Privacy Policy — CatenaHQ

The key points. We collect what we need to run the Platform and the information you choose to enter. Your data is hosted in Sydney. Some of our service providers, including our email, payment, analytics and AI providers, are overseas. We do not sell personal information or use it for advertising. You can ask to see or correct what we hold.

Contents

1. About this policy 2. Whose information we handle 3. What we collect 4. How we collect it 5. How we use it 6. AI features and automated scores 7. Who can see it and who we share it with 8. Overseas disclosure 9. Storage and security 10. Retention and deletion 11. Access, correction and complaints 12. Cookies and analytics 13. Email from us 14. Children 15. Changes to this policy 16. Contact

1. About this policy

This policy explains how Anthony Owen trading as CatenaHQ, ABN 30 519 768 584 ("CatenaHQ", "we", "us", "our") collects, uses, holds and discloses personal information in connection with the CatenaHQ platform and website (the "Platform"). We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Our Data Collection Notice sets out, module by module, what the Platform stores and who can see it. This policy should be read with our Terms of Use.

2. Whose information we handle

Users — founders, team members, advisers, partners and their staff who hold an account.
People whose details users enter — for example shareholders, investors, directors, employees and contacts. A company or partner using the Platform decides what to enter about these people and is responsible for having the right to do so. If your details were entered by a company, you can contact that company or us.
Visitors — people who use our website, free tools, contact forms or support chat.

3. What we collect

Kind	Examples
Account	Name, email address, company name, password (stored only as a one-way hash), passkey public key, role and access settings
Company profile	Sector, stage, location, entity type, ABN/ACN, raise target
Business records	Share registers and cap tables, shareholder and investor details, investor classifications and certificates, board records, documents, presentations, financial models, compliance, grant and R&D records, tasks
Communications	Emails and notices sent through the Platform, replies captured in the Platform inbox, support tickets, enquiries
Billing	Plan, billing status and payment records (card details are held by Stripe, not by us)
Records we keep about use	Sign-ins, actions taken, acceptance of these Terms (version, time, IP address and browser), changes to login email addresses, requests sent to our AI provider, errors
Technical	IP address, browser and device type, pages visited
Website measurement	On our public pages only: a random identifier kept in a returning-visitor cookie, the page viewed, the referring site, any campaign tags on the link you followed, screen width, the country you appear to be in, and — through Microsoft Clarity — a recording of mouse movement, scrolling and clicks on that page. Section 12 sets out the tools and how to opt out.

We do not ask for, and you should not enter, tax file numbers, bank passwords or similar sensitive identifiers.

4. How we collect it

Mostly from you: when you register, complete your profile, use the Platform or contact us. We also collect it from the company or partner who invites you or enters your details, from investors and others who respond to requests sent through the Platform (for example an investor verification), and automatically as the Platform is used.

5. How we use it

to provide, secure and support the Platform and your account;
to send the emails the Platform needs to send (set-up links, password resets, notices of changes to your login, verification and document requests you initiate);
to deliver communications you send to shareholders, investors and others;
to provide AI features, when you use them;
to process payments and manage subscriptions;
to keep records of acceptance, access and changes, for security and to meet legal obligations;
to improve the Platform, using aggregated or de-identified information where we can, and anonymised usage data (which tools are used, how often, the sector, company size and raise size, never names or contact details);
to tell you about Platform updates, which you can opt out of.

We do not sell personal information and do not use it for third-party advertising.

6. AI features and automated scores

When you use an AI feature, the content you submit is sent to our AI provider, Anthropic, to generate a response. Under its commercial terms Anthropic does not use that content to train its models and keeps it only for a limited period. We keep a log of what was sent to the AI provider.

Some tools produce scores or ratings automatically, such as readiness scores, deck ratings and grant matches. They are shown to you as guidance. We do not use automated processes to make decisions about you that have a legal or similarly significant effect.

