Privacy Policy

Last updated: 3 June 2026

1. Overview

Evolve Mind Solutions Pty Ltd (ABN 41 672 546 217) ("we", "us", "our") operates Advisory Stack. We are committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information.

2. Information We Collect

We may collect the following categories of personal information:

  • Identity information: name, email address, phone number, ABN
  • Financial information: income details, deductions, superannuation information (as provided for tax analysis)
  • Tax file numbers (TFNs): we do not collect or store TFNs. The Platform provides tax advisory and modelling only — it does not lodge returns with the ATO — so a TFN is not required and is never requested.
  • Account data: login credentials, subscription plan, usage history
  • Technical data: IP address, browser type, device information (only collected with cookie consent)

3. Tax File Numbers (TFNs)

We do not collect or store Tax File Numbers. The Platform provides tax advisory, strategy and modelling services only — it does not lodge returns or other forms with the ATO — so a TFN is never required to use it and we do not ask for one.

  • No field on the Platform asks for a TFN, and none is stored in our database.
  • As a safeguard, the Platform includes a detection layer that recognises TFN-formatted values (and other structured identifiers such as ABNs) so they can be replaced with non-identifying placeholders before content is sent to our AI providers. Where this layer is enabled, the real value never leaves our trust boundary and is not retained by the provider; where it is not, no field on the Platform asks for a TFN in the first place.
  • We never use a TFN (or any part of it) as a login, account number, or general identifier.

4. How We Use Your Information

We use personal information to:

  • Provide tax analysis, general tax information and modelling, and AI features
  • Manage your account and subscription
  • Process payments via Stripe
  • Communicate service updates, security notices, and support responses
  • Improve Platform performance and features (with consent)
  • Comply with our legal and record-keeping obligations

5. Legal Basis for Processing

Under the APPs, we collect and process personal information where:

  • You have consented to the collection
  • It is reasonably necessary for our functions or activities
  • It is required or authorised by law (e.g., taxation law)

6. Disclosure of Information

We may disclose personal information to:

  • Your accounting firm: firm administrators can access client data within their tenant
  • Service providers (subprocessors): the providers listed below process personal information on our behalf, each for the limited purpose shown:
  • Stripe: Payment processing.
  • Resend: Transactional and notification email delivery.
  • Supabase: Database and file storage hosting (Sydney, ap-southeast-2).
  • Amazon Web Services: Application hosting (Sydney region where available).
  • Anthropic: AI processing — generates tax analysis, explanations, and draft text.
  • Voyage AI: AI text embeddings for knowledge-base search (current default). Structured identifiers in a query (e.g. TFN-formatted values, ABNs) are detected and replaced with placeholders before embedding where the de-identification layer is enabled.
  • OpenAI: AI text embeddings for knowledge-base search (used only when configured). Structured identifiers in a query (e.g. TFN-formatted values, ABNs) are detected and replaced with placeholders before embedding where the de-identification layer is enabled.
  • Cohere: AI text embeddings for knowledge-base search (used only when configured). Structured identifiers in a query (e.g. TFN-formatted values, ABNs) are detected and replaced with placeholders before embedding where the de-identification layer is enabled.
  • Google: AI text embeddings for knowledge-base search (used only when configured). Structured identifiers in a query (e.g. TFN-formatted values, ABNs) are detected and replaced with placeholders before embedding where the de-identification layer is enabled.
  • Regulatory bodies: where required by law (e.g., ATO, OAIC)

We do not sell personal information to third parties. All service providers are contractually bound to handle data in accordance with the APPs. Only one AI embedding provider is active at a time; the others are listed so that any change to our configuration never creates an undisclosed data flow.

7. Data Storage and Security

  • Data is stored on Australian-region servers where available
  • Row-level security (RLS) isolates each firm's data
  • All data in transit is encrypted via TLS 1.3
  • Sensitive data at rest is encrypted with AES-256
  • Regular security audits and penetration testing
  • Uploaded tax documents (PDFs) are parsed and immediately deleted; no long-term document storage

8. Data Breach Notification (NDB Scheme)

We comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). If we become aware of an eligible data breach that is likely to result in serious harm to any individual whose personal information we hold, we will:

  • contain and assess the breach, and take reasonable steps to remediate it where possible;
  • notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in accordance with our legal obligations; and
  • describe the breach, the kinds of information involved, and the steps we recommend you take in response.

