surveyor who reviews and certifies our work;
  • the people involved in your building, as the service requires: for example, DLP Manager shares a defect report with the builder and the contractor fixing it, and a handover package is shared with the developer, the strata manager and the owners corporation;
  • for insurance: insurers, underwriting agencies, premium funders, claims managers and loss assessors, and our licensee, Ausure Pty Ltd;
  • integration partners that you or your organisation ask us to connect, such as Procore;
  • our professional advisers, auditors and insurers;
  • regulators, courts and law enforcement, where the law requires or allows it; and
  • a buyer of all or part of our business, under confidentiality and only as far as needed.

We do not sell personal information.

9. Cookies and analytics

Our websites and apps use cookies and similar technology to keep you signed in, remember your settings and understand how our sites are used. We use:

  • Lovable's built-in analytics on our websites built with Lovable, which records page views against a short-lived session identifier;
  • Google Analytics on unlockt.io and dlpmanager.com, and Google Tag Manager in the DLP Manager web app; and
  • Google Fonts, which loads fonts from Google's servers.

We do not use advertising or retargeting cookies. You can block or delete cookies in your browser settings, although some features may not work without them. To opt out of Google Analytics, use Google's opt-out browser add-on.

10. Marketing

We send marketing emails only with your consent or where the law allows (for example, to a business address published for that purpose and related to your role). Every marketing email says who sent it and has an unsubscribe link, which we act on within five working days. You can also ask us to stop at any time. Service messages, such as enquiry acknowledgements and account and security notices, are not marketing.

11. Where we hold information, including overseas

We hold most personal information in Australia. Our main databases and file storage are in Sydney: Google Cloud and Supabase for AI Construct, Substrata AI, the Help Centre and Unlockt, and Amazon Web Services for DLP Manager. Our email and business documents are on Microsoft 365, stored in Australia.

Some service providers process personal information outside Australia:

  • AI processing (Google's Gemini models, through Vertex AI and the Gemini API, including speech-to-text for Titan): any country where Google operates.
  • Email delivery (Resend): Japan and the United States.
  • Website hosting and analytics for our Lovable-built websites (Lovable, based in Sweden): served from locations around the world.
  • Website analytics (Google Analytics): the United States.
  • Customer relationship management (Pipedrive): the European Union or the United States.
  • Accounting and payments (Xero, Stripe and Airwallex): Australia, the United States and other countries where these providers operate.
  • AI assistants our staff use for business tasks (Anthropic): the United States.

We take reasonable steps to make sure overseas providers protect personal information in line with the Australian Privacy Principles.

12. How we protect it and how long we keep it

We protect personal information with access controls, multi-factor authentication on staff accounts, encryption in transit and at rest on our main cloud platforms, daily backups, logging and regular security reviews, and we limit staff access to what each role needs. We keep personal information only as long as we need it for the purposes in this policy or as the law requires. A building's record, such as its asset register or defect history, is kept for the life of the building for its owners. When we no longer need personal information, we delete it or de-identify it.

13. Access, correction and deletion

You can ask for the personal information we hold about you, or ask us to correct it, by contacting our Privacy Officer. We respond within 30 days and don't charge for a request. We may need to confirm your identity, and in limited cases the law allows us to refuse; if we do, we will tell you why.

You can also ask us to delete your account. Where information forms part of a building's record that others rely on, such as a defect history, we keep the record but remove or de-identify your personal details.

14. Questions and complaints

Contact our Privacy Officer at privacy@thesubstratagroup.com.

We acknowledge complaints within five business days and aim to resolve them within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, 1300 363 992, GPO Box 5288, Sydney NSW 2001. Complaints about insurance services can also be made through Ausure's complaints process (ausure.com.au/afca), which includes the Australian Financial Complaints Authority (AFCA).

15. Data breaches

If a data breach is likely to result in serious harm, we will notify the people affected and the OAIC as the Notifiable Data Breaches scheme requires.

16. Changes to this policy

We review this policy at least once a year and publish any changes here with a new date.