Privacy Policy

    Last updated: August 18, 2026

    1. Information We Collect

    We may collect the following personal information:

    • Name
    • Email address
    • Company (or "pre-company")
    • Role (e.g., founder, investor)
    • Stage
    • Messages and free-text details you provide
    • LinkedIn profile or website URL
    • Password (hashed and stored securely)
    • Display name
    • Avatar URL
    • Region
    • Marketing consent preferences
    • IP address
    • Browser user agent
    • Anonymous session ID
    • Tool interactions and result snapshots from calculators and assessments
    • Messages or prompts submitted to the AI chatbot
    • Browser type and version
    • Device information
    • Referrer URL
    • UTM parameters (source, medium, campaign)

    2. How We Use Your Information

    We use your information to:

    • Respond to enquiries and provide fractional CFO services.
    • Authenticate your identity and manage your account.
    • Deliver gated resources (PDFs, guides) you have requested.
    • Improve our tools, calculators, and platform functionality.
    • Send occasional insights or updates where you have given consent.
    • Prevent abuse, spam, and security incidents.

    We do not sell your personal information to third parties. We do not use your data for automated decision-making or profiling.

    3. Legal Basis for Processing

    We process personal data on the basis of your consent (e.g., resource downloads, marketing opt-in), contractual necessity (providing services you request), and legitimate interests (security, fraud prevention, product improvement).

    4. Data Storage & Security

    We are committed to ensuring that the personal information we collect is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the personal information and protect it from misuse, interference, loss and unauthorised access, modification and disclosure.

    We cannot guarantee the security of any information that is transmitted to or by us over the Internet. The transmission and exchange of information is carried out at your own risk. Although we take measures to safeguard against unauthorised disclosures of information, we cannot assure you that the personal information we collect will not be disclosed in a manner that is inconsistent with this Privacy Policy.

    5. Cookies & Tracking

    We use essential cookies to maintain your authentication session and basic site functionality. We may use analytics cookies to understand how our services are used. You can control cookie preferences through your browser settings.

    6. Third-Party Services

    We rely on carefully selected third-party providers:

    • Authentication and database: Lovable Cloud (powered by Supabase) for secure user management and data storage.
    • Email delivery: transactional and marketing email services for sending resource links and updates.
    • Analytics: standard web analytics to understand usage patterns.

    These providers process data only on our behalf and are bound by appropriate data protection obligations.

    7. Your Rights

    You have the right to access, correct, or delete your personal data. You can request a copy of your data or ask us to delete your account by contacting us at the email below. For users in the EU or UK, you have additional rights under GDPR / UK GDPR, including the right to data portability, the right to restrict processing, and the right to object to processing based on legitimate interests.

    8. Data Retention

    We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Account data is kept while your account is active. Upon deletion request, your data will be permanently removed within 30 days, except where retention is required for legal or security purposes.

    9. International Transfers

    Your data may be transferred to and processed in jurisdictions outside your country of residence, including Singapore and the United States, which may have different data protection laws than your country of residence. We apply appropriate safeguards for such transfers.

    10. Changes to This Policy

    We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

    11. Contact Us

    If you have any questions about this Privacy Policy, or wish to exercise your data rights, please contact us at contact@whyterabbit.com.au.