If you believe your data held by us has been compromised, contact our Privacy Officer immediately (see clause 18).

9. Cookies and Analytics

We use cookies and similar technologies only with your explicit consent. A cookie consent banner is displayed on your first visit. You may accept or decline non-essential cookies at any time. Essential cookies required for authentication and security are always active. For a full description of the cookies we use, see our Cookie Policy.

Analytics services (PostHog for product analytics, Sentry for error monitoring) are only activated after you consent. Declining analytics cookies does not affect your ability to use the Platform.

10. AI and Automated Decision-Making

The Platform uses AI to generate tax analysis and general tax information and modelling. Text generation is powered by Anthropic Claude. To find relevant guidance, the Platform also creates numerical "embeddings" of search queries using a text-embedding provider (currently Voyage AI; OpenAI, Cohere or Google may be used if configured).

All AI requests pass through a single, audited gateway inside our systems rather than calling AI providers directly. This gateway includes a de-identification layer that can detect structured identifiers (such as TFN-formatted values and ABNs) and replace them with non-identifying placeholders before a request leaves our trust boundary, with the real values re-inserted inside our boundary on return. When this layer is enabled, we also keep an internal transparency log recording, for each AI request, what categories of identifiers were replaced and that the placeholders were restored correctly — so the handling of personal information can be reviewed. We are progressively extending this de-identification across all AI features; detection is not infallible and the safeguard is defence-in-depth, not a guarantee that no personal information is ever processed by a provider.

All AI-generated content is clearly labelled. AI outputs are general information and do not constitute personal advice, and a registered tax agent remains responsible for any advice given to you. The Platform does not make automated decisions that produce legal or similarly significant effects without human involvement, and you have the right to request human review of any AI-generated assessment — on a consumer Tax Health Check result you can ask a registered tax agent to review it before you act.

11. Your Rights

Under the Privacy Act 1988 and APPs, you have the right to:

  • Access personal information we hold about you (APP 12)
  • Request correction of inaccurate information (APP 13)
  • Request deletion of your data (subject to legal retention requirements)
  • Opt out of direct marketing communications
  • Withdraw consent for analytics cookies at any time
  • Lodge a complaint with the OAIC if you believe your privacy has been breached

12. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this policy, or as required by law. Tax-related records are retained for a minimum of 5 years in accordance with ATO requirements.

13. Children's Privacy

The Platform is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children.

14. Cross-Border Disclosure

Some of our service providers may process data outside Australia. These currently include:

  • Stripe
  • Resend
  • Anthropic
  • Voyage AI
  • OpenAI
  • Cohere
  • Google

Where this occurs, we take reasonable steps under APP 8 to ensure the overseas recipient handles personal information consistently with the Australian Privacy Principles, including binding the recipient by contract. By using the Platform you consent to these cross-border disclosures for the purposes described in this policy.

15. Serious Invasions of Privacy

In addition to the Australian Privacy Principles, Australian law provides a statutory cause of action for serious invasions of privacy. We design the Platform to minimise the personal information we hold (for example, we do not collect tax file numbers), isolate each firm's data, and restrict access, in order to reduce the risk of any such invasion. If you believe your privacy has been seriously invaded, contact our Privacy Officer (see the contact clause below); nothing in this policy limits any rights you may have under that law.

16. Office of the Australian Information Commissioner (OAIC)

If you are not satisfied with our response to a privacy concern, you may lodge a complaint with the OAIC:

  • Website: www.oaic.gov.au
  • Phone: 1300 363 992
  • Email: enquiries@oaic.gov.au

17. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or Platform notification. The "Last updated" date at the top reflects the most recent revision.

18. Contact Us

For privacy enquiries or to exercise your rights, contact our Privacy Officer at support@advisorystack.com.au.