Privacy Policy

1. Who we are and how this policy works

This Privacy Policy explains how Savvy Start Agency (ABN 21 266 850 175) handles your personal information when you use SavvyPortfolio.

We're a small Australian business. Because of our size, most of the obligations in the Privacy Act 1988 (Cth) don't currently apply to us. We've chosen to handle your information consistently with the Australian Privacy Principles anyway, and the commitments in this policy are commitments we make directly to you. If that changes so the Privacy Act applies to us, we'll update this policy and tell you.

In this policy, "SavvyPortfolio" and "the Service" mean the software we supply at savvyportfolio.com.au, on any subdomain, and through our mobile applications. Your use of the Service is also covered by our Terms of Service.

If we change this policy we will update the date above. For a change that materially affects how we collect, use or share your information, we will show a notice in the Service at least 30 days before it takes effect. Previous versions of this policy are available on request.

2. What we collect

• Account information: your email address, your name if you give it to us, your password (stored only as a hash), your profile picture if you sign in with Google or Apple, and your settings.
• Portfolio data: the transactions, holdings, dividends and franking details you enter or import, your portfolio names and notes, and the figures we calculate from them such as cost bases, realised and unrealised gains, CGT discount eligibility and franking credits.
• AI chat: the messages you send the AI assistant, its replies, how many messages you send each day (we use this to apply plan limits), and the portfolio context sent with your question.
• Subscription data: your Stripe customer ID, subscription status, plan type, billing period dates and invoice records.
• Usage and device data: the pages and features you use, timestamps, error and performance logs, your IP address, and your device, operating system and browser type.

SavvyPortfolio is for people aged 18 and over. We don't knowingly collect information from anyone under 18 — if you believe we have, email us and we'll remove it.

3. What we never collect

We never ask for and never store:

• your bank or broker login details
• your card numbers — Stripe handles payments, and we only ever see whether a payment succeeded
• your Tax File Number
• identity documents
• sensitive information as defined in the Privacy Act

4. How we use it

We use your information to:

• create and run your account
• organise your transactions and calculate gains, losses, CGT discount eligibility and franking credits
• produce the reports and exports you ask for
• answer your questions through the AI assistant and apply your plan's daily limit
• respond to your support requests
• keep the Service secure and prevent fraud and abuse
• process your subscription payments through Stripe
• send you service notices such as security alerts, billing notices and changes to this policy — product and marketing emails only if you opt in
• find and fix bugs and see which features people use

We don't use your portfolio data for anything else, and it is never used to train AI models.

5. Who we share it with

We use these providers to run the Service. Each one receives only what it needs:

• Supabase — our database and sign-in provider. Your account and portfolio data are stored here, in the Sydney region.
• Vercel — hosts and delivers the web application, and gives us anonymised page-view and performance data.
• Azure OpenAI — powers the AI assistant and our import column detection. It receives your messages and the portfolio context sent with them.
• Stripe — processes all payments. Stripe receives your payment details directly; we receive your customer ID, subscription status and billing dates.
• TradingView — provides the interactive charts, embedded in a cross-origin iframe. TradingView may track chart usage under its own privacy policy.
• Yahoo Finance — provides prices, dividends and splits. Only ticker symbols are sent; no personal or portfolio data.
• Google and Apple — provide sign-in. We receive your name, email address and profile picture as authorised by your provider settings.
• Google Analytics — tells us which features people use. See section 7.

5.1 Importing a file we don't recognise

When you import a file from a broker we don't have a built-in template for, we send the file's column headings and up to three rows of it to our AI provider so it can work out which column is which. Those rows contain real transaction data. If you'd rather not do that, use a supported broker template or enter your transactions manually.

5.2 AI processing

Our AI provider processes your data under enterprise terms and does not use it to train or improve its models. AI processing may occur outside Australia.

5.3 Legal requests and business changes

We may disclose your information where the law compels us to — for example a court order, a subpoena, or a lawful request from a regulator or the Australian Taxation Office. Where we are permitted to tell you, we will. If the business is sold or transferred, your information may transfer with it, and we will tell you before that happens.

6. Where your data lives and how we protect it

If you use SavvyPortfolio without an account, your portfolio data stays in your browser on your device and is never sent to us.

If you create an account, your portfolio data is stored in our database in Australia, in the Sydney region, and is available on any device you log in to. There is no toggle for this — storing your data is part of having an account.

How we protect it:

• Access is restricted at the database level so you can only ever read your own records.
• Data is encrypted in transit using TLS 1.2 or higher.
• Data is encrypted at rest using AES-256.
• Passwords are stored only as salted bcrypt hashes — nobody can read them, including us.
• We keep our dependencies and platforms up to date.

No system is perfectly secure, and we don't hold any security certification. What we can tell you is exactly what we do, which is all of the above.

Backups: we do not currently run automated backups of your data, so please keep your own copy. You can select your transactions and dividends and export them to CSV at any time, on any plan. (Exporting the CGT report itself is a Pro feature.)

How long we keep it: your account and portfolio data are kept for as long as your account is open. Data held in your browser stays there until you clear your browser data. We may keep billing records for longer where tax or accounting law requires it.

7. Your choices and rights

These are commitments we make to you. You don't need to give a reason, and there is no charge for a reasonable request. Email us at info@savvystart.com.au and we will respond within 30 days. We may need to verify who you are first.

• Access: ask us what personal information we hold about you and how it has been used and disclosed, and we'll tell you. Most of it you can see in the app already.
• Correction: if something we hold is wrong, out of date or incomplete, ask us to fix it. You can edit your profile and your portfolio data yourself at any time.
• Export: download your transactions and dividends as CSV whenever you want, from the app. If you would like your data in another format, ask us.
• Deletion: when you ask us to delete your account, we delete your account and portfolio data from our live systems.
• Withdraw consent: where we rely on your consent, you can withdraw it at any time.
• Opt out of marketing: unsubscribe from any product email, or change your preferences. You'll still get essential service notices such as security and billing messages.

7.1 Cookies and analytics

We use Google Analytics to understand which features people use. It sets cookies and collects your IP address, device and browser type, and the pages you visit. We don't use it to identify you and we never combine it with your portfolio data. Essential cookies keep you logged in and secure and can't be turned off without breaking the Service. You can block analytics cookies in your browser settings at any time.

8. Contact and complaints

If you have a question about this policy, or you think we've mishandled your information, tell us first. Put "Privacy" in the subject line, describe what happened and how you'd like it resolved. We aim to respond within 30 days.

8.1 Escalating to the OAIC

If you're not satisfied with our response, or you'd rather not come to us first, you can contact the Office of the Australian Information Commissioner: