Privacy Policy — CatenaHQ

⚠️ Draft document. This privacy policy is provided as a working draft and has not yet been reviewed by a qualified legal practitioner. It will be finalised before commercial launch. If you have questions, please contact us at anthony@catenahq.com.au.

Contents

1. About This Policy 2. Information We Collect 3. How We Use Your Information 4. Legal Basis for Processing 5. How We Share Your Information 6. Data Storage and Security 7. Data Retention 8. Your Rights 9. Cookies and Analytics 10. Third-Party Links 11. Children's Privacy 12. Changes to This Policy 13. Contact Us

1. About This Policy

This Privacy Policy describes how Anthony Owen trading as CatenaHQ ("we", "us", "our"), operating the CatenaHQ platform ("Platform"), collects, uses, stores, and discloses personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By creating an account or using the Platform, you consent to the collection and use of your personal information as described in this policy. This policy should be read together with our Terms of Use.

2. Information We Collect

Information you provide directly

Category	Examples	Purpose
Account information	Name, email address, password, company name	Create and manage your account
Company profile	Sector, company stage, entity type, ABN/ACN, location, raise target	Personalise platform features and recommendations
Business data	Shareholder details, investor information, financial data, board records, compliance items, presentations	Provide platform services (cap table, bookbuild, DD, governance, etc.)
Payment information	Billing address, subscription tier	Process subscriptions (card details are handled by Stripe, not stored by us)
Communications	Support tickets, email correspondence, feedback	Respond to enquiries and improve the Platform

Information collected automatically

Category	Examples	Purpose
Usage data	Pages visited, features used, timestamps, session duration	Improve the Platform and understand usage patterns
Device information	Browser type, operating system, IP address, device type	Security, debugging, and Platform optimisation
Log data	Login timestamps, actions performed, error logs	Security monitoring and troubleshooting

Information from third parties

If you are invited to the Platform by a partner organisation (accelerator, fund, adviser), we may receive your name and email address from that partner for the purpose of creating your account.

3. How We Use Your Information

We use your personal information to:

provide, maintain, and improve the Platform and its features;
create and manage your account;
process payments and manage subscriptions;
send transactional emails (account setup, password resets, platform notifications);
send investor communications on your behalf (using your company name and reply-to address);
provide AI-powered features (grant matching, support chat, content suggestions);
respond to your support requests and feedback;
monitor for security threats and prevent fraud;
comply with legal obligations;
generate aggregate, anonymised analytics to improve the Platform (no individual users are identified).

We will not use your personal information for purposes materially different from those described here without your consent.

4. Legal Basis for Processing

We process your personal information on the following bases under Australian privacy law:

Consent: You consent to the collection and use of your information when you create an account and agree to these terms.
Contractual necessity: Processing is necessary to provide the Platform services you have subscribed to.
Legitimate interests: We have a legitimate interest in improving the Platform, preventing fraud, and understanding how the Platform is used.
Legal obligation: We may process information where required by law, regulation, or court order.

5. How We Share Your Information

We do not sell your personal information to third parties.

We may share your information with:

Service providers: Third-party services that help us operate the Platform, including Stripe (payment processing), SendGrid (email delivery), and Anthropic (AI features). These providers are bound by their own privacy policies and data processing agreements.
Partner organisations: If your account is linked to a partner (accelerator, fund, adviser), that partner may have visibility into your platform activity and module progress through their partner dashboard. This is a core feature of the Platform and is disclosed at account setup.
Your recipients: When you send communications through the Platform (investor updates, share links, verification emails), the content is delivered to the recipients you specify.
Legal requirements: We may disclose information where required by law, legal process, or government request, or to protect our rights, safety, or property.
Business transfers: If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

6. Data Storage and Security

Your data is stored on servers located in Australia, hosted by our hosting provider (VentraIP). We take reasonable measures to protect your information from unauthorised access, loss, misuse, or alteration, including:

encrypted passwords (one-way hashing);
HTTPS/SSL encryption for all data in transit;
access controls limiting who can view account data;
regular security monitoring and testing.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Platform services. When you request account deletion:

Your identifying information (email, password) is removed or anonymised;
Your email address is freed for reuse;
Transaction records and business data may be retained in anonymised form for compliance, audit, and legal purposes as required by law;
Deleted accounts cannot be reactivated.

We may also retain certain information where we have a legal obligation to do so (e.g., tax records, regulatory compliance).

8. Your Rights

Under the Privacy Act 1988 and the Australian Privacy Principles, you have the right to:

Access: Request access to the personal information we hold about you.
Correction: Request correction of inaccurate or incomplete information.
Deletion: Request deletion of your account and personal information (subject to our data retention obligations).
Data portability: Request a copy of your data in a commonly used format.
Withdraw consent: Withdraw your consent to specific processing activities at any time (this may affect your ability to use certain Platform features).
Complaint: Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached.

To exercise any of these rights, contact us at anthony@catenahq.com.au. We will respond within 30 days.

9. Cookies and Analytics

The Platform uses cookies and similar technologies for:

Essential cookies: Session management, authentication, and security. These are necessary for the Platform to function.
Functional cookies: Remembering your preferences and settings (e.g., sidebar state, completed tours).
Analytics: We may use analytics tools to understand how the Platform is used. This data is aggregated and does not identify individual users.

We do not use advertising cookies or tracking pixels. We do not share cookie data with advertisers.

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent the Platform from functioning correctly.

10. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing personal information.

11. Children's Privacy

The Platform is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child under 18, we will take steps to delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Platform at least 14 days before they take effect. The "Last updated" date at the top of this policy will be revised accordingly.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

CatenaHQ (Anthony Owen trading as CatenaHQ, ABN 30 519 768 584)
Privacy enquiries: anthony@catenahq.com.au
Phone: +61 497 975 000
Brisbane, Queensland, Australia

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.