Privacy Policy

1. What Information We Collect

We collect only what is necessary to provide the service:

• Account data: email address, password (hashed — we never see it)
• Financial inputs: property details, income, tax rate, loan details, and other figures you enter into the calculator
• Usage data: pages visited, features used (via analytics — financial inputs are never sent to analytics)
• Payment data: handled entirely by Stripe — we do not store card numbers

2. How We Use Your Information

• To provide and improve the Investivo service
• To process payments via Stripe
• To send account-related emails (receipts, renewal notices, updates)
• To respond to support requests

We do not sell your data. We do not use your financial inputs for advertising.

3. Sharing Your Information

We share data only with the following service providers, solely to deliver the service:

• Supabase (cloud database hosting) — stores your account and deal data. Hosting region: see our current infrastructure disclosure below.
• Stripe (payments — US) — processes subscription payments
• Vercel (hosting — global CDN) — serves the application

Some of these providers store data outside Australia. We take reasonable steps to ensure they handle your data consistently with the Australian Privacy Principles (APP 8). Our current primary database region is disclosed on request via privacy@investivo.co, and we are progressively consolidating hosting to Australian regions (AWS Sydney) where available.

4. Shared Deal Links

When you generate a share link, a limited view of your deal results is accessible to anyone with the link. Sensitive financial inputs (income, tax rate, deposit, etc.) are never included in shared views. You can revoke a share link at any time from your account.

5. Data Retention

• Active accounts: data retained while your account is active
• Cancelled accounts: data retained for 7 years for tax compliance purposes, then deleted
• Deleted accounts: use the "Delete my account" button in Account settings for immediate deletion, or email us — data purged within 30 days of any request

6. Security

Data is encrypted in transit (HTTPS/TLS) and at rest (Supabase AES-256 encryption). Access to the database is role-restricted and protected by multi-factor authentication. We do not log sensitive financial inputs in application logs or analytics.

7. Your Rights

Under the APPs, you have the right to:

• Access your personal information
• Correct inaccurate information
• Delete your account and data

To exercise these rights, email privacy@investivo.co. We will respond within 30 days.

8. Data Breach Response

In the event of a notifiable data breach (as defined under the Privacy Act 1988), we will notify the Office of the Australian Information Commissioner (OAIC) and affected users within 30 days of becoming aware of the breach.

9. Cookies & Analytics

We use minimal analytics to understand how the product is used (e.g., page views, feature usage). Financial input data is never sent to analytics platforms. You can disable analytics via your browser settings.

10. Changes to This Policy

We may update this policy. We will notify you by email before material changes take effect.

11. Contact & Complaints

Privacy questions or complaints: privacy@investivo.co

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).