Privacy Policy

About This Policy

This Privacy Policy explains how Meister Athlete Pty Ltd (ABN 49 162 434 513), trading as Valutten ("Valutten", "we", "us", or "our"), collects, uses, discloses, and protects your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Valutten is a commission intelligence platform for Australian mortgage brokerages, providing commission tracking, analytics, and reporting services.

This policy applies to:

• Users of the Valutten platform (brokers, administrators, office managers)
• Individuals whose data appears in commission records uploaded to our platform
• Visitors to our website
• Business contacts and prospective customers

By using our Service, you consent to the collection and use of information in accordance with this Privacy Policy. This policy should be read in conjunction with our Terms of Service.

Table of Contents

1. Information We Collect
2. How We Use Your Information
3. Legal Basis for Processing
4. Data Storage and Security
5. Data Retention
6. Disclosure of Information
7. Cross-Border Disclosure
8. Product Analytics (PostHog)
9. AI Processing
10. Mailbox Integration (Gmail and Microsoft 365 / Outlook)
11. Email Communications
12. Meta Platform Integrations
    • 12A. Calendar Availability Integration (Google Calendar)
13. Cookies and Tracking
14. Your Rights
15. Children's Privacy
16. Changes to This Policy
17. Contact Information

1. Information We Collect

We collect different types of personal information depending on how you interact with Valutten.

1.1 Information You Provide Directly

When you register for or use Valutten, we collect:

• Account Information: Name, email address, phone number, job title, company name
• Authentication Data: Password (stored encrypted), multi-factor authentication settings
• Company Information: Business name, ABN, office locations, aggregator relationships
• Commission Data: Commission records you upload including broker names, lender details, loan information, payment amounts, customer/borrower names
• Support Communications: Correspondence when you contact us for assistance

1.2 Information Collected Automatically

When you access our Service, we automatically collect:

• Device Information: Browser type, operating system, device identifiers
• Log Data: IP address, access times, pages viewed, actions taken
• Usage Information: Features used, reports generated, files uploaded
• Product Analytics: Page views, UI interactions, and error reports collected via PostHog (consent-gated; see Section 8)

1.3 Information from Third Parties

• Authentication Providers: Identity data from Google Sign-In (if enabled)
• Payment Processors: Subscription and billing data from Stripe (we do not store full payment card details)
• Gmail API: Commission email content if you enable the optional email integration (see Section 10)
• Microsoft Graph: Commission email content if you enable the optional Microsoft 365 / Outlook integration (see Section 10)

1.4 Sensitive Information

We do not intentionally collect sensitive information (as defined in the Privacy Act) such as health information, racial or ethnic origin, political opinions, or religious beliefs. The commission data you upload may contain financial information related to loan transactions, which we treat with appropriate security measures.

2. How We Use Your Information

2.1 Primary Purposes

We use your information to:

• Provide, maintain, and improve our commission tracking and analytics Service
• Process and display your commission data in dashboards and reports
• Create and manage your user account
• Communicate with you about your account, updates, and support requests
• Send transactional emails (password resets, security alerts, subscription confirmations)
• Generate AI-powered commission insights (see Section 9)
• Ensure the security and integrity of our Service

2.2 Secondary Purposes

We may also use your information to:

• Analyse product usage patterns via PostHog to improve the Service (consent-gated)
• Generate anonymised, aggregated statistics about platform usage (not identifiable to you)
• Comply with legal obligations and regulatory requirements
• Protect our rights and prevent fraud or abuse

2.3 What We Do Not Do

We will never:

• Sell your personal information or commission data to third parties
• Share your commission data with other Valutten customers
• Use your data for purposes unrelated to providing our Service without your consent
• Send marketing communications without your express consent
• Use commission data to train AI models (data is used for inference only, not training)

3. Legal Basis for Processing

Under the Australian Privacy Principles, we collect and process your personal information on the following bases:

• Consent: You have provided consent by creating an account and uploading data. For analytics and AI features, separate opt-in consent is obtained.
• Contractual Necessity: Processing is necessary to provide our Service under the Terms of Service
• Legal Obligation: Processing is required to comply with Australian law (e.g., record keeping requirements)
• Legitimate Interests: Processing is necessary for our legitimate interests in improving our Service, provided this does not override your rights

4. Data Storage and Security

4.1 Data Location

Primary data is stored in Google Cloud Platform's australia-southeast1 (Sydney) region. This includes your commission data (BigQuery), user accounts (Firestore), uploaded files (Cloud Storage), and audit logs.

