Privacy Policy
Last Updated: 28 October 2026
Privacy Policy
COVRA respects your privacy. This policy explains how we handle personal information, in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). It applies to information we collect through covra.com.au, the COVRA broker exchange at app.covra.com.au, and by email.
“COVRA”, “we” and “us” mean the business that runs covra.com.au. You can contact us about privacy at privacy@covra.com.au.
1. What we collect
From businesses that send an enquiry:
- Your name, email address and phone number
- Your industry, postcode and state, revenue range, the covers you’re asking about, your current needs and your timeline
- Your answers, if you use the insurance check or the review checklist
- Any other details you give us in your enquiry or by email
- Where the enquiry came from: the page you sent it from, the first page you visited, the website that referred you and any campaign tags in the link
- Whether you confirmed your email address, and the results of our automated checks (section 5)
- Your feedback, if you answer our email asking how your enquiry went
From brokers who join the exchange: your name, brokerage name, work email, website, Australian Financial Services Licence or authorised representative number, the covers we’ve approved for you, the preferences and limits you set, and your bids and payments. If you add colleagues to your auction emails or give them their own login to bid for your brokerage, we hold their names and work email addresses. Card details are held by our payment provider, Stripe. We don’t store full card numbers.
When anyone uses the site or the exchange, our hosting and anti-spam providers process technical information such as your IP address and browser details.
We don’t ask for sensitive information, such as health information, and ask that you don’t include it in an enquiry.
2. How we collect it
We collect information directly from you when you fill in a form, use the insurance check, email us or register as a broker. Occasionally we receive it from others, for example when a broker tells us they couldn’t reach you about your enquiry, or when a broker adds a colleague to its auction emails. We email that colleague to confirm before we send them anything else, and they can stop the emails at any time from a link in each one. We don’t buy personal information.
You can read the site and use the insurance check without telling us who you are. To send an enquiry, we need your name and contact details, because the broker needs them to get in touch. Without them, we can’t pass your enquiry on.
3. Why we collect it
- To check your enquiry and pass it to a broker, so that broker can contact you about it
- To confirm your email address, or your mobile number with a code we text to it, before your enquiry goes to a broker
- To run the broker exchange, including approving brokers, running auctions, charging brokers, issuing tax invoices and handling refund requests
- To stop spam, fraud and misuse
- To ask how your enquiry went, once a broker has received it, and to improve our service from your answer
- To answer your questions and complaints
- To understand which pages lead to enquiries, so we can improve the site
- To meet our legal obligations, such as keeping tax records
We only use your information for these purposes, for related purposes you’d reasonably expect, or where the law allows or requires it.
4. Disclosure of your information
By submitting your details, you consent to your information being shared with a licensed or authorised insurance broker for the purpose of responding to your enquiry.
COVRA is free for businesses. Brokers pay COVRA to receive enquiries, and the broker who contacts you will have paid for yours.
Before your enquiry is shared, approved brokers can see a summary of it (your industry, state and postcode, revenue range, the cover you asked about and your timeline), but not your name, email address or phone number. Approved brokers who offer a cover you asked about bid to receive it (enquiries that don’t name a cover are open to every approved broker), and each enquiry goes to the broker who bids the most. Only that broker receives your name and contact details.
Before a brokerage can receive enquiries, we check on ASIC’s professional register that it holds, or acts under, an Australian Financial Services Licence that covers general insurance, and check its website for the covers it offers. COVRA doesn’t recommend or compare brokers, and approving a broker isn’t a recommendation. Once the broker has your details, they handle them under their own privacy policy, and our broker terms require them to use your details only for your enquiry and to keep them secure.
We also disclose information:
- To the service providers listed in section 6, so they can run parts of the site and exchange for us
- To a business that asks which brokerage received its enquiry, and to a broker about an enquiry they received, such as when a refund is requested
- On our website, if you said we may show your comment about your enquiry: the comment, with your first name, industry and state
- To our professional advisers, and to anyone who buys or takes over our business, who must handle it under this policy
- Where the law requires or allows it, such as to a regulator, a court or law enforcement
5. Automated checks and decisions
When an enquiry arrives, our systems check it automatically for signs it isn’t genuine: a phone number that isn’t valid or looks made up, a throwaway or test email address, a name that doesn’t look real, or a repeat of an enquiry from the same business in the last 90 days. The checks only flag an enquiry. A person at COVRA decides whether to pass it on.
For brokers, the exchange works out the winner of each auction automatically, following the broker terms, and refuses bids that go over the limits a broker has set or that are for covers they aren’t approved for.
6. Where your information is processed
Enquiries and the broker exchange are stored with Google Cloud (Firebase) in Sydney, Australia. Some of our service providers process information outside Australia:
- Website hosting and our anti-spam check (Google Firebase Hosting and reCAPTCHA): countries including the United States
- Website analytics (Google Analytics and Google Tag Manager): countries including the United States
- Advertising measurement (Meta Pixel, from Meta Platforms): the United States
- Emails we send, such as the email to confirm your address (SendGrid, part of Twilio): the United States
- The code we text to confirm your mobile number (Twilio Verify): the United States
- Our own email accounts (Google Workspace): countries including the United States
- Card payments by brokers (Stripe): countries including the United States
- The videos on our home page and in our guides (YouTube): countries including the United States
We use established providers whose terms require them to protect the information and use it only to provide their services to us.
7. Marketing
We only email you about your enquiry. We don’t send marketing emails, and we don’t give your details to anyone for their own marketing. The broker who receives your enquiry may contact you about it. If a broker sends you marketing you didn’t ask for, you can unsubscribe with them, and please let us know.
8. Storage and security
We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, change or disclosure. Your contact details are stored separately from the summary brokers see, and only COVRA can see them before your enquiry goes to a broker. Access to our systems is limited to the people who need it.
If a data breach is likely to cause you serious harm, we’ll tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
9. How long we keep it
We keep enquiry and broker records while we need them for the purposes above, including answering questions or complaints about an enquiry and keeping the business and tax records the law requires. When we no longer need personal information, we take reasonable steps to delete it or de-identify it.
11. Access and correction
You can ask for a copy of the personal information we hold about you, or ask us to correct it, by emailing privacy@covra.com.au. We may need to confirm your identity first. We’ll reply within 30 days and won’t charge you for asking. If we can’t give you access or make a correction, for a reason the Privacy Act allows, we’ll tell you why in writing and how to complain. If a broker already has your details, you can also ask them directly.
12. Privacy complaints
If you think we’ve mishandled your personal information, email privacy@covra.com.au and tell us what happened. We’ll let you know we’ve received it within 7 days, look into it, and give you our answer in writing within 30 days.
If you’re not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC).
13. Changes to this policy
We’ll update this page when the way we handle personal information changes. The date at the top shows when it last changed. Our terms of use explain how the site and the referral service work.
Contact
For privacy enquiries, contact: privacy@covra.com.au