Privacy Policy

1. Who we are, and who this policy covers (APP 1)

Llord is a software tool for Queensland landlords who manage their own rentals. This policy covers everyone whose information passes through it.

Llord is operated by Delon Leung trading as Cohdit (ABN 35 532 639 253), based in Queensland, Australia (“we”, “us”). It covers landlords who use Llord; tenants whose landlord uses Llord — you never sign up, your landlord sends you a link or you email a repair to your property's Llord address; tradespeople who register to quote for work; and anyone visiting llord.ai.

Cohdit may currently fall under the annual-turnover threshold at which the small-business exemption in the Privacy Act 1988 can apply. We do not rely on that exemption. We handle personal information in accordance with the Australian Privacy Principles whether or not the exemption is available to us, and we will keep doing so.

2. What we collect, and how we get it (APP 3, APP 5)

What a tool needs to do the job you asked it to do — nothing for its own sake.

If you are a landlord

You give us: your email address, to sign you in and send your documents; the property's address and features; the current rent, when it last went up and the tenancy type; your name, address and typed signature when you prepare a notice or an agreement; lease details you enter, or a lease you upload for the AI to read — including any emergency contact and bank account details the lease document contains; repair descriptions and photos, whichever of you or your tenant supplies them; and your consent choices, with when you made them and from which device.

If you are a tenant

Your landlord gives us your name and email address so we can send you a notice or an agreement. You give us information directly:

• Tenant-facing pages: tenants give us information directly on four pages, each reached by a private link we email to them — the maintenance request form (name, phone, optional email, what is wrong and when they are home, including anything typed into the AI triage chat), the scheduling page (the times they choose and any access note), the sign-off page (whether the job was done properly, and any note), and the tenant lease portal (whether they accept, counter or decline a renewal, any rent they propose or changes they ask for, their notes, and the name they type as their signature).
• Inbound tenant maintenance email: when a landlord turns on AI Triage for a property, tenants can email that property's unique llord.ai maintenance address. We store the sender address, subject, and message content — encrypted (see section 6) — for up to 12 months, only when the sender matches a tenant on an active lease for that property.

If you are a tradesperson

You give us your business name, contact name, email address, phone number, ABN, trades and service postcodes; optionally your website, licence number, insurance details and the price lists or documents you upload to set up quoting; and the quotes you give. Card payments go straight to Stripe — we never see card numbers.

If you are visiting the site

Your browser tells us the pages you visit and general device and location details (website analytics — section 10), and we keep the answers you type into a tool before you sign in, so you can pick up where you left off.

Waitlist and feedback. If you join a waitlist for a state we don't yet support, register for early access, or use the early-access feedback form, we collect your name, email and what you tell us. A waitlist signup is stored against your email; feedback form submissions are emailed straight to our support inbox and are not otherwise stored.

We do not knowingly collect personal information from anyone under 18. We do not collect sensitive information (such as health or religious information) unless someone chooses to type it into a free-text field, in which case it is stored under the same controls as everything else. If you choose not to give us something a tool needs, that tool can't do that step — for example, without an email address we can't email a notice for you.

3. What we use it for — and what we don't (APP 6, APP 7)

To run the tools you use. We don't sell it, and we don't use it to decide anything about your tenancy.

• Generate statutory rent-increase notices and new tenancy agreements based on details you supply, and send them when you click Send. We do not send automated follow-ups or reminders about these documents.
• Estimate market rent using publicly available bond data (RTA) plus AI fallback when no live data exists.
• Assess repair requests, find matching tradespeople when you ask for quotes, and help arrange the work. We also match a tradesperson when you open a repair request before asking for quotes, to show you a preview estimate from that tradesperson's AI quoting assistant — only tradespeople who have chosen to offer previews, and no tradesperson is contacted at that stage. We match by a fixed postcode/area/state ladder; if the tradesperson we pick doesn't respond in time, we automatically try the next match on that same ladder — you don't need to ask again.
• Release tenant details to a tradesperson. A tradesperson sees the fault description (with any email address or phone number typed into it masked), the suburb and the times the tenant is home; they get the tenant's name, contact details and the property address only after the landlord approves the job and the tradesperson pays Llord's lead fee for it. Photos of the fault — including photos a tenant emails in, and photos a landlord uploads themselves — go to the tradespeople the landlord asks for quotes, and to our AI when it assesses the request.
• AI Triage. For properties where AI Triage is on, our AI reads a tenant's maintenance email and triages and summarises it for the landlord. It does not reply to the tenant: AI-written replies to tenants are currently switched off while we get legal advice. A tenant whose message may report an emergency — flagged by our emergency check or by the AI — still gets our fixed safety instructions; the AI never writes them.
• Tradesperson track record. We compute a tradesperson's on-time, completion and satisfaction rates from real job outcomes (bookings, completions, exits) across every landlord who has used them, and show that track record to other landlords choosing a tradesperson.
• Sign you in, send you the emails a tool needs to send, and keep the records the law and these tools require.
• Find and fix problems, and improve the service using figures that don't identify anyone.