Limited data is processed by overseas providers as disclosed in Section 7. This includes authentication tokens (Firebase Authentication, US), product analytics events (PostHog, EU), AI inference requests (Anthropic, US), transactional email delivery (Resend, US), payment processing (Stripe, US/Global), and Meta platform integrations for lead capture and Page messaging (Meta, US/Ireland) where you have explicitly connected a Meta Page.

4.2 Security Measures

We implement industry-standard security measures including:

4.3 Security Incident Response

In the event of a data breach likely to result in serious harm, we will:

1. Contain the breach and assess the impact
2. Notify the Office of the Australian Information Commissioner (OAIC) within 72 hours
3. Notify affected individuals as soon as practicable
4. Take steps to prevent future breaches

5. Data Retention

5.1 Retention Periods

5.2 Account Deletion

When you delete your account, we will remove your personal information within 90 days. However, commission data may be retained as required by law (7-year retention period for financial records under the Corporations Act 2001). Retained data will be anonymised where possible. Backups are retained for disaster recovery (maximum 30 days after deletion).

6. Disclosure of Information

6.1 Disclosures Within Your Organisation

We disclose personal information to authorised users within your organisation based on their assigned roles and permissions:

• Company administrators can view all users and brokers within their company
• Office administrators can view users and data within their assigned offices
• Brokers can view their own commission data only

6.2 Service Providers

We engage the following third-party service providers who process personal information on our behalf:

All service providers are contractually obligated to protect your information, implement appropriate security measures, process data only as instructed by us, and delete data when no longer needed.

6.3 Legal Requirements

We may disclose your information if required to:

• Comply with a legal obligation, court order, or regulatory request
• Respond to requests from ASIC, AUSTRAC, OAIC, or other regulatory bodies
• Protect our rights, property, or safety, or that of our users
• Investigate potential violations of our Terms of Service

6.4 Business Transfers

If Valutten is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.

7. Cross-Border Disclosure

While our primary data infrastructure is in Australia (GCP australia-southeast1), certain service providers process limited categories of data outside Australia. Under APP 8, we disclose the following:

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient is subject to a law or binding scheme substantially similar to the Australian Privacy Principles, or has contractually agreed to handle the information in accordance with the APPs.

By using Valutten, you consent to the international transfers described above. If you do not consent, please contact us to discuss alternatives, noting this may limit available functionality.

8. Product Analytics (PostHog)

We use PostHog (EU-hosted at eu.posthog.com) for product analytics, routed through our own servers to ensure reliability. Analytics data collection requires your opt-in consent.

8.1 What We Collect

• Page views and navigation patterns
• UI interactions (button clicks, feature usage)
• Error reports and performance metrics
• Device type and browser information

8.2 What We Do NOT Collect

• Session recordings: Disabled; we do not record your screen
• Console logs: Disabled; we do not capture browser console output
• Form input values: Masked; we do not capture text you type into forms
• Commission data: Never sent to analytics

8.3 Consent and Control

• Opt-in: Analytics data is only collected after you consent via the consent banner
• Settings: You can manage your analytics preferences at any time in Settings > Privacy
• Do Not Track: We respect the Do Not Track (DNT) browser signal: if your browser sends DNT, no analytics events are collected
• Ad blockers: Analytics is routed through our own domain to ensure data integrity, but blocking it will not affect platform functionality

9. AI Processing

Valutten uses Anthropic's Claude AI to provide commission intelligence features. This section explains what data is sent, how it is protected, and your opt-out rights.

