Privacy Policy

01Who we are

Assetwise ("Assetwise", "we", "us", "our") is a personal asset register and document service operated by Cognify Labs Pty Ltd (ACN 683 272 228 · ABN 39 683 272 228), the team behind AdviceGenie, of 339 Bobbin Head Road, North Turramurra NSW 2074, Australia. Cognify Labs Pty Ltd is responsible for the personal information described in this policy.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We follow them as a matter of practice, because of the kind of information Assetwise holds, whether or not a particular obligation applies to a business of our size.

02What this policy covers

This policy applies to:

• this website, assetwise.advicegenie.com.au;
• the Assetwise platform at /app/, where you create an account and keep your register;
• the demo at /demo/;
• emails we send you (account, reminder and invitation emails); and
• any contact you have with us, such as support requests.

It doesn't cover other websites we link to (for example, an insurer's site or Stripe's checkout pages), which have their own privacy policies. AdviceGenie's other services have their own policies.

03What we collect

Your account

• Your name and email address.
• Your password — held by our sign-in service (Amazon Cognito) in a form we can't read. We never see or store your password.
• Your role in your household (owner or member), access level (edit or view-only), account status, and the plan you are on.

Your register

Everything you choose to record, which can include:

• Assets: descriptions, categories, purchase dates and prices, suppliers, serial numbers, model numbers, IMEIs, vehicle identification numbers (VINs), registration numbers, odometer and service details, photos, notes, and where each item is kept.
• Property: addresses, title references, purchase and valuation details, estimated rebuild cost, and the names and phone numbers of property managers and lenders you record.
• Warranties and returns: warranty periods, extended warranties and return windows.
• Insurance: insurers, policy numbers, policy types, sums insured, premiums, renewal dates, which items each policy covers, and the clauses we read from a Product Disclosure Statement (PDS).
• Claims: claim numbers, dates, status history and notes.
• Payment cards: only the last four digits of a card you record as having paid for an item, its issuer, and the card's insurance terms if you upload them. We never need, and our AI pipeline never keeps, a full card number.
• Tax-relevant notes: your own statement of the work-use share of an item and how you worked it out, and whether you are registered for GST.
• Reminders and settings: custom reminders, dismissed alerts, categories and preferences.

Documents you upload

• The original file (PDF, photo or text file), kept unchanged.
• The text read from it, page by page, and the details extracted from it (for example supplier, ABN, items, totals, GST, warranty terms, policy terms), each with a confidence score and page reference.
• A fingerprint (SHA-256 hash) of the file, so we can tell you when you upload the same document twice.

Your questions to the assistant

The questions you ask the Assetwise assistant and the answers it gives, so we can show them to you and keep the service working.

Billing

If you buy a paid plan, payment is handled by Stripe. Your card details are entered into Stripe's own secure form and go straight to Stripe — we never see or store them. We receive and keep a Stripe customer reference, your plan, its status and renewal date, and payment confirmations.

Household members and invitations

If you add someone to your household or invite a friend to Assetwise, we collect their email address (and, for an invitation, any short message you write). See Information about other people.

Activity and technical information

• A household activity log — who in your household added, changed or deleted what, and when — so you can see the history of your register.
• Usage counts needed to apply plan limits (for example the number of AI scans used this year and uploads today).
• Operational and security logs: your account identifier, the request made, the time, error details, and your IP address as seen by our hosting provider. These logs are designed to exclude the content of your documents and register.

Visits to this website

When you visit the marketing pages of this website (not the platform or the demo), a small first-party script records the visit: a random visitor identifier and session identifier (stored in two cookies — see Cookies), the page address, the referring page, the page title, your browser's language and time zone, screen and window size, device type information your browser reports (such as platform, processor count and memory class), connection type, how long you stayed and how far you scrolled. Our server also records your IP address, your browser's user agent and the country worked out from your IP address. We use this to understand how people find Assetwise. It isn't linked to your Assetwise account and isn't used for advertising.

When you contact us

Your name, email address and whatever you tell us in your message.

04How we collect it

• From you — when you create an account, fill in your register, upload documents and photos, ask the assistant a question or contact us.
• From your documents — the text and details we read from the files you upload.
• From your household owner — if the owner of a household adds you as a member, they give us your email address.
• From Stripe — confirmation of payments and subscription changes.
• Automatically — technical and activity information when you use the website and platform.

We don't buy personal information, and we don't collect information about you from data brokers or social media.

05Why we use it

We use personal information to:

• Provide Assetwise: keep your register, store and show your documents, work out warranty and renewal dates, compare your recorded values with your sums insured, and answer your questions about your own records.
• Read your documents (paid plans), so you don't have to type everything in — see How the AI reads your documents.
• Send you the emails you've asked for — account verification, password resets, renewal and warranty reminders, and notices that someone has added you to a household.
• Manage your account and plan, including applying plan limits and processing payments.
• Keep Assetwise secure — scanning uploads for malware, preventing abuse and fraud, investigating problems and protecting our users.
• Support you when you contact us.
• Improve Assetwise, using aggregated or de-identified usage information (for example, how many documents fail to read) rather than the content of your register.
• Meet our legal obligations, such as tax record-keeping and responding to lawful requests.

