Privacy Policy

1.Who we are

Axis is operated by [LEGAL NAME] trading as Axis (ABN [ABN]), a sole trader based in Australia. Axis is a portfolio management system for Australian property investors.

For anything on this page — access, correction, deletion, a copy of your data, or a complaint — write to privacy@axishq.com.au, or post to [POSTAL ADDRESS].

The Privacy Act 1988 (Cth) exempts most small businesses turning over less than $3 million a year. That exemption currently applies to us. We do not rely on it. We comply with the Australian Privacy Principles voluntarily, and we hold ourselves to this policy as though the Act bound us — because given what Axis stores, anything less would be indefensible.

2.What we collect

Almost everything in Axis is information you enter or upload yourself. Here it is, specifically.

3.What we do not collect

Worth stating plainly, because it is unusual for a product in this category:

• No tax file numbers. There is no field for one anywhere in Axis.
• No dates of birth, BSBs or bank account numbers. No fields for those either.
• No bank login credentials, and no screen-scraping. Ever. If bank feeds are ever built, they will use the regulated Consumer Data Right with your explicit consent, and this policy will be updated before that happens.
• No credit checks, and no data about you bought from anyone.
• No property or valuation data pulled from a third-party data provider. Valuation sources are whatever you type in.

4.Sensitive information

We do not ask for sensitive information as the Privacy Act defines it — health, race, religion, political or union membership, sexual orientation, criminal record, biometrics or genetic data. Axis has no field for any of it and no use for any of it.

The one path by which it could reach us is a document you choose to upload, such as an identity document. If you upload one, we hold it as part of your document library and treat it under this policy. We would rather you did not upload identity documents at all.

5.Why we collect it

• To run Axis — keep your records, compute your position, generate plans, health figures and missions, and file your documents.
• To support you — answer questions and fix problems.
• To send you service email — sign-in links, account notices, and the portfolio digest. You can turn the digest off in your notification settings.
• To improve the product — understand which features are used, and find and fix errors.
• To meet our legal obligations — and to establish or defend a legal claim if we ever have to.

And four commitments about what we will not do:

• We do not sell your data. Not to anyone, not in any form.
• We do not use your financial data to market third-party products to you. No lender referrals. No insurance upsells off the back of your renewal dates. Your renewal calendar is yours.
• We do not train our own models on your data.
• We do not publish aggregate insights drawn from your data without telling you first and de-identifying it properly.

6.How we use AI

Parts of Axis are generated or read by AI, and all of that happens outside Australia. We use OpenAI, based in the United States, to write the summaries below and to read the documents you upload. You should know exactly what goes where.

Document reading is the most sensitive of these, so it is worth being specific about it:

• It runs on OpenAI in the United States, so sending a document to be read is a disclosure of personal information to an overseas recipient. Your documents themselves are stored in Australia; the reading is not.
• It is the whole document, not a summary of it — the extracted text plus images of up to eight pages. Anything written on a page you upload goes with it.
• Nothing it reads is applied to your portfolio on its own. Every figure it pulls out of a document is shown to you to accept or reject first, and you can reject the lot.
• It happens to every document you upload. There is no setting that turns it off, so a document you would rather was not read by AI is a document not to upload.

So every one of these features sends something to OpenAI in the United States — your figures for the summaries, your documents for the reading. What we can tell you about all of it:

• We do not use your data to train our own models, and we do not give it to anyone to train theirs.
• OpenAI's API terms state that data submitted through the API is not used to train their models by default. That is their commitment, not ours, and you should weigh it as such.
• We store the generated output — the summary or digest text, and the facts read out of a document — against your account, and the health summary is cached for 30 days.
• AI output is generated text. It can be wrong, and it is never advice. Every figure it describes comes from data you entered or a document you uploaded; check the underlying numbers before you act on anything.

If you would rather none of this happened, tell us at privacy@axishq.com.au. We will turn the generated summaries and document reading off for your account.

7.Automated processing

Axis computes things from your data and ranks them for you. It works out your health verdict, cash runway, reserve floor, how much equity is available via refinance, what needs a revaluation, your capital gains position, whether a plan satisfies its constraints, and which piece of work matters most right now.

These are calculations over figures you entered, presented as information. They are not decisions about you. Nothing in Axis decides whether you get credit, a service, a benefit or a price — no lender, insurer or government body receives an assessment from us, and no result here affects your legal rights. You make every decision. Where a result matters, Axis shows the inputs behind it so you can check the work.

From 10 December 2026 the Privacy Act requires certain automated decision-making to be disclosed in privacy policies. We have written this section now so it stands from the day those rules commence. If Axis ever makes or substantially supports a decision that significantly affects your rights or interests, we will describe it here first.