9.1 AI-Powered Features

• First-Login Briefing: An automated summary of your company's commission activity, generated on first login for administrators
• AI Assistant: Natural-language queries about your commission data (e.g., "What was our trail income last quarter?")

9.2 PII Protection

Before any data is sent to Anthropic:

• Broker names are replaced with opaque tokens (e.g., [VT_BROKER_0])
• Lender names are replaced with opaque tokens (e.g., [VT_LENDER_0])
• Loan IDs are omitted entirely from AI requests
• Dollar amounts and date ranges are included as they are necessary for meaningful analysis
• Tokens are mapped back to real names only within our Australian infrastructure after the AI response is received

9.3 Data Retention by Anthropic

Anthropic may retain prompts for up to 30 days for safety and abuse monitoring purposes. Prompts are not used to train AI models. After 30 days, prompts are deleted from Anthropic's systems.

9.4 Opt-Out

The AI Assistant is available to Enterprise tier subscribers. If you do not wish to use AI features, you can avoid them entirely - they are not invoked unless you navigate to the AI Assistant or trigger the first-login briefing. You may also contact us to disable AI features for your account, and we will apply an account-level block that overrides your subscription entitlement.

10. Mailbox Integration (Gmail and Microsoft 365 / Outlook)

Valutten offers optional mailbox integrations to help automate commission file imports. Two providers are supported: Google Gmail, and Microsoft 365 / Outlook via Microsoft Graph. Each integration is connected by an individual user, requires that user's explicit authorization, is read-only, and can be revoked at any time. Connecting a mailbox is never required to use Valutten. The Microsoft 365 / Outlook integration is being introduced as a limited pilot and is unavailable unless it has been enabled for your organisation.

10.1 Gmail: Scope and Access

• OAuth scope: gmail.readonly, read-only access to email messages
• What we access: Email messages matching commission-related sender addresses and subject lines (e.g., lender commission statements)
• What we extract: Attached commission files (CSV, XLSX, PDF) for processing through our pipeline
• What we do NOT access: Emails unrelated to commission statements, drafts, sent mail, or contacts

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to provide and improve the commission import feature described above; it is not transferred to others except as necessary to provide that feature, to comply with applicable law, or as part of a merger or acquisition (see Section 6.4); it is not used for advertising; and it is not read by humans except with your explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and de-identified.

10.2 Microsoft 365 / Outlook: Scope and Access

• API: Microsoft Graph, authorised through Microsoft Entra ID
• Delegated permission Mail.Read: read-only access to the mail in the mailbox of the individual user who connects the account, and only that user's own mailbox. We do not request or use tenant-wide or application permissions, so Valutten cannot read the mailbox of any other person in your organisation.
• Delegated permission User.Read: the connecting user's basic profile (account identifier and email address), used to identify and display which mailbox is connected.
• Delegated permission offline_access: a refresh token so scheduled imports can continue without asking the user to sign in again.
• What we read: for messages from commission sender addresses that carry attachments: the sender address, the received date, the subject, and attachment names; and the attachment bytes of commission files only.
• What we do NOT access: message bodies, messages from senders outside the commission sender list, calendars, contacts, files, Teams messages, or any other Microsoft 365 data. (The mailbox integration described in this Section 10 has no calendar access of any kind. The separate, separately consented Calendar Availability integration in Section 12A is a different connection with a different scope, and is currently offered for Google Calendar only.)

10.3 Microsoft 365: Administrator Consent

Depending on your organisation's Microsoft 365 settings, your Microsoft 365 administrator may need to grant consent to Valutten before a user can connect a mailbox. Consent granted at the organisation level authorises Valutten to use the delegated permissions listed in Section 10.2 on behalf of users who individually choose to connect their own mailbox. It does not give Valutten access to the mailbox of any user who has not connected one.

10.4 Data Storage

Extracted commission files are stored in our Australian infrastructure (Cloud Storage, australia-southeast1) and processed identically to manually uploaded files. We do not store the full email body; only the extracted attachments and metadata needed for processing (sender, subject, date). This applies to both providers.

