Privacy Policy

CatenaHQ — Investor Readiness Platform

⚠️ DRAFT — FOR LAWYER REVIEW
This document is a draft and has not been reviewed by a qualified legal professional. It must be reviewed and approved by a lawyer before CatenaHQ launches commercially.

Effective Date: [To be confirmed]

Last Updated: 20 September 2026

Anthony Owen trading as CatenaHQ (ABN 30 519 768 584) ("we", "us", "our") operates the CatenaHQ platform ("Platform"). We are committed to protecting the privacy of your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains what information we collect, how we use and protect it, and your rights in relation to it.

1. Information We Collect

1.1 Account Information

When you register for the Platform, we collect:

  • Full name and email address
  • Company name
  • Password (stored as a cryptographic hash — we never store plain-text passwords)

1.2 Profile Information (Progressive Capture)

As you use the Platform, we may ask you to provide additional information to improve your experience:

  • Sector/industry, company stage, location
  • Raise target, entity type, ABN/ACN

This information is optional and collected progressively as you engage with Platform features, not required at registration.

1.3 Business and Corporate Data

You may choose to enter business data into the Platform, including:

  • Shareholder registers, cap tables, and shareholding data
  • Investor information and verification records
  • Board governance records, minutes, and resolutions
  • Financial models, projections, and KPIs
  • Due diligence documents and presentations
  • Compliance records, R&D tax claims, and grant applications

This data is entered by you and remains under your control.

1.4 Technical and Usage Data

We automatically collect:

  • Login timestamps and session data
  • Browser type and device information
  • Pages visited and features used within the Platform
  • Error logs and performance data

1.5 Communications Data

When you use the Platform to send emails to shareholders, investors, or other contacts, we process the recipient email addresses, names, and message content for the purpose of delivering those communications via our email service provider.

1.6 Inbound Email Data

When recipients reply to emails sent via the Platform, those replies are captured and stored in your Platform inbox, including sender email address, name, subject line, and message content.

1.7 Task Data

When you create tasks within the Platform, we store task titles, descriptions, due dates, priority levels, status, comments, and assignment information.

1.8 Grant Data

When you use the grant discovery tools, we store information about grants matched to your profile, including grant names, providers, amounts, closing dates, and your application status. AI-generated content (gap reports, application drafts) is also stored within your account.

2. How We Use Your Information

PurposeInformation UsedLegal Basis
Providing and operating the PlatformAccount, profile, business dataContract performance
Sending transactional emails (password resets, setup links, platform notifications)Email, nameContract performance
Delivering communications you initiate (shareholder updates, investor correspondence)Recipient data, message contentYour instruction
Capturing and storing inbound email replies in your inboxSender email, name, subject, message bodyYour instruction (replies to emails you initiated)
Task management and collaborationTask content, comments, assignmentsContract performance
Grant discovery and application trackingProfile data (for matching), grant records, AI-generated draftsContract performance / your instruction
AI-powered features (document review, strategy recommendations)Data you submit to AI toolsYour instruction
Improving the Platform and fixing bugsTechnical and usage data, error logsLegitimate interest
Platform announcements and updatesEmail, name, account typeLegitimate interest
Billing and subscription managementAccount data, payment metadata (via Stripe)Contract performance

3. Third-Party Services

We use the following third-party services to operate the Platform:

ServicePurposeData Shared
SendGrid (Twilio)Transactional and broadcast emailsRecipient email, name, email content
StripePayment processingPayment details (processed directly by Stripe — we do not store card numbers)
Anthropic (Claude API)AI-powered featuresContent you submit to AI tools (not stored by Anthropic after processing)
VentraIPWeb hostingAll Platform data (stored on Australian servers)

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4. Data Storage and Security

4.1 Storage Location

Your data is stored on servers located in Australia, managed by our hosting provider VentraIP.

4.2 Security Measures

We implement reasonable security measures including:

  • SSL/TLS encryption for all data in transit
  • Passwords stored using industry-standard cryptographic hashing (bcrypt)
  • Session security with secure, HTTP-only cookies
  • Role-based access controls (founders see only their data; partners see only their clients' data)
  • Sensitive configuration files (API keys, database credentials) are not publicly accessible

No system is completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security.

4.3 Data Retention

We retain your data for as long as your account is active or as needed to provide the Platform services. When an account is deleted, we anonymise the account (removing email and credentials) but may retain business data in anonymised form for compliance and reporting purposes.

5. Your Rights

Under the Australian Privacy Principles, you have the right to:

  • Access — request a copy of the personal information we hold about you
  • Correction — ask us to correct any inaccurate or incomplete personal information
  • Deletion — request deletion of your account and personal data (subject to legal retention obligations)
  • Data Export — request an export of your data in a reasonable format
  • Opt-out — unsubscribe from marketing communications at any time

To exercise any of these rights, contact us using the details in Section 9.

6. Partner Access

If your account was created by a Partner (such as an accelerator, fund, or company secretary), that Partner may have access to your company data within the Platform. Partners are bound by their own obligations to protect your information and use it only for the purposes of providing their services to you.

7. Cookies

The Platform uses session cookies to maintain your login state and preferences. These are essential for Platform functionality and cannot be disabled. We do not use third-party advertising or tracking cookies.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the Platform or email. The updated policy will be effective from the date posted.

9. Contact and Complaints

For privacy-related questions, access requests, or complaints, contact us at:

Privacy Officer
Anthony Owen trading as CatenaHQ
ABN 30 519 768 584
Email: anthony@catenahq.com.au
Phone: +61 497 975 000

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

© 2026 Anthony Owen trading as CatenaHQ. All rights reserved.
Terms of Use · Data Collection Notice · Return to Dashboard

Advisory Enquiry Data: When you submit an advisory services enquiry, we collect your name, email, phone, company details, sector, stage, location, services of interest, raise target, timeline, and message. This data is used to assess your enquiry and respond appropriately.

Contact Form Data: When you submit a contact form, we collect your name, email, phone, subject, and message. This is used to respond to your enquiry.

AI Support Chat: When you use the website support chat, your questions are processed by our AI assistant. Chat transcripts are not stored permanently.