Privacy Policy

1. Introduction

Jazoodle Pty Ltd (ACN 607 642 259), trading as Advisorli, ABN 67 607 642 259 ("we", "us", "our") is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our business intelligence and advisory platform at advisorli.com, including all related applications, integrations, and services (collectively, the "Service").

We are headquartered in Sydney, NSW, Australia and operate globally. We comply with the following privacy frameworks where applicable:

• Australia: Australian Privacy Principles (APPs): Privacy Act 1988 (Cth)
• United Kingdom: UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018
• European Union: General Data Protection Regulation (GDPR), Regulation (EU) 2016/679
• Canada: Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation
• New Zealand: Privacy Act 2020 and the Information Privacy Principles (IPPs)
• United States: California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA), and applicable state privacy laws

Data Controller / Contact Details: Jazoodle Pty Ltd trading as Advisorli 133 Sandringham Street, Sans Souci, NSW 2219, Australia Email: privacy@advisorli.com

2. Information We Collect

2.1 Account Information

When you register for an account, we collect:

• Full name and email address
• Password (cryptographically hashed, we never store plaintext passwords)
• Company name, role/position, and business intent
• Phone number (optional)
• Business address, city, state, postcode, and country
• Profile preferences and display settings

2.2 Financial and Business Data

To provide our core services, we collect and process:

• Profit and loss statements, balance sheets, and cash flow data
• Business valuations, forecasts, and scenario analyses
• Accounts receivable and accounts payable ageing data
• Customer concentration and revenue breakdown data
• Business goals, KPIs, performance metrics, and covenant limits
• Headcount, employee count ranges, and operational data
• Bank transaction data (where imported or synced)

2.3 Accounting Integration Data

If you connect third-party accounting software, we receive data from:

• Xero: Chart of accounts, profit & loss, balance sheet, invoices, contacts
• QuickBooks Online: Chart of accounts, financial reports, invoices, customers, vendors
• Sage Business Cloud: Ledger accounts, financial data, contacts
• MYOB Business: General ledger, financial reports, contacts
• Reckon One: Chart of accounts, financial statements, invoices

OAuth access and refresh tokens for these integrations are encrypted at rest using AES-256-GCM and stored in access-restricted tables with deny-all client-side policies.

2.4 Other Integration Data

We also support connections to non-financial platforms such as Google Analytics. Data received from these integrations (e.g. sessions, pageviews, conversion metrics) is stored and processed solely to surface performance insights within the Service.

2.5 AI Coaching and Conversational Data

Our AI Business Coach feature collects:

• Conversation history, prompts, and responses
• Action items, check-in responses, mood and energy data
• Business challenges and goals you share in coaching sessions

AI coaching data is isolated per user and per business, other users with shared access to the same business cannot see your coaching conversations.

2.6 Shared Access and Advisor Data

If you share a business with an advisor, investor, or collaborator, or if someone shares a business with you, the following data is disclosed to the shared party in accordance with the permissions you grant:

• Financial data (P&L, Balance Sheet, KPIs) for the shared business only
• Business profile details (name, industry, stage, country)
• Generated reports, board packs, and valuation outputs

Shared access can be revoked at any time by the business owner. Advisor and investor users are bound by the same confidentiality obligations set out in the Terms of Service.

2.7 Technical and Usage Data

We automatically collect:

• IP address and approximate geolocation (country/region level only)
• Browser type, version, and device information
• Pages visited, features used, and interaction patterns
• Date and time of access
• Referring website addresses
• Error logs and performance data (for debugging purposes)

3. How We Use Your Information

We use your information for the following purposes:

• Service Delivery: To provide business analytics, valuations, AI recommendations, board packs, benchmarking, and reporting features
• Data Synchronisation: To sync financial data from connected accounting platforms on your behalf
• Account Management: To create and manage your account, authenticate access, enforce role-based permissions, and process subscriptions
• Communication: To send service updates, security alerts, digest emails, and support responses
• AI Features: To power coaching, diagnostics, opportunity identification, and automated financial commentary
• Improvement: To analyse aggregate usage patterns and improve platform features, stability, and performance
• Compliance: To meet legal obligations including tax reporting and responding to lawful requests
• Security: To detect, prevent, and address fraud, abuse, unauthorised access, or technical issues

4. Legal Basis for Processing

4.1 GDPR / UK GDPR (EEA and UK Users)

For users in the EEA and United Kingdom, we process personal data under these legal bases:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide the Service you subscribed to
• Legitimate Interests (Art. 6(1)(f)): For analytics, security monitoring, and service improvement, where not overridden by your rights
• Legal Obligation (Art. 6(1)(c)): Where required by law (e.g. tax, regulatory compliance)
• Consent (Art. 6(1)(a)): For optional analytics cookies and marketing communications, which you may withdraw at any time via cookie settings or account preferences

4.2 Australian Privacy Principles

Under the Privacy Act 1988 (Cth), we collect personal information only where reasonably necessary for our functions and activities, and by lawful and fair means. Where practicable, we collect information directly from you. We do not use or disclose personal information for direct marketing without your consent.