OAuth tokens for both providers are held in Google Secret Manager and are never exposed to your browser. Microsoft tokens are stored in Google Secret Manager with storage pinned to the Australian region australia-southeast1.

10.5 Overseas Processing

Mailbox contents are read through each provider's APIs, which are operated outside Australia: Google (United States) and Microsoft (Microsoft Graph endpoints are operated by Microsoft outside Australia; the datacentre holding your Microsoft 365 mailbox depends on your Microsoft tenant). Before disclosing personal information overseas we take the reasonable steps required by APP 8, as described in Section 7, which lists both providers.

10.6 Revocation

You can revoke Gmail access at any time by:

• Visiting your Google Account > Security > Third-party apps with account access
• Contacting us at support@valutten.com

You can revoke Microsoft 365 / Outlook access at any time by:

• Using Disconnect in Valutten (Settings > Connected Accounts). This deletes the stored Microsoft token from our systems and stops all future imports from that mailbox.
• Removing the application on the Microsoft side: for a personal Microsoft account, under your Microsoft account privacy settings ("Apps and services you have given access to"); for a work or school account, in Microsoft Entra My Apps (myapps.microsoft.com) under the application's "Manage your application" options. Your Microsoft 365 administrator can also remove the enterprise application for the whole organisation.
• Contacting us at support@valutten.com

Microsoft does not provide an endpoint that lets an application revoke its own tokens remotely. Disconnecting in Valutten deletes our copy of the token so we can no longer use it; removing the application on the Microsoft side additionally revokes the consent held at Microsoft.

Revoking access stops future email imports but does not delete commission data already processed (retained per Section 5).

11. Email Communications

11.1 Transactional Emails

We send transactional emails via Resend for:

• Account verification and password resets
• Security alerts (new sign-in, MFA changes)
• Subscription confirmations and billing receipts
• Team invitations

Tracking pixels are disabled on all transactional emails. We do not track whether you open transactional emails or click links within them.

11.2 Marketing Emails

Marketing emails require your explicit opt-in consent, collected during the subscription checkout process via Stripe. You may unsubscribe at any time via the unsubscribe link in any marketing email, or by contacting us. We comply with the Spam Act 2003 (Cth) for all commercial electronic messages.

11.3 Email Sender

Emails from Valutten are sent from addresses on the valutten.com domain (for example dieter@valutten.com, support@valutten.com, onboarding@valutten.com, or notifications@valutten.com). These are monitored addresses and you can reply to them. We authenticate all outgoing email with SPF, DKIM, and DMARC to protect against spoofing.

12. Meta Platform Integrations

Valutten offers optional integrations with Meta platforms (Facebook and Instagram) to help your team capture leads and respond to customer enquiries from a single inbox. These integrations are off by default and are only enabled when an authorised user of your organisation connects a Facebook Page through Settings > Integrations > Meta.

12.1 Scope of Integration

• Meta Lead Ads (live): Valutten receives lead form submissions from Facebook and Instagram ad campaigns operated by your connected Facebook Page, delivered via Meta's Webhooks API.
• Meta Page Messaging (subject to Meta App Review approval of the pages_messaging permission): Valutten surfaces direct messages sent by Facebook users to your connected Page inside the Valutten lead inbox so your team can respond from within the platform. This feature is available only after Meta grants the permission and you enable it on your Page.

12.2 Information We Receive from Meta

We do not receive a Facebook user's broader profile, friends list, ad preferences, location, or content posted outside the conversation with your Page.