What we don't do

• We don't sell, rent or trade your personal information.
• We don't use your register or documents for advertising or to build marketing profiles.
• We don't pass your information to insurers, retailers, lenders or brokers to market to you.
• We don't use your documents, register or questions to train AI models, and neither does our AI provider.
• We don't look at the contents of your register except where you ask us to (for example, in a support request), where it's needed to fix a fault or investigate abuse, or where the law requires it.

06How the AI reads your documents

On paid plans, Assetwise uses AI to read receipts, invoices, warranties and insurance documents, and to answer questions about your records. On the Free plan you enter details by hand and the assistant answers from your records without AI. Here is exactly what happens:

1. Malware scan. Every upload is scanned for malware first. A file that isn't cleared is deleted and never processed.
2. Reading the text. If the file already contains text (most PDFs), we read it directly. Otherwise, Amazon Textract reads the text from the image, in AWS's Sydney region. The file never leaves our private, encrypted storage.
3. Hiding personal details. Before any text is sent to the AI model, Assetwise replaces the personal details it recognises with placeholders such as ⟦NAME_1⟧. This includes your name and email, property addresses and title references, serial numbers, VINs, registration and policy numbers you've recorded, and anything that looks like an email address, Australian phone number, street address, card number, tax file number, Medicare number, bank account number, date of birth or licence number. Full card numbers are reduced to their last four digits and can't be restored.
4. The AI model. The masked text is read by an Anthropic Claude model through Amazon Bedrock, using AWS's Australian inference profile, so the request is processed in AWS's Sydney or Melbourne regions. Under AWS's terms, Amazon Bedrock doesn't use our prompts or the model's answers to train models and doesn't share them with the model's developer.
5. Putting details back. The placeholders in the AI's answer are swapped back for the real values inside our own system. The link between placeholders and real values exists only for that one request — it isn't logged, stored or sent anywhere.
6. You confirm. You see every extracted value with its confidence and the page it came from. Nothing is added to your register until you confirm it.

We keep the AI's answer (still containing placeholders) with your document as a record of how each value was extracted. We don't keep logs of the text sent to or received from the AI model.

In the demo, the AI isn't used. Documents are read by software running in your own browser and are stored only on your device.

07Automated decisions

We don't use computer programs to make decisions about you that could reasonably be expected to significantly affect your rights or interests.

Assetwise does use automated processing to suggest information and to calculate figures from your records:

• suggesting the details of a document (supplier, items, prices, warranty and policy terms) and which asset or policy it belongs to — you review and confirm every suggestion;
• working out warranty expiries, renewal dates, return windows and service reminders from the dates you've recorded;
• comparing the values you've recorded with the sums insured on your policies, and showing which policy clauses relate to an item — a comparison of your own records, not a decision about your cover;
• applying the limits of your plan (for example, the number of AI scans per year).

These use the information in your register and your uploaded documents. None of them decides whether you get insurance, credit, a claim payment or any other service from anyone. Your insurer makes its own decisions under its own policy terms.

08Who we share it with

People in your household

Everyone you add to your household can see your household's register and documents. Members with edit access can change it; view-only members can't. Only the household owner can add or remove members, change the plan or delete the household.

Your adviser — only with your consent

We are building a way for you to let a financial adviser, broker or other professional view your register. They will only be able to see it if you give consent, and you'll be able to withdraw it. An adviser, broker or employer that pays for your plan does not get access to your register by paying — only your own consent does.

Service providers

We use a small number of service providers to run Assetwise. They handle personal information only to provide their service to us, under contract.

Other disclosures

• When the law requires it — for example, a court order, or a request from a regulator or law enforcement agency that we are legally required to answer. Where we're allowed to, we'll tell you.
• To protect people — where we reasonably believe it is necessary to lessen or prevent a serious threat to someone's life, health or safety, or to deal with suspected unlawful activity, as the Privacy Act permits.
• If our business changes hands — if Assetwise is sold or merged, your information may pass to the new owner, who must continue to protect it under this policy. We'll tell you before that happens.
• With your consent — in any other case, only if you ask us to or agree.

09Information sent overseas

Your register, your documents and the text read from them are stored and processed in Australia. AI requests are processed in AWS's Australian regions.

Some information does leave Australia:

• Payments: Stripe may process your billing information in the United States.
• Fonts: when a page loads, your browser asks Google's servers (mainly in the United States) for our fonts, which shares your IP address and browser details with Google.
• Website delivery: CloudFront may serve this website's pages from a location outside Australia if that is nearest to you — for example, when you travel.
• Visitor country lookup: the IP address of a visitor to our marketing pages is sent to ip-api.com, a service based outside Australia, to work out the visitor's country.

