Privacy Policy

Hemma is operated by Hojae Jung (ABN 52 404 425 649) from Sydney, New South Wales, Australia. In this policy, “Hemma”, “we”, “us” and “our” mean Hojae Jung trading as Hemma, the operator of the myhemma.app service. We treat personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we apply those standards even where a small-business exemption might otherwise be available.

1. Who this policy applies to

This policy applies to everyone who uses Hemma — residents and owners, committee members, on-site building managers, and anyone whose details are added to a building’s directory. It covers the Hemma website, the web app at myhemma.app, and the things we do behind the scenes to run the service.

Your building (and any strata or management firm that runs it) may have its own privacy policy covering how they handle your information. This policy only covers what Hemma does.

2. Information we collect

Information you give us

• Account details — your name, email address, and the password you set (passwords are handled by our authentication provider and are never stored by us in readable form).
• Profile details — optional things like a profile photo, phone number, and your unit or apartment number.
• Your building and residency — the building you belong to, your role (resident, committee or building manager), and whether you are an owner-occupier, owner-investor or tenant.
• Content you create — announcements, events, comments, acknowledgements, support requests, documents, listings and messages you post or upload.

Information added by your building

• Directory imports — a building manager or committee may add residents to a building’s directory, including by importing a spreadsheet (for example name, email, unit and phone number) so they can invite people to join.

Information we collect automatically

• Usage information — basic records of how the service is used, such as whether an announcement has been read or acknowledged, and when.
• Technical information — your device type, browser, approximate location derived from your IP address, and log data needed to keep the service secure and working.

We don’t go looking for sensitive information (such as health, religion or political views) and ask that you don’t post it. If you choose to include it in content you create, you consent to us handling it to provide the service.

3. How we use it

We use personal information to:

• create and manage your account and verify who you are;
• run the core features — announcements, events, the directory, acknowledgements and the other tools your building has switched on;
• show the right information to the right people in your building;
• send you service messages, such as invitations, important notices and security alerts;
• give building managers basic, aggregated insights (for example how many residents have read an announcement);
• keep Hemma secure, prevent misuse, and fix problems; and
• meet our legal obligations.

4. When we disclose it

We do not sell your personal information. We disclose it only:

• Within your building — other members of your building see the content you post and, depending on your building’s settings, your directory profile. Building managers and committee members can see directory and usage information for their building.
• To service providers — the trusted companies that help us run Hemma (see below), under contract and only as needed.
• Where the law requires it — for example in response to a valid request from a court, regulator or law-enforcement agency, or to protect someone’s safety.
• In a business transfer — if Hemma is ever involved in a merger, acquisition or sale, your information may be transferred as part of that, subject to this policy.

5. Service providers & overseas storage

Hemma is built on a small number of reputable infrastructure providers, including Supabase (database, authentication and file storage) and Vercel(application hosting). These providers process information on our behalf so we can run the service.

Some of these providers, or their data centres, may be located outside Australia (for example in the United States or other countries). This means your personal information may be stored or processed overseas. We take reasonable steps to ensure our providers handle your information consistently with the Australian Privacy Principles, but the laws of those countries may differ from Australian law.

6. Cookies & analytics

We use cookies and similar technologies that are necessary to sign you in, keep you signed in, and remember basic preferences. We keep tracking to the minimum needed to run and improve the service, and we do not use Hemma to build advertising profiles about you. You can control cookies through your browser, though turning off necessary cookies may stop you from signing in.

7. Communications & marketing

Most messages we send are service messages — invitations, password resets, security notices and product updates relevant to your building. From time to time we may send you optional updates about Hemma. Where the Spam Act 2003 (Cth) applies, any such marketing will identify us and include an easy way to unsubscribe. You can opt out of optional messages at any time without affecting essential service communications.

8. How we protect it

We take reasonable steps to protect personal information from misuse, loss and unauthorised access, including encryption in transit and at rest, and access controls so people only see data for buildings they belong to. You can read more on our Security page. No online service can be guaranteed to be perfectly secure, so we also rely on you to keep your login details safe.

9. How long we keep it

We keep personal information for as long as your account is active and as long as we need it to provide the service, then for a reasonable period afterwards to meet legal, accounting or dispute-resolution needs. When information is no longer needed, we take reasonable steps to delete it or de-identify it. If you ask us to delete your account, we will do so subject to any records we must keep by law.

10. Accessing & correcting your information

Under the Australian Privacy Principles you can ask us for a copy of the personal information we hold about you, and ask us to correct it if it’s wrong or out of date. Much of this you can do yourself in your profile. For anything else, email us at privacy@myhemma.app and we’ll respond within a reasonable time, usually within 30 days.

If you have a privacy concern, please contact us first so we can try to fix it. If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

11. Data breaches

We have processes to detect and respond to data breaches. If a breach occurs that is likely to result in serious harm, we will notify affected individuals and the OAIC as required by the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).

12. Children

Hemma is intended for adults who live in, own or help run a building. It is not directed at children, and we don’t knowingly collect information from anyone under 16 without the involvement of a parent, guardian or building manager.

13. People outside Australia

Hemma is built for Australia first. If you use Hemma from outside Australia, your information will be handled under this policy and Australian law. As Hemma expands, we will add region-specific terms (for example for the GDPR in Europe) where they apply.

14. Changes to this policy

We may update this policy as Hemma grows or the law changes. If we make a material change, we’ll update the date at the top and, where appropriate, let you know in the app. Continuing to use Hemma after a change means you accept the updated policy.

15. How to contact us

For any privacy question or request, email privacy@myhemma.app. For anything else, you can reach us at hello@myhemma.app.