12.3 How We Use This Information

• Route incoming leads and Page messages into your Valutten lead inbox according to the routing rules your organisation has configured
• Trigger assignment notifications to the responsible user in your team
• Display the conversation thread so an authorised user can respond from inside Valutten
• We do not share Meta-sourced personal information with other Valutten customers and we do not use it for marketing, training of AI models, or any purpose other than operating the integration you enabled

12.4 Authentication and Security

• OAuth credentials issued by Meta (Page Access Tokens and, where applicable, System User tokens) are stored encrypted in Google Secret Manager in our Australian infrastructure (australia-southeast1)
• Webhook payloads from Meta are verified via HMAC-SHA256 signature using the Meta App Secret before processing; payloads that fail signature verification are rejected
• The integration uses least-privilege OAuth scopes appropriate to each capability (for example, leads_retrieval, pages_show_list, pages_manage_metadata, and, where granted, pages_messaging)
• All communications with Meta are over TLS 1.2+ encrypted channels

12.5 Retention

• Leads and message threads are retained inside your Valutten tenant for the same period as other CRM records (the life of your active account, plus 90 days after deletion, unless an earlier deletion is requested)
• Meta-issued tokens are refreshed periodically; when you disconnect an integration the tokens are revoked at Meta and deleted from our Secret Manager
• Webhook delivery logs are retained for 180 days for deliverability monitoring

12.6 Lawful Basis and Notice to Lead Submitters

When you run Meta Lead Ads, you are the controller of the data subject's lead submission and you are responsible for the privacy notice presented to the lead inside the Meta lead form, as required by Meta's Terms for Lead Ads. Valutten acts as your processor for the purpose of receiving, storing, routing, and surfacing those submissions inside your tenant.

For Page Messaging, Meta presents its own messaging notices to the Facebook user; by sending your Page a message the user has initiated a 1:1 conversation that we surface to your team in line with Meta's Platform Terms.

12.7 Revocation

You can disconnect a Meta integration at any time. Either:

• Inside Valutten (Settings > Integrations > Meta), choose Disconnect; or
• Inside Meta (Business Manager > Business Settings > Integrations > Apps), locate Valutten, and remove access

Either action immediately revokes our tokens and stops further lead or message ingestion from that Page. Records already received remain inside your tenant per Section 12.5 unless you separately request deletion under Section 14.

12A. Calendar Availability Integration (Google Calendar)

Numbered 12A rather than 13 deliberately: the existing Sections 13 to 17 are cited by number in our terms, our security questionnaire responses and in correspondence with customers, so they are not renumbered to insert a section.

Valutten offers an optional Calendar Availability integration. Its only purpose is to avoid assigning a new lead to a broker who is sitting in an appointment at that moment.

This integration is off by default. It is enabled for an organisation only on request, and even then it does nothing until an individual user chooses to connect their own calendar. Connecting is a personal decision by each user; an administrator cannot connect a calendar on someone else's behalf.

12A.1 Scope of Access

• API: Google Calendar API, authorised through a dedicated Google OAuth client used for this feature and nothing else.
• Scope https://www.googleapis.com/auth/calendar.freebusy: returns the start and end times of periods marked busy in the connecting user's own primary calendar, and nothing else.
• Scopes openid and email: the connecting user's account identifier and email address, used only to show which account is connected so an accidental connection is visible and correctable.

12A.2 What We Read, and What We Cannot Read

• What we read: a list of time periods, each with a start time and an end time, for the next 24 hours by default (configurable by your organisation up to 7 days).
• What we do NOT read, and cannot read with this scope: event titles, guests or attendees, locations, descriptions or notes, attachments, organisers, conferencing or meeting links, recurrence details, calendars other than the primary calendar, and any calendar belonging to anyone who has not connected one.
• What we cannot do: this scope is read-only for free/busy information. Valutten cannot create, modify, move, accept, decline or delete anything in your calendar, and cannot invite anyone to anything.

A period marked busy is reported to us as a period marked busy. We are not told what it is, who it is with, or where it is.

12A.3 Limited Use

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Calendar data is used only to provide the lead-routing availability feature described in this Section 12A; it is not transferred to others except as necessary to provide that feature, to comply with applicable law, or as part of a merger or acquisition (see Section 6.4); it is not used for advertising; it is not used to train any generalised or general-purpose artificial intelligence or machine-learning model; and it is not read by humans except with your explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and de-identified.

