movelyLegal
Privacy
This policy explains how Apollo Advisors° handles personal information through Movely, from the public website and waitlist to invited and paid planning features. Movely is in early access, so this policy is written around the features currently operating.
Last updated: 12 August 2026
About this policy
Movely is a product operated by Apollo Advisors° ABN 34 346 108 139 (we, us or Movely). Our operating address is International Tower 3 Level 17, 300 Barangaroo Ave, Barangaroo NSW 2000, Australia. This policy covers the Movely website, waitlist and referrals, sign-in and account creation, authenticated Move Boards and renovation projects, billing, support and email communications.
In this policy, a household means a shared Move Board and its authorised members. Personal information means information or an opinion about an identified individual, or an individual who can reasonably be identified, whether true or not. Property and financial information can be commercially or personally sensitive even where it is not legally classified as sensitive information.
Information we handle
Depending on how you use Movely, we may handle:
- names, email addresses, phone details where provided, account identifiers and authentication or security events;
- household membership, roles, invitations, activity, tasks, notes, dates, plans, checklists and renovation projects;
- property addresses, suburb and postcode information, property preferences, search history, property images, estimates, comparisons and related calculations;
- sale, purchase, moving and settlement dates, budgets, deposits, costs, mortgage assumptions, cash buffers and other financial inputs;
- billing, subscription, checkout and payment-status records handled through our payment flow;
- contact messages, feedback, referral and campaign details, and transactional email delivery records; and
- cookies, authentication data, device and browser details, IP-related request data, server logs, analytics events and error or security events.
We do not currently ask you to upload documents through the reviewed planning routes. If that changes, we will update this policy before introducing that processing.
Where information comes from
Information may come directly from you, from another household member or inviter, from public or licensed property datasets, from property-data providers, from address, mapping or geocoding services, from cookies and application infrastructure, or from calculations and inferences generated from inputs already in Movely.
An inviter may give us another person's email address so that we can send an invitation. That person does not need to have a Movely account before the invitation is sent. Please only submit information about another person, household or property when you are authorised to do so.
Waitlist IP protection
When a waitlist submission reaches the application, Movely reads the first address in the forwarded request headers, or an equivalent request header when available. The server creates an HMAC-SHA-256 value using the server-side WAITLIST_RATE_LIMIT_SALT configuration. The resulting 64-character value is stored with waitlist submission events and rate-limit counters, together with a timestamp and outcome or attempt count.
This keyed hash is used to rate-limit abuse and can link repeated requests that produce the same value. The raw IP address is not stored in the waitlist signup or submission-event records. Vercel, a CDN, browser, security or other infrastructure provider may still receive or retain request information in its own logs and systems. Movely does not treat the application record as a promise that raw IP information is absent from every part of the request path.
How we use information
We use information for specific purposes, including to:
- operate Move Boards, property planning, renovation feasibility, calculations, comparisons and requested imagery;
- create and secure accounts, workspaces, invitations and role-based access;
- send invitations, account, billing, security, support and other service messages;
- process subscriptions and payments when you choose a paid plan;
- troubleshoot, monitor, prevent fraud and abuse, enforce limits and protect the service;
- understand product use, improve the application and assess reliability through configured analytics and error monitoring; and
- meet legal obligations, establish or defend legal rights, and keep operational records where reasonably necessary.
The current reviewed application does not use personal information to train an AI or model service, make lending or insurance decisions, rank people for employment, or decide a person's legal rights. Its planning calculations, property estimates and scenario outputs are not formal valuations or decisions of that kind.
Property information and estimates
Address and property information may be entered by you or selected from published and licensed Australian property data. Current valuation integrations use PropRadar and, where configured as a fallback or source, Domain. Address search, geocoding, Street View and satellite context may use Movely's approved datasets and Google Maps Platform services.
Movely combines user inputs, provider data and its own calculations to produce estimates, comparisons, ranges and planning views. Third-party data may be delayed, incomplete or inaccurate, and an estimate is not a formal valuation or a promise about a sale price, purchase price, lending outcome or market result. You can ask us to correct information that Movely holds. If the issue came from a third-party source, we may need to refer you to that source for the original correction.
Household collaboration and invitations
Information in a shared household is visible to active members of that household according to the application's access model. Owners can manage billing, edit the workspace, invite collaborators and edit tasks. Editors can edit the workspace and tasks. Viewers have read-only access. Owners and authorised members should not invite someone unless they intend to share the household information with them.
Owners send invitations by email through Clerk and Movely's email service. The invitation records the invited address, inviter, requested role, audience, message, status and expiry. Current Clerk invitations are created with a 30-day expiry. A repeated pending invitation for the same household and address is not sent again. An invitation is transactional and is not, by itself, an addition to the waitlist or a marketing subscription. An invitee can ignore an invitation, or use the controls made available by the invitation provider to decline or let it expire.