We don't sell personal information, rent it out, or use it for advertising profiles, and Llord never decides anything about a tenancy — the landlord does.

What we are paid for an introduction. Llord is free for landlords. When you accept a tradesperson's quote for a job we introduced, that tradesperson pays Llord 15% of the accepted job price (minimum $5, maximum $150, including GST). You are never charged it. It does mean we have a financial interest in the introduction, so we tell you every time you are choosing a tradesperson.

Secondary use — anonymised market data. We do not sell a market-data product today, and there is no customer for one. The third consent toggle on the Your data page exists so that, if we ever build one, we already have your position on it. Default is off; we never opt you in, and we will tell you before any such product starts using your records. If — and only if — you turn it on, your records may be passed through our de-identification process: it removes landlord and tenant names, the exact street address and any other direct identifier, disguises the remaining details that could point to someone, and refuses to produce any figure drawn from fewer than 5 records. Withdrawing the consent stops new aggregates including your data from the moment you save the change.

4. Llord's AI (APP 6, APP 8)

The AI reads information on Australian servers, almost always on a basis we record.

The AI runs in Australia. When you use AI features (rent reports, lease drafts, maintenance triage, vendor proposals), the relevant text — and, for properties where the landlord has turned on AI Triage with photo consent, tenant-submitted maintenance photos, plus any maintenance photos the landlord uploads themselves — is read by Anthropic's Claude model running on Amazon Web Services in Sydney and Melbourne (the ap-southeast-2 region), the same region where your account records are stored; Amazon Bedrock's routing decides which of the two cities actually serves a given call. The model is called through Amazon Bedrock, so prompts go to Amazon Web Services rather than to Anthropic's own API. Until 3 September 2026 this step ran on Anthropic's servers in the United States; it no longer does.

When the AI runs

• Your requests and drafts — only after you agree to AI processing, which we record with the wording you saw and when. You can withdraw on the Your data page at any time; AI-powered features stop running until you turn it back on, but you can still write a notice, lease email or repair note by hand, and a tenant's request is still saved for you to review.
• Repair requests your tenants send — only if their landlord has agreed. If not, the request is still saved for the landlord, and an emergency still gets the safety instructions.
• A tradesperson's own price lists, documents or website — when they choose to give them to us, to set up their quoting. This also covers vendors who set up their AI quoting assistant by uploading price lists, rate cards, documents, or website content — that material is read in Australia for text extraction and config synthesis, and we keep the extracted text (up to 50KB per document) and the filename, not the original file. When a tradesperson registers, the AI also reads the website address or document they give us to suggest their services and service area, and can polish the wording of a quote they write. For these three tradesperson-only features we do not yet record a formal consent basis the way we do for a landlord's or tenant's information — a tradesperson registering or using the tool is treated as having agreed by doing so, and we are working on the same recorded-basis treatment for this too.
• Area-level market-rent estimates — when published data is thin, the AI is sent the suburb, property type and number of bedrooms only, which identifies no one.

Inbound tenant maintenance emails are AI-processed only for properties where the landlord has switched on AI Triage (formerly overnight maintenance triage) and recorded the per-property consent (which names where the AI runs and includes the landlord's warranty that routed content is lawfully obtained). For properties without that consent, inbound messages are stored — encrypted, under section 6 — but are never sent to the AI provider.

What the AI is sent, and what we keep

Every prompt we send to Claude routes through a single internal gateway to Amazon Bedrock on Amazon Web Services. Before a prompt leaves our servers:

• Kept to what the feature needs. Email addresses and phone numbers typed into repair descriptions, tenant chat and quote requests are masked. Renewal-email prompts carry the names needed to address and sign the email, but never your tenants' email addresses or phone numbers — they are not put in the prompt, and a safety filter replaces any that slip in with a placeholder. Names typed into free text are not masked, and an uploaded lease is sent whole — we tell you that before you upload one.
• What we record. When an AI call can be tied to a verified landlord or vendor account, we record a one-way fingerprint of the (minimised) prompt, the time, which feature and AI model made the call, what was masked, and a coded reference to the account (not its email address) — never the prompt text itself. This includes a call that fails: one that errors, times out or is aborted before it completes still gets its audit row, marked as failed, because the prompt had already been sent by then. A call made with no identified account may not produce an audit row. You can see a 7-day summary of AI calls made on your behalf at Your data under “AI services.”
• Retention at Amazon Web Services. Prompts are sent to Amazon Bedrock (Amazon Web Services, Sydney and Melbourne). No zero-data-retention arrangement exists yet — see Amazon Bedrock data protection.

