Privacy Policy

We collect the following types of personal information:

We collect personal information:

• Directly from you when you create an account, enter financial data, upload documents, or interact with Frank.
• Automatically through server logs and usage analytics when you use the platform.
• From third-party services: Stripe (payment processing), Supabase (authentication), and market data providers.

We use your personal information to:

• Provide and improve the Finance Frank platform and its features.
• Generate personalised financial insights, health scores, and AI-powered recommendations.
• Process subscription payments and manage your account.
• Send service-related notifications (e.g. bill reminders, compliance alerts).
• Maintain audit logs for security and compliance purposes.
• Comply with legal obligations under Australian law.

We will not use your personal information for purposes unrelated to the above without your consent.

We share personal information with the following third parties, solely for the purpose of providing our services:

We do not sell, rent, or trade your personal information to any third party.

When you use Frank (our AI data assistant), a summary of your financial data and your conversation messages are sent to Anthropic (based in the United States) for AI processing. This includes:

• Your conversation messages with Frank.
• A contextual summary of your financial data (asset values, liability balances, income amounts, budget categories, goals, and transactions) used to provide relevant responses.
• Your profile information (name, age, state, household type) for context.

Important safeguards:

• Anthropic’s API does not use your data to train their AI models (per their commercial API terms).
• Data is encrypted in transit (TLS) between our servers and Anthropic’s API.
• We do not send raw sensitive identifiers (e.g. Tax File Numbers, bank account numbers, credit card numbers) to Anthropic.
• Other overseas providers (Stripe in the US, Supabase with US infrastructure) process data as described in Section 4 above.

By using Finance Frank, you consent to this cross-border disclosure. If you do not wish your financial data to be processed overseas, you may use the platform without the Frank AI feature.

We take reasonable steps to protect your personal information, including:

• Encryption of data in transit (TLS/HTTPS) and at rest (database-level encryption).
• Application-level Fernet encryption (AES-128-CBC with HMAC-SHA256) of sensitive fields (e.g. Tax File Number).
• Row-level security (RLS) ensuring users can only access their own data.
• JWT-based authentication with token expiry and verification.
• Rate limiting and input sanitisation to prevent abuse.
• Audit logging of API access for security monitoring.
• Security headers (X-Frame-Options, CSP, etc.) to prevent common web attacks.

Under the Australian Privacy Principles, you have the right to:

To exercise any of these rights, contact us at the details below.

In the event of a data breach that is likely to result in serious harm, we will comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988:

• Conduct a reasonable and expeditious assessment within 30 days of becoming aware of grounds to suspect a breach.
• Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable if a breach is assessed as an eligible data breach.
• Notify affected individuals directly via email, including a description of the breach, the types of information involved, and recommended steps to protect themselves.
• Take reasonable steps to contain the breach and mitigate any resulting harm.

We use essential cookies for authentication and session management. We do not use third-party advertising cookies or tracking pixels. Local storage is used for user preferences (theme, notification settings).

Finance Frank is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notification. The “Last updated” date at the top of this page reflects the most recent revision.

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).