Privacy Policy

1. Who we are

MyLoanBook is a software service for Australian mortgage brokers. It is operated by Digital Broker Labs Pty Ltd (ABN 37 694 129 907, ACN 694 129 907), an Australian Private Company in NSW. In this policy, “we” means Digital Broker Labs Pty Ltd. Contact us at support@myloanbook.au.

Our customers are brokers. A broker’s clients are not our customers, and we hold their information on the broker’s behalf. A client who wants to see or correct their information should ask their broker first.

2. What we collect (APP 1, 3)

• Account details: your name, email address, business name, credit representative or licence number, and your authentication factors.
• The commission statements you upload: lender names, loan balances, settlement and payment dates, commission amounts, and your clients’ names. This is your clients’ personal information, and you warrant that you are authorised to share it with us. The original statement file is kept under your account until the account is deleted.
• Details you add about a client or a loan: contact details, property addresses and values, interest rates, review notes and messages.
• Billing details: your plan and its price (stated ex GST), your invoices and the state of your subscription. Stripe processes payments and holds the card. We never see or store a full card number. A new paid subscription starts with a 45-day free trial. A card is asked for at checkout and is not charged until the 45 days are up. Cancel before then and nothing is charged. While you have fewer than 30 clients the service is free and no card is collected; we count your clients (not their details) to know when the limit is reached.
• Your licence check: the credit representative number or Australian Credit Licence number you give us, and what ASIC’s public registers say about it (the name and ABN it is registered to and whether it is current). We use it to confirm you are a licensed broker. If it cannot be confirmed automatically, a member of our team reviews it, usually within 4 hours.
• Usage data: pages visited, features used, and error diagnostics without personal data.

Offsetly

Offsetly is an app for a broker’s clients, offered through the broker. A client has no account and no password. The broker sends the client a one-time code; the client enters it in the app on their phone. Linking stores a hashed copy of the code and a hashed device token for that phone, and nothing else about the device.

Through Offsetly a client sees the borrower-safe details of their own loans from the broker’s records: lender, balance as last reported, interest rate, and fixed or interest-only dates. Never the broker’s commission. If the client answers a check-in, sends a message or turns on rate watch, that information goes to their broker, who keeps it as part of their records. All of it is optional.

The app shows a collection notice when a phone links and again from its settings (version 2026-09-25-draft). This policy follows that notice: when the notice changes, so does this section.

3. How we use it (APP 6)

• To provide the analytics, reports, documents and workflow tools of the service.
• To send the emails, SMS and app notifications you have turned on.
• To operate billing and your subscription.
• To improve the service, using de-identified and aggregated patterns only.

We do not sell personal information. We do not use your clients’ data for advertising. No artificial-intelligence or machine-learning service processes your data. We do not use automated decision-making that significantly affects individuals: every figure the service shows is a calculation from your own records, and a person decides what to do with it.

4. RateIntelligence (APP 6)

RateIntelligence shows brokers what loans of a kind have recently ended up at: the rate negotiated with the lender a loan was already with, and the rate new loans settled at. It is built from rates recorded by the brokers who use the service, grouped so that no client, broker or brokerage is ever named in it.

What is counted about a rate a broker records as negotiated or settled:

• The lender
• The rate that was negotiated or settled, the date it took effect and the date it was recorded
• Whether the rate is fixed or variable, and the fixed term
• What the loan is for: owner occupied or investment
• Whether repayments are principal and interest, or interest only
• The LVR, as a band (for example 70% to 80%)
• The size of the loan, as a band (for example $500,000 to $750,000)
• Whether the loan is on a package

What is never counted:

• Your client's name, address, date of birth or contact details
• Account numbers, or the address of a property
• Your name, your brokerage's name, or your commission
• Notes, documents or anything you have written about a client

How it is protected:

• An estimate never names a client, a loan, a broker or a brokerage: what it is built from holds none of them, and it is shown only for a loan of your own book.
• You are shown a band (for example “10-24 clients”), never a count, and the week of the latest deal, never its date.
• How many clients and brokerages an estimate needs is set by MyLoanBook and is raised as more brokers take part.
• A rate that looks implausibly low for its lender is held out until it has been checked.
• Only rates recorded by brokers whose credit licence has been checked against ASIC's register are counted.
• Estimates can only be looked up for a loan in your own book: nobody can ask about a lender, an LVR or a loan size directly.
• Estimates are for you. They do not appear in any document a client is given.

A broker takes part unless they choose not to, and can stop at Settings, then RateIntelligence. A broker who stops is shown no estimates from that moment. RateIntelligence is built again every night from the brokers then taking part, so from the next night their rates are in no estimate.

5. Disclosure and overseas transfer (APP 8)

We share information only with the service providers that run the service, and only as far as each one needs:

• Supabase: database, authentication and file storage, hosted in Sydney, Australia.
• Vercel: application hosting. Our functions run in Sydney; its edge network may involve the United States. Vercel Web Analytics and Speed Insights also count page views and measure how fast pages load, without cookies; the address they receive has no search terms or link codes in it, and they are never loaded on the Offsetly join page or on a referral link.
• Stripe: payments, United States.
• Resend: email, including statements you forward to us, United States.
• Twilio: SMS delivery, United States.
• Upstash: rate limiting and caching in Sydney, and the job queue, which runs in the European Union.
• Apple: notifications for the Broker and Offsetly apps. A notification carries no client name, loan detail or figure: only a fixed message for its kind and an opaque identifier.
• Sentry: error reports only, with personal-data collection turned off.
• Google Analytics: optional usage analytics on the web app. It is never loaded on the Offsetly join page or on a referral link.

Where information leaves Australia, we use providers bound by contractual safeguards consistent with APP 8. We do not disclose personal information to anyone else unless the law requires it.

6. Security (APP 11)

Your data is isolated per account and the isolation is enforced in the database itself (row-level security). Data is encrypted in transit and at rest. Multi-factor authentication is mandatory for brokers and their staff.

An Offsetly client does not sign in. They link a phone with a one-time code that works once, within 48 hours, and the phone then holds a device token. There is no password and no second factor. That access is limited to the borrower-safe details of the client’s own loans, and it ends when the broker revokes it, when the client unlinks the phone, or after 180 days without use.

No system is perfectly secure. We will notify you and the Office of the Australian Information Commissioner of eligible data breaches as the Notifiable Data Breaches scheme requires.

7. Access, correction and deletion (APP 12, 13)

You can export a machine-readable copy of all data we hold for your account at any time from Settings, then Data and Privacy. You may ask us to correct inaccurate information. You may ask for your account and its data to be deleted; we complete a verified request within 30 days, after any active subscription has been cancelled. Backups expire on their normal schedule.

8. Marketing messages (Spam Act 2003)

We send commercial electronic messages only with your consent, identify the sender in every message, and honour an opt-out within 5 business days. The SMS and email features you use with your clients record the consent basis for each contact and refuse to send to a contact who has opted out.

9. Cookies

We use essential cookies for signing in and for your preferences, and optional analytics cookies (Google Analytics), which you may decline in your browser settings.

10. Complaints (APP 1)

Contact us first at support@myloanbook.au. If you are not satisfied with our answer, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.