Privacy Policy

How Vistra collects, uses, stores, and protects your personal information.

Last updated: 12 October 2026

1. Who we are

Vistra is a field reporting and inspection platform. It helps tradies and inspection businesses capture photos and notes on site, build reports, and share them with their own clients and teams. Vistra is operated by Shining Technologies. In this policy, “Vistra”, “we”, “us” and “our” mean Shining Technologies.

This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you use our website, apps and related services (“Services”). We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Privacy questions, requests and complaints can go to privacy@vistra.report.

By using Vistra you acknowledge that you have read this policy.

2. Information we collect

We collect information necessary to provide, maintain, and improve our Services. The types of information we collect include:

2.1 Account information

When you create an account, we may collect:

  • Full name
  • Business name
  • Email address
  • Phone number
  • Password credentials
  • Account preferences
  • Subscription information
  • Billing details

2.2 Business information

Depending on how you use Vistra, we may collect:

  • Company details
  • Team member information
  • Project information
  • Client information entered by users
  • Inspection details
  • Property or site information
  • Report information

2.3 Uploaded content

Users may upload content including:

  • Photos
  • Documents
  • Inspection notes
  • Checklists
  • Measurements
  • Annotations
  • Comments
  • Reports
  • Attachments

Users remain responsible for ensuring they have appropriate rights and permissions to upload this information.

2.4 Your clients’ information

Many of our customers add information about their own clients to Vistra, such as a client’s name, a site address, contact details, or photos taken at a property. For that information:

  • The customer decides what to collect and is responsible for having a proper reason to collect it and for telling their clients about it.
  • We handle it only to provide the Services to that customer, on their behalf. We do not use it for our own purposes.
  • If one of your clients asks us about their information, we may refer them to you, and we will help you respond where we reasonably can.

Our Data Processing Addendum sets this out in more detail.

2.5 Photo capture details, location and device information

Photos taken with the Vistra app camera are stamped and recorded with details that help show when and where a photo was taken. This matters when a report may be relied on later, for example in a dispute about the condition of a property. The details are:

  • The date, time and timezone of capture
  • GPS coordinates, if you have allowed the app to use your location. Location access is optional and a photo is still captured without it.
  • The make, model and operating system version of the device, and a device fingerprint (an identifier for that phone or tablet)
  • A digital fingerprint (a SHA-256 hash) of the image file, used to detect later changes

The time stamp, and the GPS coordinates when available, are printed onto the photo and appear in exported reports. Photos added from your gallery are not stamped, but are recorded as unverified imports with a file fingerprint. You can turn location access off at any time in your device settings. Because location is personal information, think about who you share a report with before you send it.

2.6 Technical information

When you use our Services, we may automatically collect:

  • IP address
  • Browser type
  • Device information
  • Operating system
  • The version of the Vistra app installed on your device, so we can support you and tell you when an update is required
  • Usage activity
  • Login history

2.7 Crash and performance data

The Vistra app can send crash reports and performance measurements (for example how long a screen takes to load, or that a report failed to save) to our diagnostics provider (Google Firebase Crashlytics and Performance Monitoring). This is off by default and is only enabled for a signed-in account after you agree to it in the app. You can withdraw that consent in the app’s settings at any time. Diagnostics data contains device and app details and technical error information; it does not contain your report content or photos.

2.8 Push notification token

When you sign in to the Vistra app and allow notifications, a device notification token is stored against your account so we can deliver notifications to that device. The token is removed when you sign out.

2.9 Payment information

Payments are processed by our payment provider, Stripe, or through the Apple App Store or Google Play if you subscribe in the app. We do not store complete payment card numbers. Payment providers handle card details under their own privacy policies.

2.10 How we collect personal information

We collect personal information:

  • directly from you, when you sign up, use the app, upload content, contact us or change your settings;
  • automatically, from your device and your use of the Services (see sections 2.5 to 2.8);
  • from other people who use Vistra, for example a customer who adds your details as their client, or a team member who invites you to a business; and
  • from our payment providers, which tell us whether a payment succeeded.

We use it for the purposes in section 3, and we only collect what we need for them.

2.11 If you do not give us information

You need to give us an email address and the basic account details we ask for, or we cannot create your account. Location access, notifications, crash reports, AI features and product news are all optional. If you turn them off, Vistra still works, but photos will not carry GPS coordinates, you will not get push notifications, and AI suggestions will not be available.

3. How we use information

We use collected information to:

  • Provide and operate Vistra Services
  • Create and manage user accounts
  • Generate inspection reports
  • Store and organise uploaded content
  • Provide AI-assisted features, if you choose to use them
  • Improve platform performance
  • Provide customer support
  • Process payments
  • Communicate important service updates
  • Send notifications about activity on your reports (see section 4)
  • Detect fraud, abuse, and security issues
  • Develop and improve the Services

4. Notifications and marketing

We send two kinds of message, and treat them differently:

  • Service messages, such as a comment on a report you share, a report shared with you, a team invitation, a scheduled visit reminder, a receipt, or a notice about your subscription. These are part of providing the Services. In the app they arrive as push notifications once you allow notifications on your device. You can turn them off in the app’s settings or in your device settings.
  • Product news and offers, which are occasional tips, feature announcements and offers. We only send these if you have opted in. The “Product news & offers” setting is off by default and is turned on only by you, in the app’s settings or in your account settings on the web. Every marketing email has an unsubscribe link, and we honour unsubscribes within 5 business days (usually straight away), as the Spam Act 2003 requires. You can also opt out in the same place you opted in.

We do not sell your information, and we do not send marketing on behalf of anyone else.

