Privacy Policy

Effective date: 22 March 2026 · Last updated: 22 March 2026

This Privacy Policy explains how J&A Marsh Investments Pty Ltd (ABN pending) ("we", "us", "our", "AlphaIQ") collects, uses, stores, and protects your personal information when you use the AlphaIQ platform ("the Platform"), accessible at alphaiq.pro and app.alphaiq.pro.

We are committed to protecting your privacy in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We are based in Perth, Western Australia.

1. Information We Collect

Account information: When you create an account via Google OAuth, we receive your name, email address, and Google profile identifier. We do not receive or store your Google password.

Financial information you provide: To deliver personalised wealth intelligence, you may choose to provide information including but not limited to:

• Income details, employment information, and salary data
• Investment property details (addresses, purchase prices, rental income, mortgage details, depreciation schedules)
• Superannuation fund details, balances, and contribution history
• Share portfolio holdings, purchase prices, and transaction history
• Financial goals, retirement plans, and risk preferences
• Tax-related information (marginal tax rate, CGT events, deductions)

Uploaded documents: You may upload financial documents such as super statements, rental agent statements, depreciation schedules, and mortgage documents. These are stored securely and processed by AI to extract relevant financial data.

AI interaction data: Questions you ask the AI Advisor, Growth Scanner queries, Thesis Interrogator sessions, and What-If scenario configurations are stored to provide you with continuity and historical context.

Usage data: We collect standard technical information including IP address, browser type, device information, pages visited, and session duration. This is used to maintain platform stability and improve the user experience.

Payment information: Subscription payments are processed by Stripe. We do not store your credit card number, CVV, or full card details on our servers. Stripe's handling of payment data is governed by their own privacy policy and PCI DSS compliance.

2. How We Use Your Information

We use your information exclusively to:

• Provide and personalise the AlphaIQ platform and its features
• Generate personalised intelligence feeds based on your holdings
• Run AI-powered analyses including Growth Scanner, Thesis Interrogator, Portfolio Health, and What-If projections
• Calculate Australian tax obligations, negative gearing, CGT, and superannuation projections
• Process your subscription payments
• Send essential service communications (account security, billing, critical platform updates)
• Maintain platform security and prevent fraud
• Improve the platform based on aggregated, anonymised usage patterns

3. What We Will Never Do

4. AI Processing and Third-Party AI Services

AlphaIQ uses artificial intelligence to power features including the Growth Scanner, Thesis Interrogator, AI Advisor, Intelligence Feed, and document extraction. These features may involve sending relevant portions of your data to third-party AI service providers (such as Anthropic's Claude API) for processing.

Important safeguards:

• Only the minimum data necessary to generate a response is sent to AI providers
• AI providers are contractually prohibited from using your data to train their models
• AI providers do not retain your data beyond the processing session
• We use API-level access (not consumer-facing products), which provides stronger data handling guarantees
• AI-generated outputs are informational only and do not constitute financial advice

5. Data Storage and Security

Your data is stored in cloud infrastructure provided by Supabase (PostgreSQL database with Row Level Security) and Railway (application hosting). All data is encrypted in transit (TLS 1.2+) and at rest.

Security measures include:

• Row Level Security (RLS) on all database tables — users can only access their own data
• Authentication via Google OAuth with secure session management
• HTTPS encryption on all connections
• Secure, time-limited, token-authenticated document sharing links
• Regular security reviews of application code and infrastructure

While we implement reasonable security measures to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

6. Data Sharing

We share your data only in the following limited circumstances:

• Service providers: Supabase (database), Railway (hosting), Stripe (payments), and AI API providers — solely to operate the platform. These providers are bound by their own privacy policies and data processing agreements.
• Your explicit direction: When you generate a shareable document link for your accountant, broker, or other professional, you are choosing to share specific data with that recipient.
• Legal requirements: If required by Australian law, court order, or government authority, we may disclose information as legally compelled. We will notify you where legally permitted.

7. Data Retention

We retain your account and financial data for as long as your account is active. If you close your account, we will delete your personal and financial data within 30 days, except where retention is required by Australian law (such as tax records or financial transaction records).

You may request deletion of your data at any time by contacting us. We will process deletion requests within 30 days.

8. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Complaint: Lodge a complaint with us or with the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached

To exercise any of these rights, contact us at the details below.

9. Cookies and Tracking

We use essential cookies and local storage to maintain your authenticated session and platform preferences. We do not use third-party advertising cookies or tracking pixels. We do not use analytics platforms that track your behaviour across other websites.

10. Children's Privacy

AlphaIQ is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

11. International Data Transfers

Our service providers may store or process data in locations outside Australia (including the United States). Where this occurs, we ensure that appropriate safeguards are in place consistent with the Australian Privacy Principles. By using AlphaIQ, you consent to these transfers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on the platform. Your continued use of AlphaIQ after changes are posted constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your privacy rights:

J&A Marsh Investments Pty Ltd
Perth, Western Australia
Email: [email protected]

You may also contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au if you wish to lodge a formal complaint.