How we handle your information.

What we collect, what we do with it, who else sees it, and what rights you have. Straightforward. No fine print.

Who we are

BuildScore™ is a registered business name

BuildScore™ is the customer-facing trading identity. The underlying legal entity is Audrey’s Collective Pty Ltd (ACN 672 304 880, ABN 53 672 304 880), an Australian private company. BuildScore™ is a registered business name of Audrey’s Collective Pty Ltd. All BuildScore™ orders, reports, and communications are produced by Audrey’s Collective Pty Ltd trading as BuildScore™.

You’ll see BuildScore™ on the website, in your emails, and on your PDF report. You’ll see Audrey’s Collective Pty Ltd on tax invoices and in this Privacy Policy. Your payment is processed by Stripe and will appear on your statement under our payment descriptor.

Information we collect

Only what we need to score your quote or tender

Identity

Your full name and email address, provided at checkout and used to deliver your report.

Build context

State, build type, target budget, ideal start date, your scoring priorities, and any focus notes you add to your submission.

Quote or tender documents

The builder quote or tender PDFs you upload via your private submission link, one per builder.

Payment metadata

Order reference, payment amount, and Stripe transaction ID. We do not see or store your full card number. Stripe handles that directly.

We collect nothing beyond the above to produce your report. We run no advertising pixels and no cross-site behavioural profiling, and we never sell your information. Some operational services do collect limited technical data as they run the site: Vercel Analytics for cookie-less aggregate page metrics, Metricool for aggregate visit and referral metrics, Sentry for error monitoring, and our hosting, edge and rate-limiting providers for standard request data including your IP address. Each one is listed in Third-party processors below with exactly what it receives, and Cookies below sets out what we do and don’t store on your device.

Sensitive information. We don’t ask for sensitive information (such as health, racial, or political information). Please don’t include it in your focus notes or uploads. If sensitive information is inadvertently included in documents you upload, we will not use it for any scoring or business purpose beyond what is strictly necessary to process your submission. If you’re concerned that sensitive information may be contained in your uploaded documents, contact us at reports@buildscore.com.au and we’ll discuss options, including deletion of the document.

How we use your information

One purpose: producing your BuildScore™ Report

We use your name and email to send the order confirmation, submission link, and final report.
We use your build context and uploaded quotes or tenders to score each builder across the five BuildScore™ categories and generate the PDF report.
We do not sell your information to anyone. We do not use it for marketing other products. We do not share it with builders or brokers.
If you receive any follow-up communication from us beyond the report delivery, you opted in to it explicitly. Any marketing email we ever send includes an unsubscribe link, and you can opt out at any time by emailing reports@buildscore.com.au.
Direct marketing. We do not currently send marketing communications beyond transactional emails (order confirmation, submission link, and report delivery). If we introduce marketing communications in the future, we will only contact you if you have explicitly opted in.
Under the Privacy Act 1988 (Cth), you have the right at any time to request that we stop using or disclosing your personal information for direct marketing purposes. That request will be actioned free of charge within a reasonable period. You may also request us to identify the source of personal information we hold about you that is used for direct marketing purposes. To exercise either right, email reports@buildscore.com.au.

Anonymity and pseudonymity

Your option to interact without identifying yourself

Under APP 2 of the Privacy Act 1988 (Cth), individuals have the right to deal with an APP entity anonymously or under a pseudonym where it is lawful and practicable to do so.

Where anonymous or pseudonymous interaction is available. You may contact us with general enquiries, feedback, or complaints without providing your name or identifying yourself. Email reports@buildscore.com.au and you are not required to identify yourself unless you want us to respond to a specific order or access your personal information.

Where identification is required. Purchasing and receiving a BuildScore™ Report requires us to identify you. We need your name and email address to process your payment through Stripe, send you your private submission link, deliver your completed report, and respond to any request you make about your order.

It is not practicable for us to deliver the core service to an unidentified individual. This is not a policy choice. It is an operational requirement of a personalised, delivered report service. We collect only the minimum information necessary for that purpose.