We choose providers with strong security practices and take reasonable steps to make sure they handle personal information consistently with the APPs.

10How we protect it

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. These include:

• Encryption: all connections use HTTPS. Documents are encrypted at rest with an encryption key used only by Assetwise; the database is encrypted at rest.
• Private documents: document storage is private and blocks all public access. Your browser receives a document through a private link that expires within five minutes.
• Separation between households: every request is checked against the signed-in person's own household, which is worked out on our server — never from information the browser sends. We test that one household can't read or change another's records.
• Least privilege: each part of the system can only reach what it needs. For example, the part that answers web requests can't call the AI model, and the activity log can't be edited or deleted through the app.
• Malware scanning of every upload before anything opens it, and checks that each file is what it claims to be.
• Backups and versioning: the database can be restored to any point in the last 35 days, and stored documents keep previous versions for 30 days, to protect against accidental or malicious loss.
• Account protection: passwords must meet minimum strength rules, sessions expire, and suspended accounts are signed out everywhere immediately.
• Limited internal access: only authorised Cognify Labs staff can access production systems, and only for running and supporting Assetwise.

No system can be guaranteed completely secure. You can help by using a strong, unique password, keeping it to yourself, signing out of shared devices, and only adding people you trust to your household.

Found a security issue? Please email info@advicegenie.com.au with the subject "Assetwise security".

11How long we keep it

We keep personal information only for as long as we need it, then delete or de-identify it.

When a household is deleted we keep a single entry recording that the deletion happened, with personal details removed.

12Access, correction and export

You have the right to ask for access to the personal information we hold about you and to ask us to correct it.

• Most of it is already in your hands. You can view and edit your register, documents and settings at any time in the platform.
• Export: in Settings you can download your whole register, with your original documents, as a ZIP file.
• Anything else: email info@advicegenie.com.au. We'll need to confirm your identity first. We'll respond within 30 days, and there's no charge.

If we refuse a request, we'll tell you why in writing (unless that would be unreasonable) and how to complain. If we don't agree to correct information, you can ask us to attach a statement that you believe it is inaccurate, out of date, incomplete, irrelevant or misleading.

13Deleting your account

• Household owners can permanently delete the household in Settings. This deletes every record, document and photo in the household, removes your sign-in account, and stops all access straight away. Deletion can't be undone, so export anything you want to keep first.
• Household members can ask the owner to remove them, or email us.
• You can delete individual assets, documents and policies at any time.

After deletion, copies remain only in the time-limited backups and document versions described in How long we keep it, and are then removed automatically. We don't restore from backups except to recover from an incident.

If you'd like your marketing-page visit history deleted, email us — or clear this site's cookies, which disconnects future visits from past ones.

14Cookies and browser storage

We don't use advertising or cross-site tracking cookies.

You can block or delete cookies in your browser settings. Blocking the marketing-page cookies doesn't affect how Assetwise works. Clearing the platform's browser storage signs you out.

15Using Assetwise without identifying yourself

You can read this website and try the full demo without telling us who you are. To keep a register in the platform you need an account with a working email address, so we can verify it, keep your data secure and let you reset your password. You don't have to use your full legal name. If you contact us without identifying yourself, we'll help where we can, but we can't discuss or change an account without confirming you own it.

16Information about other people

Your register and documents may include information about other people — a household member, a property manager, a person named on a policy, or a family member's belongings. When you give us someone else's information:

• please only include what you need, and make sure you're entitled to share it;
• if you add someone as a household member, let them know — they'll get an email from us, and they'll be able to see the household's register; and
• if you invite a friend, we send one email with your name and message. We don't add them to any list or contact them again unless they sign up.

Anyone whose information is in a register can contact us about it.

17Children

Assetwise is designed for adults managing their household's records and isn't directed at children. Accounts are for people 18 and over. A register may record things that belong to children in the household, but we don't knowingly collect personal information directly from children. If you believe a child has created an account, contact us and we'll delete it.

18Emails we send

We send service emails that are part of using Assetwise: account verification, password resets, reminders you've set up, renewal and warranty alerts, household notices and important changes to the service or this policy.

We only send marketing emails (such as news about new features) if you've agreed to receive them, and every one includes a way to unsubscribe. Unsubscribing doesn't stop service emails you need.

19Data breaches

If we suspect a data breach, we act quickly to contain it and assess it. Where a breach is likely to result in serious harm, we will notify the people affected and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme, and tell you what happened and what you can do to protect yourself.

20Questions and complaints

If you have a question about privacy, or think we've mishandled your personal information, please contact us first:

Tell us what happened and what you'd like us to do. We'll acknowledge your complaint within 5 business days, investigate, and give you a written response within 30 days.

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

• Online: oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

21Changes to this policy

We'll update this policy when the way we handle personal information changes, or when the law does. The date at the top shows when it last changed. If a change materially affects how we handle your information, we'll tell you by email or in the platform before it takes effect.