When membership is removed or an account is deleted, access is revoked through the identity and workspace records. Removing a member does not automatically erase shared Move Board records contributed by that member. Movely does not currently provide a self-service household departure, account deletion or export control in the application. Contact us if you need help with one of these requests or if household members disagree about shared information. We may preserve shared records where another authorised member, a legal obligation, fraud prevention or a dispute requires it.
Provider enquiries
The current reviewed Movely routes do not provide a general provider-enquiry or lead-generation form for agents, lenders, conveyancers, movers, utilities or other service providers. We therefore do not currently disclose household information to a provider for a user-directed enquiry through such a flow. If that feature is introduced, we will explain the information shared, obtain the relevant authorisation and update this policy before sending an enquiry.
Service providers and overseas processing
We use providers that help us deliver Movely. Depending on the feature and configuration, these include Clerk for identity and access, Vercel for hosting and delivery, Neon for database services, Resend for email, Stripe for billing, Sentry for error monitoring, PostHog for product analytics, PropRadar and Domain for property data, and Google Maps Platform for mapping, geocoding and imagery. Providers process information only for their relevant service or as otherwise permitted by law and their applicable terms.
Some providers may process or receive personal information outside Australia. The current configuration makes the United States a likely recipient location for some services, including the configured US PostHog endpoint. Other locations depend on provider account settings, deployment and infrastructure and have not been verified as a fixed list for this release. We use contractual, technical and organisational measures we consider reasonable for the circumstances, but cannot make an absolute security or overseas-processing guarantee.
Security and data breaches
Movely uses Clerk authentication, server-side authorisation and workspace role checks, production tenant isolation requirements, signed webhook verification, access controls, sanitised application logs, monitoring and recovery procedures. These measures are reviewed as the service changes. No online service is completely secure, and we do not claim a security certification or guarantee that an incident cannot occur.
If an eligible data breach occurs, we will notify affected people and regulators where required by Australian law. The OAIC explains the Notifiable Data Breaches scheme at oaic.gov.au. Early access does not reduce Movely's privacy or security obligations.
Retention, deletion and backups
We keep each category of information for as long as reasonably needed for the purpose it was collected, the active account or household relationship, security and abuse prevention, billing, disputes, legal obligations or legitimate operational records. Waitlist, campaign and referral records are kept for waitlist administration, communications, attribution and abuse prevention. Invitation records may remain after a 30-day expiry so that status, security and audit questions can be answered. Account, household, property, financial, renovation and provider-related records are kept while the relevant workspace or service is active and while a legitimate retention reason remains.
We do not currently promise an exact deletion deadline, automatic end-to-end account purge or user-facing export. We handle access, correction and deletion requests manually, verify identity where appropriate and avoid deleting records belonging to other household members. Deleted or revoked records may remain in audit, billing, webhook, security or provider systems for their own operational or legal periods. Recoverable database copies may persist until the applicable provider recovery window expires. We will not retain information longer than reasonably required for the stated purposes or as required by law.
Access, correction and complaints
Write to support@movely.pro to ask for access to, correction of or deletion of personal information, help leaving a household, marketing opt-out, or an explanation of a property estimate. Tell us enough to locate the relevant account or workspace, but do not send passwords, payment credentials or unnecessary property information. We may verify identity, consult other authorised household members, refuse or limit a request where the law permits, and explain the reason.
Privacy complaints should be made in writing with enough information for us to investigate. We will verify identity where appropriate, investigate and generally aim to provide a written response within 30 days. If you are not satisfied after giving us a reasonable opportunity to respond, you can contact the Office of the Australian Information Commissioner.
Children and automated decisions
Movely is intended for homeowners and other adults aged 18 or over and is not directed to children. If a user enters information about a child in a household planning context, that user must be authorised to do so and should provide only what is needed for the planning purpose. Contact us if information about a child was submitted incorrectly.
The reviewed product uses calculations and rules to show planning scenarios, property estimates and renovation feasibility. It does not currently use personal information to make a computer-only decision that significantly affects a person's rights or interests. We will reassess this position as the product changes and update this policy if Australian automated-decision transparency requirements apply.
Legal disclosures and policy changes
We may use or disclose information where required by law, to respond to a valid lawful request, to establish or defend legal rights, prevent fraud, protect safety or security, obtain confidential professional advice, or support a confidential business transaction. Any successor must handle information consistently with applicable privacy obligations.
We may update this policy by publishing a revised version and date. We will provide additional notice for material changes where appropriate, and seek consent or take another required legal step where the law requires it. Minor changes do not create new product or marketing permissions by themselves.
Contact
For privacy requests or questions, contact support@movely.pro. Business and operating enquiries can also be sent through the Movely contact page.