Information we did not ask for

Unsolicited information and government identifiers

Unsolicited personal information. Occasionally we may receive personal information that we did not solicit. That can happen if someone emails us information about a third party, or if a document you upload contains personal information about individuals other than yourself, such as a builder’s employees or subcontractors named in a quote or tender.

If we receive unsolicited personal information, we will promptly assess whether we could have collected that information under APP 3 (collection of solicited personal information). If we could not have collected it lawfully, we will destroy or de-identify it as soon as practicable, provided it is lawful and reasonable to do so.

If the unsolicited information is contained within a document you have uploaded as part of your order, we will treat it as incidental to your submission. We will not use it for any purpose beyond processing your order, and we will handle it in accordance with this Privacy Policy.

Government-related identifiers. BuildScore™ does not collect, use, or disclose government-related identifiers such as Tax File Numbers (TFNs), Medicare numbers, or other identifiers assigned by Australian government agencies. Please do not include government-related identifiers in your focus notes or uploaded documents. If such information is inadvertently included in a document you upload, we will not use it for any scoring or business purpose, and we will handle it as unsolicited personal information above.

Storage and security

Encrypted at rest. Encrypted in transit. Core records in Sydney.

At rest. Your uploaded quote or tender PDFs are encrypted using AWS S3 server-side encryption. Order records in the Neon PostgreSQL database are encrypted at rest by the provider.
In transit. All requests to buildscore.com.au and its APIs use HTTPS / TLS. Builder quote or tender uploads go directly from your browser to S3 via short-lived presigned URLs.
Access. Only our two administrators can access customer records or uploaded documents via the admin dashboard. No public signup, no shared accounts.
You can also open your own order through the private submission link we email you. It opens that order without a login: it stays open for uploads until you submit, and after that it shows your order status. The link closes 30 days after your report is delivered. Because it needs no password, treat that link as private and don’t forward it.
Retention. We retain order records and uploaded quotes or tenders for seven years to meet Australian tax and audit requirements. You can request earlier deletion (see Your rights below). At the end of the seven-year period we securely delete or de-identify your records.
Your core customer records and uploaded quote or tender documents are stored in Australia: our orders database and file storage both run in the Sydney region. Some of our service providers process limited data overseas as part of delivering their service: in the United States (Stripe, AI tooling, Sentry, Resend, Upstash, Vercel, Google, Cloudflare) and in the European Union (Metricool, Pipedrive). Each is listed in Third-party processors below with exactly what it receives, and AI tooling is covered in AI assistance below.
If a data breach involving your personal information is likely to result in serious harm, we will notify you and the OAIC as required by the Notifiable Data Breaches scheme. No method of transmission or storage is completely secure, but we work to industry standard practices and collect only what we need.

Privacy by design

Built in from the ground up, not bolted on

We embed privacy protections into BuildScore™ from the ground up rather than treating them as an afterthought. In practice this means:

Data minimisation

We collect only the personal information that is strictly necessary to produce your report.

Isolated storage

Uploaded quote and tender documents are stored in an isolated, encrypted environment accessible only to our administrators.

No shared credentials

Your submission link is order-specific and private, with no shared login credentials.

No tracking

We run no advertising pixels, no cross-site tracking, and no behavioural profiling.

Cookie-less by preference

Cookie-less analytics tools are used in preference to cookie-based alternatives wherever practicable.

AI tool selection

AI tools used in report preparation are selected on the basis that they operate under zero-data-retention arrangements and do not train on customer data. See AI assistance below.

We review our privacy practices when we introduce new features or processors, and we update this policy to reflect any material changes.

Third-party processors

Who else touches your data

We use the following processors to run BuildScore™. Each receives only the data they need to do their job, governed by their own privacy and security commitments.

Where we disclose your personal information to service providers located overseas, Audrey’s Collective Pty Ltd takes reasonable steps to ensure those recipients handle your information in a manner consistent with the Australian Privacy Principles. Under s 16C of the Privacy Act 1988 (Cth), Audrey’s Collective Pty Ltd remains accountable for the handling of your personal information by those overseas recipients.

Stripe

Your name, email, payment details, and transaction amount when you purchase a report. Stripe handles payment authorisation and settlement.