What the AI produces is general information, not legal or financial advice, and it can be wrong. Llord shows it to you to review; it never acts on it by itself.

5. Who else receives it, and where (APP 8 — cross-border disclosure)

These are all the outside services that handle personal information for us.

• Amazon Web Services · Storage, encryption and the AI

  Where: Sydney and Melbourne, Australia

  Receives: All stored records and photos (including landlord- and tenant-uploaded maintenance photos), and the text and photos Llord's AI reads (Anthropic's Claude, run by Amazon Bedrock).

• Vercel · Hosting

  Where: Our servers run in Sydney; Vercel's network routes each request through its nearest location

  Receives: Every request to llord.ai while it is being processed (including in our edge middleware), and the platform logs of those requests.

• Resend · Email delivery

  Where: Stored in the United States; email is sent and received through Tokyo, Japan

  Receives: Email addresses and the content of the emails we send and receive, including attachments.

• Microsoft 365 · Our support mailbox

  Where: We have not confirmed where Microsoft routes this mailbox's data

  Receives: Emails sent to our support address, including anything a landlord, tenant or tradesperson writes to us there.

• Stripe · Payments

  Where: United States

  Receives: Tradespeople's card payments, plus the device and browser details Stripe's own payment form collects for fraud prevention. Llord never receives card numbers.

• Google Analytics · Website analytics

  Where: United States

  Receives: The pages you visit on llord.ai and the general location and device your browser reports.

• Google Places and Google Maps · Address lookup and maps

  Where: United States

  Receives: The address text you type, so it can suggest matches, and the postcodes shown on the tradesperson coverage map — each with your browser's IP address.

• OpenStreetMap (Nominatim) · Address lookup

  Where: European Union and United States

  Receives: The address text you type, when Google's address lookup is unavailable, with your browser's IP address.

• Firecrawl · Reading a tradesperson's website

  Where: United States

  Receives: A tradesperson's website address, so its pages can be read to set up quoting.

• SQM Research · Public market-rent figures

  Where: We have not confirmed where their servers are

  Receives: A property's postcode — no names or contact details.

Some other processing does still happen outside Australia, and a few details are worth spelling out:

• Our servers run in Sydney. Vercel's network passes each request through its nearest location on the way to them, so a visitor overseas is routed through a Vercel location near them.
• New maintenance photos a landlord uploads are stored in Amazon Web Services' Sydney region (ap-southeast-2), encrypted at rest, and expire automatically after 365 days. They are not stored on Vercel Blob, and removing one from a request deletes the stored file immediately rather than waiting for that expiry. Photos a tenant attaches to a maintenance email are stored the same way — Sydney, encrypted, not Vercel Blob — but have no individual-removal path today; they are retained until that same 365-day expiry. Photos uploaded before we moved to this storage are still hosted on Vercel Blob's public network and have not yet been migrated across.
• When you type into a property-address field, only the address text is sent for lookup, along with the technical details any browser sends, such as its IP address — never your name or email.
• Firecrawl receives the web address and no other personal information.
• The tradesperson coverage map uses the Google Maps JavaScript API, which runs in the browser and receives the postcodes being looked up, along with the technical details any browser sends with a request, such as its IP address.
• Rent-data lookups carry a property's postcode and our server's IP address, and no name or contact details; we have not confirmed where those sites' servers are located.
• Google Analytics 4 (United States) receives the pages you visit on llord.ai and the general location and device your browser reports. It does not run on this page or on our Terms page.

Other people in the same job see what they need: the landlord sees a tenant's repair request; a tradesperson sees what section 3 describes; a tenant sees the tradesperson's business name. Our own admin staff can look up a landlord's account for support and operational purposes; those lookups are recorded, and any that open the protected details in section 6 appear in the access record section 6 describes. Otherwise we disclose personal information only where the law requires it. We take reasonable steps to ensure each service above handles personal information consistently with the Australian Privacy Principles.

6. How we protect it (APP 11)

Encrypted in storage and in transit, with the most sensitive details locked down further and our reads of them logged.