4.3 PIPEDA (Canadian Users)

For Canadian users, we collect, use, and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances. We obtain meaningful consent before or at the time of collection. You may withdraw consent at any time, subject to legal or contractual restrictions.

4.4 Privacy Act 2020 (New Zealand Users)

For New Zealand users, we comply with the Information Privacy Principles (IPPs). We collect personal information directly from you where possible, for a lawful purpose connected with our business, and only to the extent necessary. We take reasonable steps to ensure information is accurate, complete, and up-to-date.

5. Data Sharing and Disclosure

We do not sell your personal information. We do not share your data with third parties for their own marketing purposes. We may share data with:

• Service Providers: Cloud hosting (Supabase / AWS), payment processing (Stripe), email delivery (Resend), and analytics (Google Analytics), under strict data processing agreements
• Accounting Platforms: Xero, QuickBooks, Sage, MYOB, and Reckon, when you authorise integrations
• AI Providers: To power AI features including coaching, diagnostics, and automated commentary. Financial data sent to AI models is transient and not retained by the provider for training purposes
• Shared Users: When you share a business with an advisor, investor, or collaborator, limited to the data and permissions you explicitly grant
• Legal Authorities: When required by law, court order, or to protect our rights, safety, or property
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with advance notice where practicable

5.1 Sub-Processors

We use the following categories of sub-processors:

• Infrastructure & Hosting: Cloud database, authentication, storage, and edge compute (Sydney region primary)
• Payment Processing: Stripe (PCI DSS Level 1 compliant)
• Transactional Email: Resend
• Analytics: Google Analytics 4 (subject to your cookie consent preferences)
• AI Models: Large language models for coaching, commentary, and diagnostics, processed under data processing agreements with no model training on your data

6. International Data Transfers

Our primary infrastructure is hosted in the Sydney, Australia region. Your data may also be processed in other jurisdictions (including the United States) by sub-processors. For international transfers we rely on:

• EEA/UK: Standard Contractual Clauses (SCCs) approved by the European Commission, and UK International Data Transfer Agreements (IDTAs)
• Canada: PIPEDA adequacy, the EU recognises Canada (PIPEDA-covered organisations) as providing adequate protection
• New Zealand: Recognised as adequate by the European Commission; compliant with IPP 12 (Disclosure of personal information outside New Zealand)
• Australia: APP 8 compliance, we take reasonable steps to ensure overseas recipients handle information consistently with the APPs

7. Data Retention

We retain your data as follows:

• Active Accounts: Data is retained for as long as your account is active
• Post-Closure: After account closure, we retain data for up to 7 years to comply with Australian tax and corporate law requirements, unless you request earlier deletion
• User-Initiated Deletion: When you exercise your right to erasure, we permanently delete your personal and financial data promptly, except where retention is required by law
• OAuth Tokens: Integration tokens are deleted immediately upon disconnection of the accounting platform
• AI Conversations: Retained while your account is active; deleted upon account closure or at your request
• Backup Systems: Data may persist in encrypted backups for up to 30 days after deletion

8. Data Security

We implement robust technical and organisational security measures including:

• AES-256-GCM encryption for sensitive data at rest (including OAuth tokens)
• TLS 1.3 encryption for all data in transit
• Multi-factor authentication (MFA) and passkey support
• Row-level security (RLS) database policies ensuring strict data isolation between users
• Deny-all table policies with security-definer views for sensitive credential storage
• Automated security scanning (dependency vulnerabilities, storage audits, token health)
• Session timeout and step-up authentication for sensitive operations
• Input sanitisation and output encoding to prevent injection attacks
• SOC 2 Type II aligned controls

No system is 100% secure. If we become aware of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with applicable law (within 72 hours for GDPR, as soon as practicable for APPs, and in accordance with PIPEDA breach notification requirements).