8.Who can see it

• You, and anyone you invite to your account — typically a partner, and sometimes an accountant or mentor. Invited members can see the account you invited them to.
• Advisers you share with. You grant access per adviser, and you pick which parts they see — health, portfolio, capital, plans or documents. They verify by a code sent to their email. Grants expire after 90 days, and you can revoke one at any moment. We log every time a shared view is opened, and you can see that log.
• AI clients you connect yourself. If you connect Axis to an external AI tool such as Claude or ChatGPT, that tool reads your portfolio, loans, leases, contacts and plans, and can read the extracted text of your documents. It reads only; it cannot change anything. You set that connection up and you can revoke it. Whatever it reads goes to that provider under their terms, not ours.
• Us. We do not enter, edit or manage your data for you. Technical access to production systems exists because someone has to run and support the service, and it is used for that only.
• Our service providers, listed below.
• No one else — except where the law requires it, such as a court order or a warrant. If that happens we will tell you, unless we are prohibited from doing so.

9.Our service providers

Running Axis means using other companies. Here is every one that handles personal information, what it does, and where it does it.

We will update this table when it changes. Where a provider is outside Australia, we take reasonable steps to ensure it handles your information consistently with the Australian Privacy Principles, but you should understand that overseas providers are also subject to the laws of their own country.

10.Where your data lives

Your portfolio database and every document you upload are stored in Australia, in Amazon Web Services and Supabase infrastructure in Sydney. That is where the substance of your account sits, and it is where your documents stay. Reading them is the exception: a document is sent to OpenAI in the United States to be read, and the facts pulled out of it come back here. So the file itself lives in Australia, and a copy of what is written on it is disclosed overseas each time it is read.

We cannot tell you that nothing leaves Australia, and we are not going to pretend otherwise. As the table above shows, the services that host our web pages, send our email, generate our summaries, read your uploaded documents, track our errors and measure our usage operate in the United States, and personal information is disclosed to them in the course of doing those jobs.

In transit your data is encrypted with TLS. At rest, documents are encrypted in storage and the database is encrypted by our provider.

11.Cookies and tracking

Axis sets these cookies:

Australian law requires us to tell you about tracking rather than to ask your permission first, and we do not run a cookie consent banner. So this section has to do the work instead. What actually runs:

• PostHog records which pages and features you use, identified by your user ID, email and name. Automatic capture of clicks is switched off, page text and element attributes are masked, its own session recording is disabled, and requests are proxied through our own domain.
• Sentry records errors. It is configured not to send personal information by default, and a filter strips request bodies, cookies and headers, reduces the user to an ID, and redacts anything whose name looks financial — amounts, valuations, rents, loans, rates, equity, LVR, offsets, broker and document fields. It also records session replays, at about 1 in 20 sessions and at every session that hits an error.

Session replay means a reconstruction of your interface interactions, with text masked. If you would rather not be recorded, tell us at privacy@axishq.com.au and we will exclude your account. Your browser's Do Not Track and tracking-prevention settings also apply.

12.How long we keep it

• While your account is open, we keep your data so the product works. Axis is a record of financial history; deleting it silently would defeat the point.
• If you ask us to delete it, we will — see below.
• If you close your account, we delete your portfolio data and documents within 90 days, unless you ask us to do it sooner.

13.Your rights, and how to use them

You can ask us to give you access to what we hold, correct anything wrong, delete your data, or send you a copy to take elsewhere. Write to privacy@axishq.com.au.

There is no button for this in the app yet. It is handled by a person, and here is the commitment that comes with that:

• We acknowledge your request within 7 days.
• We action it within 30 days. If a request is complex enough to need longer, we tell you why and when.
• A copy of your data is supplied as a structured data file together with your original uploaded documents.
• We do not charge for access, correction or deletion.
• If we refuse a request — which would be unusual, and only where the law allows it — we tell you why in writing.

If you are unhappy with how we have handled your information or your request, complain to us first at privacy@axishq.com.au. We will respond within 30 days. If we cannot resolve it, you can take it to the Office of the Australian Information Commissioner — oaic.gov.au, phone 1300 363 992, GPO Box 5218 Sydney NSW 2001.

If a data breach happens that is likely to cause you serious harm, we will notify you and the Commissioner, in line with the Notifiable Data Breaches scheme.

14.How we protect it

What is actually in place, stated at the level we can stand behind:

• All traffic is encrypted with TLS 1.2 or 1.3. Plain HTTP is redirected, and our document storage refuses unencrypted connections outright.
• Documents are encrypted at rest, and the connection to our database is verified against a pinned certificate authority.
• Your portfolio data sits behind row-level security in the database, so a query cannot reach another account by accident. Account access is separately checked against your membership on every request.
• Sign-in tokens are validated on every request against the identity provider, and access you have revoked stops working immediately.
• Uploaded documents sit in private storage that blocks all public access, under keys scoped to your account, and are served only through single-use links that expire in 10 minutes.
• Form submissions are protected against cross-site request forgery, and the app sends a strict set of browser security headers.
• Production credentials are held in a managed secrets store and injected at runtime, not written into the application.
• Databases are backed up daily.
• We build against the OWASP Application Security Verification Standard, Level 2.

15.Children

Axis is for adults. It is not directed at anyone under 18 and we do not knowingly collect information about children. If you believe we have, tell us and we will delete it.

16.Changes to this policy

When we change this policy materially — new categories of data, a new overseas provider, a new purpose — we will email you at least 30 days before it takes effect. Smaller corrections are published here with an updated version number and date at the top of the page.

Questions about any of it: privacy@axishq.com.au. General support: support@axishq.com.au.