• HTTPS for all traffic; HSTS preload.
• All our database records are encrypted at rest (Amazon Web Services' default DynamoDB encryption).
• Field-level KMS envelope encryption, on top of that, for your email in your account, property, lease and maintenance records, your own address as you enter it for a notice or agreement, your tenants' names captured through our Lease Renewal tool, and your tenants' emails captured through our Lease Renewal tool. Each record is sealed with its own data keys, under an AWS KMS key in ap-southeast-2 (Sydney).
• Some records hold your email without that extra layer, though still encrypted at rest: the waitlist and early-access list, your consent records, feature votes, and your autopilot settings.
• Tenants' maintenance emails (sender, subject and text) are field-level encrypted the same way.
• Our reads are logged. Each time our systems decrypt one of your field-level encrypted details — to send you an email, generate a PDF or show a dashboard — we record when, which fields and, where we can tell, which part of Llord did it, in a separate record. You can see the last 30 days (up to 200 entries) at Your data under “Where we accessed your data.” Reads of the records without the extra layer are not in that log.
• Analytics never see those details. Usage counts are kept in a separate analytics table that holds no names, email addresses or street addresses — only coded references, made with a different secret from the one our day-to-day records use.
• Sign-in codes are short-lived and single-use, sign-in cookies can't be read by page scripts, and almost every public entry point is rate-limited.
• Our application logs record reference numbers and event types, not names, email addresses or street addresses. Rent lookups log the suburb and postcode.

No system is bulletproof. If we discover a data breach affecting your information we will notify you and the OAIC consistent with the Notifiable Data Breaches scheme.

7. How long we keep it (APP 11.2)

Only as long as there's a reason to — and we tell you plainly where nothing deletes it automatically yet.

• Maintenance requests are retained for 12 months after they are closed — completed, cancelled or declined — then automatically deleted. A request that is never closed, and the quotes given on a request, are kept until you ask us to delete them.
• Inbound tenant maintenance emails are retained for 12 months from receipt, then automatically deleted.
• Maintenance photos are kept for 365 days (section 5).
• Consent records, audit records and records of notices and agreements sent are retained for at least 7 years, because they may be needed as evidence.
• Wizard sessions and the other records you create have no automatic deletion date — we keep them until you ask us to delete them (section 8).
• A tradesperson's registration, documents and quoting configuration have no automatic deletion date — we keep them until they ask us to delete them.
• Records of your access, correction or deletion requests are kept for at least 7 years, for the same evidence reason as consent records.
• Figures that no longer identify anyone are kept indefinitely, as they are not personal information.

8. Your choices and rights (APP 12, APP 13)

See it, correct it, delete it, or withdraw a consent — a person handles every request within 30 days.

If you are a landlord, the Your data page shows your consent choices, where we have accessed your protected details, and a summary of AI activity. You can change or withdraw a consent there at any time, and ask for a copy of your information, a correction, or deletion. You can also correct anything you entered from the tool you entered it in.

If you are a tenant, that dashboard is not yours — it belongs to the landlord who holds the account. Email support@llord.ai to ask us for a copy or a correction of your information, or to make a privacy complaint. That is the same address as the collection notice on the pages we send you.

If you are a tradesperson, email support@llord.ai for a copy, a correction or deletion of your information.

A person reads every request and responds within 30 days. We may ask you to confirm who you are first. We will delete what you ask us to unless the law requires us to keep a specific record — for example, a notice that has been sent — and if so we will tell you what we kept and why.

9. Email and marketing (APP 7, Spam Act 2003)

Service emails when a tool needs them; marketing only if you ticked the box.

Emails that deliver what you asked for — a notice, a sign-in code, a scheduling link — are service emails and carry no marketing. We send marketing email only to people who ticked the separate, unticked-by-default box for it. Every marketing email identifies us and carries a one-click unsubscribe link, and one click stops all marketing to that address immediately — we do not wait, and you never need to ask twice. We do not sell your email address or share it with anyone for their marketing.

10. Cookies and similar technology

A few cookies to keep you signed in and remember where you are, and website analytics.

Llord uses a httpOnly session cookie to maintain wizard state across pages. We use Google Analytics 4 to understand how people move through the site; it is operated by Google in the United States and sets its own cookies — see section 5. We do not sell your information to advertisers. Analytics do not run on this page or on our Terms page.

• Session — keeps your progress through a tool (30 days).
• Tradesperson sign-in — keeps a tradesperson signed in (7 days).
• Early access — remembers that you entered an early-access code (30 days).
• Test version — which version of a page you were shown, so it stays the same (30 days).
• In your browser only — the address you are working on and where you came from, for the current tab; and which features you voted for.

11. Complaints

Tell us first; if we don't resolve it, you can go to the OAIC.

If you believe we have breached the Australian Privacy Principles, please contact us first at support@llord.ai. We will acknowledge within 7 days and respond substantively within 30. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

12. Changes to this policy

Each change is a new numbered version; for a significant one, we ask you to acknowledge it.

We publish each change here as a new version, shown at the top of this page. When you verify your email address, we record which version you acknowledged. For a significant change, we ask you to acknowledge the new version before you next send a notice, an agreement or a request to a tradesperson through Llord.

13. Contact

Privacy questions, corrections or deletion requests:

Delon Leung trading as Cohdit (ABN 35 532 639 253), Queensland, Australia
support@llord.ai