Privacy Policy

1. Who we are

Afterward ("we", "us", "our") operates the website afterward.com.au and the Afterward estate navigation platform. We are an Australian business operating under an Australian Business Number (ABN).

We are committed to protecting your personal information and complying with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

If you have a privacy question or complaint, contact our Privacy Officer at privacy@afterward.com.au.

2. What personal information we collect

We collect personal information only when it is necessary for our functions. The types of personal information we may collect include:

• Account information: your first name, last name, and email address when you create an account or register your interest.
• Contact information: your phone number, if you voluntarily provide it for SMS updates or early access notifications.
• Usage information: how you interact with our platform — pages visited, features used, and progress through estate tasks. This helps us improve the service.
• Technical information: IP address, browser type, device type, and operating system. Collected automatically when you visit our website.
• Communications: if you contact us by email or through the website, we retain that correspondence.

We do not collect sensitive information (as defined in the Privacy Act) such as health information, financial account numbers, or government identifiers unless you explicitly provide them in a message to us.

3. How we collect personal information

We collect personal information:

• Directly from you when you create an account, sign up for early access, or contact us
• Automatically through cookies and server logs when you visit our website (see Section 8 — Cookies)

Where possible, we collect information directly from you. We will tell you why we are collecting it and how we will use it at the time of collection.

4. Why we collect and use your personal information

We collect and use your personal information to:

• Create and manage your Afterward account
• Provide you with personalised estate navigation guidance and task lists
• Send you relevant updates, guides, and early access notifications (only if you have opted in)
• Improve our platform, content, and services
• Respond to your enquiries and support requests
• Comply with our legal obligations
• Protect the security and integrity of our systems

We will not use your personal information for any purpose that is unrelated to these functions without your consent.

5. Who we share your information with

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

We may share your personal information with:

• Service providers: third-party companies that help us operate the platform (e.g. our hosting provider, Render.com). These providers are contractually required to protect your information and may only use it to provide services to us.
• Legal requirements: if required by law, court order, or a regulatory authority (including the OAIC), we may disclose your personal information.
• Business transitions: if Afterward is acquired or merged with another entity, your personal information may be transferred to the new entity, subject to the same privacy protections.

6. International data transfers (overseas disclosure)

Our website is hosted on Render.com, whose servers may be located outside Australia (including in the United States). By using our platform, you consent to your personal information being stored and processed on servers that may be located overseas.

We take reasonable steps to ensure that any overseas recipient of your personal information is subject to privacy protections at least as comprehensive as the Australian Privacy Principles, including through contractual data processing agreements with our service providers.

In accordance with Australian Privacy Principle 8, we notify you that your information may be disclosed to overseas recipients, and that the APPs may not apply once it is disclosed to those recipients. However, we require our overseas service providers to protect information to an equivalent standard.

7. How we store and protect your information

We take the security of your personal information seriously. Our security measures include:

• Passwords: all user passwords are hashed using bcrypt before storage. We never store passwords in plain text.
• Access controls: personal data is accessible only to authorised personnel who need it to operate the service.
• Encrypted transmission: all data transmitted between your browser and our servers uses HTTPS (TLS encryption).
• Limited retention: we retain your personal information for as long as your account is active, or as long as necessary to provide our services. If you request deletion, we will delete your data within 30 days.

No method of transmission over the internet is 100% secure. While we use commercially reasonable measures to protect your information, we cannot guarantee absolute security.

8. Cookies

Our website may use cookies — small text files stored on your device — to improve your experience. We currently use only essential cookies necessary for the platform to function (e.g. keeping you logged in).

We do not currently use advertising or tracking cookies. If we introduce analytics or advertising cookies in the future, we will update this policy and seek your consent where required.

You can disable cookies in your browser settings, but this may affect the functionality of the platform.

9. Your rights — access, correction, and deletion

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Correct personal information that is inaccurate, out of date, or incomplete
• Delete your personal information (subject to any legal obligations we have to retain it)
• Opt out of receiving marketing communications at any time

To exercise any of these rights, email us at privacy@afterward.com.au. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

10. Notifiable Data Breaches

We are subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988. If we become aware of a data breach that is likely to result in serious harm to you, we will:

• Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable
• Notify you directly if your personal information was involved
• Describe the breach, the information involved, and the steps we are taking

11. Children's privacy

Our service is not directed at children under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us at privacy@afterward.com.au and we will delete it promptly.

12. Links to other websites

Our guides link to external websites including government agencies (Services Australia, ATO, state Supreme Courts) and other third parties. We are not responsible for the privacy practices of those websites. We encourage you to read their privacy policies.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our platform after changes are published constitutes your acceptance of the updated policy.

14. How to make a privacy complaint

If you believe we have not complied with the Australian Privacy Principles, please contact us first:

• Email: privacy@afterward.com.au
• Subject line: Privacy Complaint

We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992
• GPO Box 5288, Sydney NSW 2001