Privacy policy

We are an enquiry service. We work out what you are trying to finance, give you a calculator to estimate repayments yourself, and — only with your consent — pass your enquiry to a licensed finance broker who takes it from there. We do not provide credit assistance, we do not arrange or recommend a loan, and we are not the credit provider.

In practice: you have a conversation with our assistant about what you are trying to finance. It gives you a calculator to work out what repayments might look like on your own figures, at a rate you set. If you ask us to take it further, we pass what you told us to a licensed finance broker, who contacts you and takes it from there.

Passing your enquiry on is the point of the service. It is the main thing we do with your information, and section 5 sets out exactly what goes across, in full, because that list is longer than most people would guess. Once your enquiry reaches a broker they hold their own copy, under their own privacy policy and their own complaints process, and you will know who they are because they will be the ones who call you. How this works, and how we are paid for it, is set out in our credit guide and disclosures.

Entity

Findnance Pty Ltd

Trading as

Findnance

ACN

701 906 318

Privacy contact

support@findnance.com.au

Email is how you reach us about anything in this policy. It goes to a person, and we do not make you use a form.

Some small businesses are exempt from the Privacy Act. Whether that exemption reaches a business that passes enquiries to a broker and is paid for doing so is a question with more than one answer, and we are not going to make you guess which one applies to us. We handle your information under the Australian Privacy Principles and treat ourselves as bound by them, whether or not the exemption applies. Everything in this policy is a commitment you can hold us to.

What you tell us

The conversation asks for these in stages. You can stop at any point, and you can see indicative figures without giving us your name.

• Your contact details — your first name, your mobile number and your email address, asked for once in a single card and only when the conversation has reached a point where a person could actually help. Our records have a place for a surname; the conversation never asks for one.Why: so the broker can ring you about your enquiry, so we can email you a confirmation with a reference for it, and so we have a way to reach you if something has gone wrong.
• What you want to finance — the category — a car, a business vehicle, a truck, plant and equipment, commercial property or business funding — the amount, the purchase price, your deposit, the term, any balloon or residual, what the money is for, and how soon you want to move.Why: these are the inputs to the indicative figures the site shows you. Without them there is nothing to work out and nothing useful to hand to a broker.
• The asset — what kind of asset it is, a short description of it, its year, whether it is new or used, and whether you have already found the particular one you want. The conversation does not ask for a make or a model — if you type them they are kept as part of what you wrote, not as separate fields.Why: what an asset is and how old it is changes what finance is available for it, and a broker who already knows you have found the truck does not have to start by asking.
• Your business, where the purchase is a business one — the business name, its ABN, whether it is a sole trader, partnership, company or trust, how long it has traded, its turnover, and whether it is registered for GST. We do not look your business up anywhere: nothing is retrieved from the ABN register or from any other source, and no request about you leaves this site. What we hold is what you typed.Why: business finance is assessed on the business, not only on you, and trading history and turnover are the first two things any finance provider asks about. You can decline any of it: we record that the question was asked and that you chose not to answer, rather than guessing a number.
• You, where it is relevant to the enquiry — two things only: your employment type, and your gross income. The conversation does not ask how long you have been in the job, and it does not ask about your housing — not whether you own, rent or board, and not what it costs you.Why: so the broker who calls you can talk about affordability without starting from nothing, and because employment type is one of the inputs to the score that orders the callback queue. Being straight about the limit of it: your income does not change any figure this site shows you — the estimate is worked out from the amount, the deposit, the term, any balloon, the credit band you describe and whether you own property. Declining is a recorded answer, not a blank.
• Your financial position — whether you own property, and which band your credit history falls into as you describe it: clean, a few minor issues, significant issues, or unsure. The conversation does not ask what finance you already have or what it costs you each month.Why: both of these do change what the site works out: whether you own property decides whether some kinds of product can apply to you at all, and so does the credit band. The band is your own description of your own history. We do not check it and we do not obtain a credit report.
• The property, for a commercial property enquiry — two things: whether you are buying or refinancing, and whether the property is owner-occupied or an investment. The conversation does not ask what kind of property it is, where it is, what rent it earns, or when it settles — a broker will ask you those on the call.Why: they are the two answers that decide which kinds of commercial property finance are worth talking about, and they are enough for the first conversation. Everything else about the property is left for the person who can actually do something with it.
• How you used the conversation — when you started, how many questions you answered, how many times you changed the figures, how many separate visits you have made, whether you asked us to get it sorted or asked to speak to a person, any contact preference you chose, and phrases you used that suggest you are ready to proceed.Why: it shows us where people give up, which is how the conversation gets shorter over time, and it tells a broker whether you are still researching or ready to move.
• Where you came from — the page you landed on and its topic, the site that sent you, the campaign tags in the link you clicked (utm_source, utm_medium, utm_campaign, utm_term and utm_content), advertising click identifiers (Google's gclid, gbraid and wbraid, and Facebook's fbclid), when we first saw them, and the timezone your browser reports.Why: so we know which advertising produces real enquiries rather than clicks, which is the only way to stop paying for the advertising that does not. The timezone is here for a different reason: so a broker rings you at a civil hour where you are, rather than at a civil hour in Sydney.
• Anything else you type — the conversation is kept as a transcript, and anything you write that does not fit one of the fields above is kept as a note against your enquiry.Why: so you do not have to say it twice when a broker calls, and so we can see what we actually told you if you ask us later.