9. Your Privacy Rights

9.1 Rights Under Australian Privacy Law

Under the Privacy Act 1988 (Cth), you have the right to:

• Access your personal information held by us
• Request correction of inaccurate, out-of-date, or incomplete information
• Complain to the Office of the Australian Information Commissioner (OAIC), oaic.gov.au

9.2 Rights Under GDPR / UK GDPR (EEA and UK Users)

If you are in the EEA or UK, you have the following rights:

• Right of Access (Art. 15): Obtain confirmation of processing and a copy of your data
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to Restriction (Art. 18): Limit how we process your data
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Right to Withdraw Consent (Art. 7): Withdraw consent at any time without affecting prior processing
• Rights Related to Automated Decision-Making (Art. 22): Not be subject to solely automated decisions with legal effects

9.3 Rights Under CCPA / CPRA (California Users)

California residents have the right to:

• Know what personal information we collect, use, disclose, and sell (we do not sell)
• Delete personal information (subject to legal exceptions)
• Correct inaccurate personal information
• Opt-out of the sale or sharing of personal information (we do not sell or share for cross-context advertising)
• Non-discrimination for exercising privacy rights
• Limit the use of sensitive personal information

9.4 Rights Under PIPEDA (Canadian Users)

Canadian users have the right to:

• Access your personal information held by us
• Challenge the accuracy and completeness of your information and have it amended
• Withdraw consent to the collection, use, or disclosure of your information (subject to legal or contractual restrictions)
• Complain to the Office of the Privacy Commissioner of Canada, priv.gc.ca

9.5 Rights Under the Privacy Act 2020 (New Zealand Users)

New Zealand users have the right to:

• Access your personal information (IPP 6)
• Request correction of your personal information (IPP 7)
• Be informed of the reasons if a request for access or correction is refused
• Complain to the Office of the Privacy Commissioner, privacy.org.nz

How to exercise your rights: You may exercise these rights via Settings → Privacy in your account dashboard (including data export, deletion, and consent management), or by contacting privacy@advisorli.com. We will respond within 30 days (or the timeframe required by your applicable law).

10. Cookies and Tracking Technologies

We use cookies and similar technologies. When you first visit our website, you are presented with a cookie consent banner that allows you to accept all, reject all, or manage your preferences granularly. Your choice is stored locally and respected on all subsequent visits.

10.1 Cookie Categories

• Essential Cookies (Always Active): Required for authentication, security, session management, and core platform functionality. These cannot be disabled without breaking the Service. Legal basis: Contract performance / legitimate interest.
• Analytics Cookies (Consent Required): Google Analytics 4 (GA4), used to understand how visitors interact with our website and application. Data collected includes pages viewed, session duration, and approximate location. GA4 operates in consent mode; no data is collected until you grant consent. Legal basis: Consent.
• Preference Cookies (Consent Required): Used to remember your settings such as theme (light/dark mode) and sidebar state. Legal basis: Consent.

10.2 Managing Your Preferences

You can change your cookie preferences at any time by:

• Clearing your browser's local storage for advisorli.com (this will re-trigger the consent banner)
• Using your browser's built-in cookie controls to block or delete specific cookies

If you reject analytics cookies, we will disable Google Analytics tracking and delete any existing GA cookies from your browser. Disabling essential cookies may affect Service functionality.

10.3 Do Not Track

We respect Do Not Track (DNT) browser signals. When DNT is enabled, analytics cookies are not loaded unless you have explicitly consented via our cookie banner.

11. AI and Automated Processing

We use artificial intelligence and machine learning to power several features of the Service, including:

• AI Business Coach, conversational guidance and action items
• Automated financial diagnostics and opportunity identification
• Account mapping and chart-of-accounts standardisation
• Board pack commentary and narrative generation
• Benchmarking comparisons and valuation assistance

Important: AI-generated outputs are for informational and decision-support purposes only. They do not constitute financial, legal, or investment advice. No fully automated decisions with legal or similarly significant effects are made about you without human oversight.

Financial data sent to AI models is processed transiently and is not used to train third-party models. AI providers operate under data processing agreements that prohibit the retention or reuse of your data.

12. Children's Privacy

Our Service is intended for business users aged 18 and over. We do not knowingly collect personal information from anyone under 18 years of age. If we become aware that we have collected data from someone under 18, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by email or through the Service at least 14 days before they take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

The "Last updated" date at the top of this page indicates when the policy was most recently revised.

14. Contact Us & Complaints

For privacy-related inquiries, data subject requests, or to exercise your rights:

Jazoodle Pty Ltd trading as Advisorli 133 Sandringham Street, Sans Souci, NSW 2219, Australia Email: privacy@advisorli.com

We aim to respond to all requests within 30 days. If you are unsatisfied with our response, you may lodge a complaint with the relevant supervisory authority:

• Australia: Office of the Australian Information Commissioner (OAIC), oaic.gov.au
• United Kingdom: Information Commissioner's Office (ICO), ico.org.uk
• European Union: Your local Data Protection Authority (DPA)
• Canada: Office of the Privacy Commissioner of Canada, priv.gc.ca
• New Zealand: Office of the Privacy Commissioner, privacy.org.nz