12A.4 Storage, Retention and Who Can See It

• Busy periods are cached in our Australian infrastructure (Firestore, australia-southeast1) and are overwritten on each refresh, which runs every five minutes while the feature is enabled. We keep no history of where you have been.
• The cache is server-side only. It is not readable by your colleagues, by your administrators, or by anyone through the Valutten application. Your organisation's administrators can see that you have connected a calendar and whether it is syncing; they cannot see what is in it.
• OAuth tokens are held in Google Secret Manager with storage pinned to australia-southeast1, and are never exposed to your browser.
• Disconnecting deletes the cached busy periods immediately, along with the stored token.

12A.5 Overseas Processing

Calendar free/busy information is read through the Google Calendar API, which is operated by Google outside Australia. Before disclosing personal information overseas we take the reasonable steps required by APP 8, as described in Section 7, which lists Google.

12A.6 Revocation

You can disconnect at any time. Either:

• Inside Valutten - on your Availability page, choose Disconnect; or
• Inside your Google Account - Security > Third-party apps with account access, locate Valutten and remove access.

Disconnecting inside Valutten revokes our token at Google, deletes it from our systems, and deletes the cached busy periods. Your organisation's administrators can also disconnect a calendar on your behalf, and every connection and disconnection is recorded in your organisation's audit log.

12A.7 If You Choose Not to Connect

Not connecting a calendar does not, by itself, stop you receiving leads. Your organisation can choose to require a connected calendar for lead routing; if it does, that is your organisation's decision, Valutten shows you clearly that it is in effect, and your administrators are warned of the consequence before they turn it on.

13. Cookies and Tracking

13.1 Essential Cookies

We use essential cookies that are necessary for the operation of our Service, including authentication tokens and session management. These cookies cannot be disabled as they are required for the Service to function.

13.2 Analytics Cookies

PostHog may set first-party cookies to track anonymous session identifiers if you consent to analytics. No third-party advertising or tracking cookies are used. We do not use Google Analytics.

13.3 Managing Cookies

You can manage cookie preferences through your browser settings or via our consent banner. Please note that disabling essential cookies may prevent you from using some features of our Service.

For detailed information about specific cookies, their purposes, and durations, see our Cookie Notice.

14. Your Rights

Under the Privacy Act 1988 and Australian Privacy Principles, you have the following rights:

14.1 Right to Access (APP 12)

You have the right to request access to the personal information we hold about you. We will provide this information within 30 days of your request, subject to verification of your identity.

How to request: Email privacy@valutten.com with your request.

Fees: We may charge a reasonable fee for access requests that require significant effort to fulfil.

Exceptions: We may refuse access where providing access would pose a serious threat to health or safety, the request is frivolous or vexatious, legal proceedings are ongoing, or denial is required or authorised by law.

14.2 Right to Correction (APP 13)

You have the right to request correction of any personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading. You can update most account information directly through your account settings.

How to request: Email privacy@valutten.com with specific details of the correction required.

14.3 Account Deletion

You can request deletion of your account and personal information by contacting us. Please note that some information may be retained as required by law (see Section 5).

14.4 Right to Anonymity (APP 2)

Where practical, you may choose not to identify yourself when dealing with us. However, this is not possible for account registration, commission data processing, or support requests where identity verification is required.

14.5 Complaints

If you believe we have breached the Australian Privacy Principles, you may lodge a complaint with us using the contact details below. We will investigate and respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with:

Office of the Australian Information Commissioner (OAIC)

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Email: enquiries@oaic.gov.au
• Address: GPO Box 5218, Sydney NSW 2001

15. Children's Privacy

Our Service is intended for business use by mortgage broking professionals and is not directed at individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete that information.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you by email and/or prominent notice within the Service at least 14 days before material changes take effect
• For significant changes that affect your rights, seek your consent where required
• Make previous versions available upon request

Your continued use of Valutten after changes take effect constitutes acceptance of the updated policy.

Australian Privacy Principles Compliance Summary

Definitions

Document Control