7. Who can see it and who we share it with

Your organisation. Team members and advisers you invite see the areas you give them access to.
Your partner. If your account is managed by a partner, the partner can see and act on your company's data.
CatenaHQ administrators. To operate the Platform and provide support. Opening an account's workspace is recorded.
Recipients you choose. People you send emails, documents or shared links to.
Service providers, who handle information only to provide their service to us:

Provider	Service	Location
Amazon Web Services	Hosting and database	Sydney, Australia
Postmark (ActiveCampaign)	Email delivery	United States
Stripe	Payments and subscriptions	Australia and United States
Anthropic	AI features	United States
Google	Our own business email; web fonts loaded by your browser; Google Analytics on our public website	United States and other countries
Microsoft	Clarity, which records how our public web pages are used	United States and other countries

If you connect an external account or service to the Platform, information passes to that provider under its own terms. We may also disclose information where required or authorised by law, or to a buyer of the Platform, who would be bound by this policy.

8. Overseas disclosure

Some of the providers above hold or process information outside Australia, mainly in the United States. We use providers whose terms require them to protect the information. By using the Platform you consent to this disclosure; you can contact us if you have concerns.

9. Storage and security

The Platform's data is stored in Amazon Web Services' Sydney region. We protect it with encryption in transit, hashed passwords, passkey sign-in, access controls by account and role, notices when a login email changes, and records of administrative access. No system is completely secure. If a data breach is likely to result in serious harm, we will notify affected people and the Office of the Australian Information Commissioner where the law requires it.

10. Retention and deletion

We keep personal information while your account is active and for as long as needed for the purposes above. When an account is closed, its records stay available to read and export for 90 days. After that they are deleted and we keep only the name, email address and phone number of the account holder. Anonymised usage data, which names no one, may be kept. Some records, such as billing, acceptance and audit records, are kept for as long as the law requires or allows. A company's share register and corporate records belong to that company and are handled on its instructions. Records of investors and shareholders held for a company are that company's records: the company decides whether they are deleted after the 90 days, and is responsible for keeping any it must keep by law.

11. Access, correction and complaints

You can ask to access or correct the personal information we hold about you. Much of it can be updated directly in your profile. We will respond within 30 days. We may need to verify your identity, and we will explain if we cannot give access.

If you have a complaint, contact us first. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au.

12. Cookies and analytics

We use cookies to keep you signed in, protect your session and remember preferences. The Platform needs its sign-in cookies to work. On our public website, the pages anyone can read without signing in, we set the following cookies and collect the following information.

A returning-visitor cookie. A random identifier stored in your browser for 12 months. It lets us tell whether the same browser has come back. It is not linked to your name, email or account.
Our own analytics. The page viewed, its title, the referring site, screen width, and any campaign tags on the link you followed. This is stored on our own server in Sydney. We do not store your IP address.
Google Analytics 4. Sets its own cookies so a returning visitor can be told apart from a new one. It reports how many people visit, where they came from, which country they are in and which pages they read. We have not turned on Google’s advertising or audience-sharing features.
Microsoft Clarity. Records mouse movement, scrolling and clicks on a public page, so we can see where people get stuck. Clarity masks text typed into form fields, and we have not turned that masking off.

None of these tools runs on the Platform dashboard, so your company data, cap table, shareholder and investor records and documents are never seen or recorded by them. We do not use advertising cookies and do not sell this information or give it to advertisers.

If you would rather not be measured, your browser can block or delete cookies and block these scripts. Google publishes an opt-out add-on at tools.google.com/dlpage/gaoptout. Blocking them does not affect your use of the Platform.

13. Email from us

Service emails (set-up, password, security and billing notices) are part of using the Platform. Update and marketing emails include an unsubscribe link.

14. Children

The Platform is not intended for anyone under 18. If we learn we hold a child's information collected through an account, we will delete it.

15. Changes to this policy

We may update this policy. We will tell you about material changes through the Platform or by email. The date at the top shows when it was last updated.

16. Contact

Privacy Officer, CatenaHQ (Anthony Owen trading as CatenaHQ, ABN 30 519 768 584)
Email: anthony@catenahq.com.au
Phone: +61 497 975 000
Brisbane, Queensland, Australia