5. AI features

Vistra includes AI-assisted features that can help you write descriptions, tidy up report wording, and organise information. They are optional. Your content is only sent to an AI provider when you use one of these features.

When you use an AI feature, the content needed for that request (for example a photo or your notes) is sent to our AI provider to produce a suggestion. The providers are named in section 7.

  • AI gives suggestions only. A person reviews, edits and approves the wording before a report is sent to a client or anyone else.
  • We do not use AI to make automated decisions that significantly affect individuals, such as decisions about whether someone gets a service, a job, credit or insurance.
  • AI output can be wrong. You remain responsible for the contents of your reports. Vistra does not replace professional inspection judgement.

See our AI Usage Policy for more.

6. Ownership of uploaded data

Users retain ownership of content uploaded to Vistra. We do not claim ownership of:

  • Inspection photos
  • Reports
  • Documents
  • Business records
  • Client information uploaded by users

Users grant Vistra a limited licence to process, store, and transmit uploaded content only as necessary to provide the Services.

7. Who we share information with, including overseas

We do not sell personal information. We share it with the following kinds of provider, only so they can help us run the Services. Some of them are outside Australia. Under APP 8 we take reasonable steps to make sure overseas providers handle your information in line with the APPs, for example through their contract terms and security standards.

  • Hosting and file storage (accounts, reports, photos and backups): Amazon Web Services.
  • Payment processing: Stripe, in the United States and Ireland. If you subscribe in the mobile app, Apple or Google processes the payment.
  • In-app subscription management: RevenueCat, in the United States. It keeps track of subscriptions bought through the Apple App Store and Google Play.
  • Push notifications, and crash and performance reports (the crash and performance data only with your consent): Google Firebase, in the United States.
  • AI suggestions, only when you use an AI feature: Anthropic and OpenAI, in the United States.
  • Email delivery: our email provider, Microsoft 365 (Microsoft), in Australia and the United States.
  • Error monitoring (technical error reports from our servers, which may include an IP address): Sentry (Functional Software, Inc.), in the United States.

Apple’s notification service delivers push notifications to iPhones and iPads. The Subprocessors page lists the providers we use.

People you share reports with

When you share a report, export it, or send an invite, the people you choose can see what is in it. Check the report before you share it, because it may include photos, addresses and location details.

Business transfers

If Vistra is involved in a merger, sale or restructure, information may be transferred as part of that deal. We will make sure it stays protected under this policy.

Legal requirements

We may disclose information where the law requires it, to respond to a lawful request, or to protect people from fraud or a security threat.

8. Data storage and security

We use reasonable technical and organisational measures to protect information. Security measures may include:

  • Encryption during transmission
  • Secure cloud infrastructure
  • Access controls
  • Authentication protections
  • Monitoring systems
  • Backup procedures

However, no internet-based service can guarantee absolute security. See our Security page for more detail.

9. How long we keep information

We keep your account data while your account exists. We do not delete active or inactive accounts automatically. These are the timeframes that apply:

  • When you delete your account. There is a 30-day grace period in case you change your mind. After that, your account, reports, photos and files are permanently deleted.
  • Deleted reports. A report you delete sits in the trash for 30 days, and you can restore it. After 30 days it is permanently deleted along with its photos.
  • Billing records. Tax invoices and payment records are kept for 7 years as Australian tax law requires, held in our payment providers’ systems (Stripe, Apple, Google).
  • Security logs. Login records and IP addresses are kept for up to 12 months to protect accounts and investigate abuse, including after an account is deleted.
  • Backups. Database backups roll off within 35 days, so deleted data can remain in a backup for up to that long before it disappears.
  • File versions. Our file storage keeps earlier versions of photos and files as protection against accidental deletion. Those versions are removed within 30 days of a file being deleted or replaced.

When we no longer need information, we delete or de-identify it. See Delete your account & data for the steps.

10. Your rights: access, correction and complaints

You can ask us for the personal information we hold about you (APP 12) and ask us to correct it if it is wrong or out of date (APP 13). You can also ask us to delete your account, and withdraw consent that you gave, such as location access, diagnostics, or product news and offers. Most of these you control in the app or your device settings.

To make a request, email privacy@vistra.report. We may need to confirm who you are first. We aim to reply within 30 days, and we will tell you if we cannot give you access and why. There is no charge for asking. To remove your account, see Delete your account & data.

If your information is in a report that one of our customers created about their own client, we may pass your request on to that customer, because they decide what goes in their reports.

Making a complaint

If you think we have mishandled your personal information, contact us first at privacy@vistra.report. We will reply within 30 days. If you are not happy with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.

11. Data breaches

If there is a data breach that is likely to cause serious harm, we follow the Notifiable Data Breaches scheme under the Privacy Act. We assess the breach quickly, take steps to contain it, and notify the people affected and the OAIC where required. If the breach involves information we hold for one of our customers, we will tell that customer so they can meet their own obligations.

12. Children’s privacy

Vistra is designed for business users. We do not knowingly collect personal information from children under applicable legal age requirements.

13. Cookies

We use essential cookies only: the ones needed to keep our systems secure and working, and small ones that remember your choices, such as light or dark theme. We do not use analytics or advertising cookies, and we will ask before we add any. See our Cookie Policy.

14. Third-party links

Our Services may contain links to third-party websites. We are not responsible for the privacy practices or content of external services.

15. Changes to this Privacy Policy

We may update this policy from time to time. The “last updated” date at the top shows the latest version. If we make a significant change, we will tell account holders by email or in the app.

16. Contact us

For privacy questions, requests and complaints:

Questions about this policy? Contact us or email hello@vistra.report.