AWS S3

The builder quote or tender PDFs you upload, stored in Sydney region (ap-southeast-2). Files are encrypted at rest using server-side encryption.

Neon (PostgreSQL)

Order and submission records: your name, email, build context, scoring data, and pointers to your uploaded files. Encrypted at rest and in transit.

Resend

Your email address and the contents of order confirmation, submission, and report-delivery emails sent on our behalf.

Google Workspace (Gmail)

Hosts our reports@buildscore.com.au mailbox. Any email you send us, whether an enquiry, a refund request, or a privacy request, and copies of the emails we send you are stored in that mailbox. Google does not receive your uploaded quote or tender documents unless you attach them to an email yourself.

Vercel

Web hosting, including standard server logs (IP address, user agent, request path) generated when you visit buildscore.com.au.

Cloudflare

Our DNS and edge provider. Cloudflare answers the domain lookup for buildscore.com.au. Where traffic is routed through Cloudflare's network, it also sees your IP address and standard request metadata (the page requested, browser and device type) as it routes and protects each request.

Vercel Analytics

Aggregate page metrics for buildscore.com.au: page path, referrer, country, device type and browser. No cookies, no cross-site tracking, and no profile of you as an individual.

Metricool

Two things. A small tracking script runs on every page and sends aggregate visit metrics for buildscore.com.au: pages viewed, the referring site or social platform, country, and device and browser type. Separately, we use Metricool to manage our social accounts (Instagram, Facebook, TikTok), which means it handles public interactions such as comments, messages sent to those accounts, and engagement metrics. It receives no customer order data: no names, no email addresses, no uploaded quotes or tenders, and no report contents. It sets no cookie, builds no advertising profile of you, and nothing is sold on.

Sentry

Error and performance diagnostics when something breaks: the error, the page it happened on, browser and device details, and the trail of actions leading up to it. Configured not to send personal information, with secret-shaped values scrubbed before an event leaves us. Screen recording is captured only when an error occurs, never as ambient monitoring, and all on-screen text is masked.

Upstash

Your IP address and request timing, used only for rate limiting: throttling repeated requests to protect our forms and admin login from abuse. Currently hosted in the United States, with a planned migration to Sydney after launch.

Pipedrive

Your name, email, order reference, and build context, held in our customer record system so we can track your order from purchase through to report delivery.

AI assistance

How we use AI tools and what this means for your information

Your uploaded quotes and tenders are compared and scored by our team. The BuildScore™ website and ordering system carry no automated AI processing: the application itself sends nothing you upload to an AI service.

Where our team uses AI tools to help prepare your report, we choose tools that do not train on your information and that operate under zero-data-retention arrangements, so your documents are not kept by the tool once the work is done. Your report is always reviewed and finalised by a person. Scoring decisions are made by our team, not by a computer program.

AI tools may substantially support that work by extracting and organising information from your documents and pre-populating submission input fields; the kinds of personal information involved are those described in Information we collect above. All AI-pre-filled or AI-extracted values are reviewed, verified, and where necessary corrected by a member of our team before any scoring or report generation proceeds.

AI training data. We do not use your personal information to train, fine-tune, or improve any AI model, whether operated by us or by a third party. The AI tools we use are selected specifically on the basis that they do not retain or train on customer data. This is consistent with the OAIC’s guidance that publicly available or customer-provided data cannot be used for AI training purposes without consent or a disclosed secondary purpose.

Opt-out for AI-assisted processing. If you would prefer that AI tools not be used in the preparation of your report, you may request a fully manual review by emailing reports@buildscore.com.au before submitting your quotes or tenders. We will confirm whether a manual-only option is available for your order and any implications for turnaround time. This opt-out does not affect your right to receive a report.

Automated decision-making disclosure

Privacy Act 1988 (Cth), APP 1.7 to 1.8. The Privacy Act requires APP entities to disclose in their privacy policy how computer programs are used in decisions that may significantly affect an individual’s rights or interests. This obligation takes effect 10 December 2026. We are including this disclosure now in the interests of transparency.

Kinds of personal information used

Uploaded builder quote and tender documents; build context information you provide (state, build type, target budget, ideal start date, scoring priorities, and focus notes); your name and email address.

