Data Collection Notice

⚠️ DRAFT — FOR LAWYER REVIEW
This document is a draft and has not been reviewed by a qualified legal professional. It must be reviewed and approved by a lawyer before CatenaHQ launches commercially.

Last Updated: 20 September 2026

This notice explains exactly what data CatenaHQ collects at each stage of your use of the Platform, why we collect it, and who can see it. This supplements our Privacy Policy with specific, practical detail.

The short version: We collect only what's needed to run the Platform. We don't sell your data. We don't use it for advertising. Your company data is visible only to you, your sub-users, and (if applicable) your assigned Partner.

1. At Registration

We keep registration deliberately simple. We collect only:

Full name — to personalise your experience and identify you within the Platform
Email address — your login credential and how we send transactional emails
Password — stored as a bcrypt hash (we never see or store your actual password)
Company name — used throughout the Platform as your company identifier

If you were invited by a Partner, we also record which Partner invited you so they can access your company data through their Partner dashboard.

2. Progressive Profile Capture

As you use the Platform, we ask for additional information to improve your experience. This is entirely optional and collected gradually, not all at once:

Field	Why We Ask	When We Ask
Sector / Industry	To provide relevant AI recommendations and benchmarks	When you first use a module
Company Stage	To tailor advice and templates to your growth stage	When you first use a module
Location	To provide jurisdiction-relevant guidance	On your profile page
Raise Target	To calibrate investor readiness tools and projections	When using investor readiness modules
Entity Type	To ensure correct corporate and compliance templates	On your profile page
ABN / ACN	To support future ASIC integration and compliance features	On your profile page

3. Data Collected by Module

Each module on the Platform collects data specific to its function. Below is what each module stores:

Module	Data Collected	Visible To
Investor Relations Shareholder Register	Shareholder names, emails, contact details, share classes, number of shares, transaction history	You, your sub-users, your Partner (if assigned), Platform admin
Investor Relations Cap Table	Calculated from shareholder data — ownership percentages, dilution modelling	Same as above
Investor Relations Verification	Investor names, emails, verification status, s708 certificates	Same as above
Investor Relations Communications	Email content, recipient lists, send timestamps, delivery status	Same as above
Investor Readiness Bookbuild	Investor expressions of interest, commitment amounts, contact details	Same as above
Investor Readiness Presentations	Uploaded presentation files, version history, share links, view tracking	Same as above; shared links visible to anyone with the link
Investor Readiness Due Diligence	Uploaded documents, document categories, completion status	Same as above
Corporate Board Governance	Director names, contact details, meeting minutes, resolutions	Same as above
Corporate Compliance, KPI, R&D, Grants	Business metrics, compliance checklists, grant applications, R&D activity records	Same as above
Grants Hub	Grant names, providers, amounts, closing dates, eligibility data, application status, AI-generated gap reports and draft content, match scores based on your profile	You, your sub-users, your Partner, Platform admin. Grant search queries sent to Anthropic API with web search
Inbox	Inbound email replies: sender email, sender name, subject line, message body, timestamps, read/archive status	You, your sub-users, your Partner, Platform admin
Tasks	Task titles, descriptions, due dates, priorities, module assignments, status, comments, assignment history	You, your sub-users, your Partner, Platform admin
AI Tools	Text you submit for AI analysis (document content, prompts, business context)	You, Platform admin. Sent to Anthropic API for processing (not stored by Anthropic after response)
ECF Campaign Hub	Campaign details, task assignments, stakeholder contacts, project status	You, assigned stakeholders (via token-based portal), your Partner
Raise Playbook	Module progress, saved responses, financial models, pitch deck content	You, Platform admin

4. Automated Data Collection

The Platform automatically collects:

Activity logs — login times, module usage, actions taken (for audit trail and support)
Error logs — JavaScript errors, API failures, page load issues (for bug tracking and platform stability)
Session data — encrypted session cookies to keep you logged in (30-day lifetime)

5. Data You Send to Others

When you use the Platform to send emails (shareholder updates, investor communications, document distribution), the Platform acts on your instructions. The emails are sent from CatenaHQ's email infrastructure (SendGrid) but with your company name as the sender and your email address as the reply-to address. Recipients reply directly to you, not to CatenaHQ.

6. Who Can See Your Data

Who	What They Can See	Why
You	Everything in your account	It's your data
Your Sub-Users	Data within modules you've granted them access to	Role-based access you control
Your Partner	All your company data (if you were invited by a Partner)	They're your adviser — they need it to help you
Platform Admin	All data across all accounts (aggregate and individual)	Platform operation, support, and troubleshooting
Nobody else	—	We don't share your data with advertisers, data brokers, or any other third parties

7. Data Deletion

When you request account deletion:

Your email and password are removed immediately (email freed for re-registration, password cleared)
Your personal identifiers are anonymised
Business data may be retained in anonymised form for compliance and audit purposes
Account status is set to "deleted" — login is permanently blocked

To request deletion, contact us at anthony@catenahq.com.au or use the support ticket system within the Platform.

8. Questions

If you have questions about what data we collect or how it's used, contact:

Anthony Owen trading as CatenaHQ
ABN 30 519 768 584
Email: anthony@catenahq.com.au
Phone: +61 497 975 000