Privacy Policy

1. What we collect

We collect the following categories of information:

• Identity and contact information: name, email address, phone number, and information you provide when registering or contacting us.
• Financial Data: with your consent, balances, transactions, holdings, account names and related account information retrieved from institutions you link, via CDR Open Banking and other secure read-only integrations.
• Consent records: records of the data-sharing consents you give and withdraw, as required under the CDR.
• Billing information: your plan, purchase history, Token usage and billing status. Card details are collected and stored by our payment processor, not by us. We hold only tokenised references and truncated card data (such as last four digits).
• Agent interactions: the questions you ask the Vecta AI agent, generated responses, and related usage metrics.
• Technical and usage data: device and browser information, IP address, log data, pages viewed, feature usage, crash reports and cookies as described in section 10.
• Support and recruitment data: information you provide in support requests, contact forms or job applications, including CVs.

2. How we collect it

• Directly from you, when you register, link an institution, use the agent, contact us or apply for a role.
• From your financial institutions through our accredited CDR data partner, with your express consent.
• Automatically, through cookies, analytics tools and server logs when you use the Service.
• From our payment processor, in the form of payment status and tokenised payment references.

3. Why we collect and use it

• To provide the Service: aggregate your accounts, display your dashboard, generate insights, alerts and AI answers.
• To operate the Vecta AI agent, including querying your structured Financial Data to answer your questions and metering Token consumption.
• To process subscriptions, Token purchases, invoices and refunds, and to detect and prevent payment fraud.
• To secure the Service: authentication, fraud and abuse detection, incident investigation and audit logging.
• To communicate with you about the Service, including service notices, security alerts and billing communications.
• To improve the Service, using aggregated or de-identified data wherever practicable.
• To comply with our legal obligations, including tax, accounting, CDR and record-keeping requirements.
• With your consent, to send product news and marketing, which you can opt out of at any time via the unsubscribe link or your settings.

4. AI processing of your data

When you ask the Vecta AI agent a question, relevant portions of your Financial Data are processed by our orchestration layer and sent to Amazon Bedrock (Amazon Nova) inside O&C Technology’s own AWS account in Asia Pacific (Sydney), ap-southeast-2, to generate a response. CDR-derived prompts are not sent to Anthropic’s public API or to any other third-party AI vendor. We apply the following safeguards:

• We send only the data reasonably necessary to answer your question.
• Inference runs in our AWS account in Sydney. AWS terms for Bedrock restrict use of customer content to provide the service and do not permit training on that content.
• Your Financial Data is not sold to anyone, for any purpose.
• Agent interactions are logged for security, quality and billing purposes and are subject to the retention rules in section 8.

Further detail about the agent, its limitations and Token consumption is in our AI Disclosure.

5. Who we disclose information to

We disclose personal information only as needed to run the Service, and never by sale. Recipients include:

• Our accredited CDR data partner, which facilitates institution connections.
• Cloud infrastructure providers hosting the Service. Production data for Australian customers is hosted in Australia (Sydney region) where available.
• Amazon Web Services (Amazon Bedrock in our AWS account, Sydney), solely to generate agent and insight text as described in section 4.
• Payment processors, to process subscriptions and Token purchases.
• Professional advisers (lawyers, accountants, auditors) under confidentiality obligations.
• Law enforcement, regulators, courts or government agencies where required or authorised by law, or where reasonably necessary to investigate suspected fraud or unlawful activity.
• A purchaser or successor entity in connection with a merger, acquisition or asset sale, subject to this policy.

6. Overseas disclosure

The Vecta application runs on Vercel in the United States. CDR copies and AI inference stay in Australia (Supabase PostgreSQL and Amazon Bedrock, both AWS ap-southeast-2, Sydney). Where we disclose personal information overseas (application hosting), we take reasonable steps to ensure the recipient handles it in a manner consistent with the APPs, including through contractual protections. CDR data is handled in accordance with the CDR Rules.

7. Security

We take security seriously and apply layered controls appropriate to the sensitivity of financial data:

• Encryption in transit (TLS) and at rest for stored data.
• Read-only data access by design. We never hold credentials for your institutions.
• Least-privilege internal access controls, with logging and review of administrative access.
• Segregated environments, secrets management and regular dependency and vulnerability management.
• Vulnerability reports are welcomed at contact@vectapp.io and handled through responsible disclosure.

No system is completely secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

8. Retention and deletion

• We retain personal information only as long as needed for the purposes described in this policy or as required by law.
• You can delete your Account and associated data permanently at any time from settings. Deletion requests are actioned promptly.
• Some records must be retained after deletion where required by law, such as tax and transaction records under the Corporations Act 2001 (Cth) and tax legislation (generally up to 7 years), and CDR consent records as required by the CDR Rules. These are retained in a restricted, access-controlled form and deleted when the obligation ends.
• De-identified or aggregated data that can no longer identify you may be retained for analytics and service improvement.

9. Access, correction and your rights

• You may request access to the personal information we hold about you, and request corrections if it is inaccurate, out of date, incomplete or misleading.
• You can exercise most rights directly in the app: update profile details, manage consents, export data and delete your Account.
• For anything else, contact contact@vectapp.io. We respond to access and correction requests within 30 days.
• You may deal with us anonymously or under a pseudonym where lawful and practicable, but most of the Service requires a verified identity to function.

10. Cookies and analytics

We use cookies and similar technologies that are necessary for the Service to function (such as session and security cookies) and, with your consent where required, analytics cookies that help us understand product usage. You can control cookies through your browser settings. Disabling necessary cookies may prevent parts of the Service from working.

11. Children

The Service is not directed at children and may only be used by people aged 18 or over. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

12. Complaints

If you believe we have breached the Privacy Act, the APPs or the CDR privacy safeguards, contact us at contact@vectapp.io with the subject line Privacy Complaint. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, phone 1300 363 992, or GPO Box 5288, Sydney NSW 2001.

13. Changes to this policy

We may update this policy from time to time. The current version is always available in the Legal hub, with the last updated date shown at the top. For material changes we will notify you by email or in-app notification.