Decisions made solely by a computer program

None. No aspect of your BuildScore™ report or score is generated or decided by a computer program operating alone.

Where a computer program does something substantially and directly related to a decision

AI assistance tools may be used by our team to extract and organise information from your uploaded documents and to pre-populate submission input fields that feed into the scoring process. This assistance is preparatory only. All extracted or pre-filled values are reviewed, verified, and corrected by a member of our team before scoring takes place. The final report and all scoring decisions are made by our team.

Solely automated decisions

No decision about you is made solely by automated means.

The cookies we set, and the ones we don’t

When you first arrive we set one small cookie on our own site, named bs_attr. It records how you found us: the campaign tag in the link you followed, the site that referred you, and the first page you landed on. It holds no name, no email and nothing that identifies you, it is only ever read on buildscore.com.au, and it is never shared with another site. It keeps your first visit only, so a later visit never overwrites it, and it expires after 90 days.
You will not see a cookie banner. Australian privacy law does not require consent for a first-party cookie like that one, and we set no advertising or cross-site cookies that would call for one. You can clear or block it in your browser at any time and the site works exactly the same.
Your payment is taken on Stripe’s own checkout page. Stripe sets its own cookies there, on Stripe’s domain and under Stripe’s privacy notice, to run the payment and detect fraud. We don’t control or read them.
The only other cookies we set are the essential sign-in cookies for our two administrators when they sign in to the admin dashboard. They keep those administrators signed in for that session, and they are never set on a customer visit.
We run no advertising cookies, no cross-site tracking cookies, and no third-party marketing tags.
Our page-visit counting is separate from that cookie and sets none of its own. Vercel Analytics uses no cookie, and the Metricool script that counts page visits sets no cookie either.
Our error monitoring keeps a short diagnostic identifier in your browser’s session storage rather than in a cookie. Your browser clears it when you close the tab.

Your rights

Access. Correction. Deletion. Direct marketing opt-out. Complaint.

Under the Privacy Act 1988 (Cth), you have the right to access the personal information we hold about you (APP 12), ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant, or misleading (APP 13), ask us to delete it (subject to the seven-year tax retention obligation noted above), opt out of direct marketing at any time free of charge, and lodge a complaint about how we have handled your personal information.

How to exercise your rights. Email reports@buildscore.com.au. We’ll acknowledge your request within 2 business days and respond within 30 days. We may need to verify your identity before actioning a request. There’s normally no charge.

Access requests (APP 12). We will give you access to the personal information we hold about you unless an exception under APP 12 applies, for example where giving access would unreasonably impact the privacy of another individual, or where we are required by law to refuse. If we refuse access, we will tell you why in writing and advise you of any available complaint mechanisms.

Correction requests (APP 13). If you believe personal information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, you may ask us to correct it. We will take reasonable steps to correct the information within 30 days. If we do not agree that a correction is warranted, we will tell you why and note your request alongside the relevant record.

No charge for access or correction. We do not charge a fee for access or correction requests. If a request is unusually complex or voluminous, we will discuss this with you before proceeding.

Complaints

If we’ve got it wrong, tell us

If you’re unhappy with how we’ve handled your personal information, email reports@buildscore.com.au first. We’ll acknowledge your complaint within 2 business days and respond fully within 30 days.

If you’re not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. The OAIC is Australia’s independent national regulator for privacy and freedom of information. There is no charge to lodge a complaint with the OAIC.

We acknowledge everything within 2 business days. After that, different requests run on different clocks: refund requests within 5 business days, general complaints within 10 business days, and privacy requests or privacy complaints within 30 days. If one message covers more than one of these, we’ll acknowledge it once and tell you which timeframe applies to each part. See our Refund Policy and Terms of Service.

Contact

Questions about this policy?

Email reports@buildscore.com.au, the same inbox that delivers your report.

This Privacy Policy was last updated on 6 August 2026. We’ll post the date of any future change at the top of the page.

BuildScore™ is a registered business name of Audrey’s Collective Pty Ltd (ACN 672 304 880, ABN 53 672 304 880).

← Back to BuildScore™