What we work out from it, and keep

• A score — four numbers out of 100 and a weighted total, with a written list of the reasons that produced them and the time they were calculated. What each of the four measures is set out below; who receives it is in section 5.Why: to order the callback queue. It decides who a specialist rings first, not whether anyone can get finance.
• An event log — a dated entry each time something happens on your enquiry — it was created, a field was captured, a figure was generated, your status changed, it was handed to a broker, a message was sent to you or about you, you unsubscribed. Each entry carries a short description and, for some kinds, a small block of structured detail. The delivery entries include the email address or mobile number a message was addressed to, which for your confirmation email is your own.Why: so there is a dated record of what happened and when, if you or we ever have to explain it. It is append-only: see section 10.
• A consent record — for each permission: which permission it is, the exact wording you were shown, the version number of that wording, where you gave it, when you gave it, and — if you withdraw it — when you withdrew it.Why: so what you agreed to stays reproducible after the wording on this page changes, and so the fact that you asked us to stop is evidenced rather than asserted.
• A written summary — a short brief of your enquiry in sentences: who you are, what you are financing, the credit position you described, how many alternative structures you tried, any phrases read as high intent, and the first few of your notes in your own words.Why: so the broker who calls you already knows what you are doing and you do not have to go through it twice. It is the paragraph they read first, so it is worth knowing it includes how you behaved as well as what you said.

The score, in more detail

The score exists to decide the order of the callback queue. It is worth setting out plainly, because it is the one thing here you cannot see and it does travel.

• Intent — how ready you appear to be: whether you asked us to get it sorted, how soon you said you want to move, whether you have already found the particular asset, whether you asked to speak to a person, whether you adjusted the figures, and phrases you used that read as ready to proceed.
• Financeability — how straightforward the enquiry looks on paper: the credit band you described, how long the business has traded, its turnover, your deposit as a share of the purchase price, whether you own property, and whether you are in full-time work. It is a rough sort, not an assessment, and nothing in it is checked against a credit file.
• Commercial value — the size of the facility, and nothing else — the amount being financed, in bands, with a small addition for a commercial property enquiry. It measures what the enquiry is worth to the business that receives it. It is not a measure of you.
• Engagement — how much of the conversation you completed: questions answered, times you changed the figures, whether you have been here before, and whether a quote was generated.

The total is a weighted average of those four, and the reasons behind every point are stored in words alongside it. It does not decide whether you can get finance and it is not a credit assessment: no lender is sent it, nothing in it is checked against a credit file, and no automated decision is made about you on the strength of it. What it decides is who a specialist rings first.

It is not shown to you on the site, and the broker who calls you is sent it — the total, the intent part and the financeability part in the alert we send the moment you leave your details, and all four parts with the reasons in the fuller record that goes to the brokerage. The enquiry email itself carries no score at all. If you want to know what your score was and why, ask us and we will tell you.

What your browser tells us

• Your visit — a random visitor identifier kept in your browser's local storage and a random session identifier kept in its session storage; when the visit started and when we last saw it; how many pages you viewed; the page you arrived on and the site that referred you; whether you are on a mobile, tablet or desktop, worked out from the width of your window rather than from any device fingerprint; the timezone your browser reports; the campaign tags and click identifiers listed above; and four markers for how far you got — chat started, contact details given, figures generated, enquiry handed over. Once you start a conversation, the visit is linked to that enquiry.Why: so we can count visitors rather than page loads, see which pages and which campaigns lead to enquiries, and see how many people abandon the conversation and where. The identifiers are random: they are not derived from anything about you and they mean nothing outside this site.
• Pages you view — the path of each page you open and the time you opened it, plus a heartbeat about every thirty seconds while the tab is open and in front of you.Why: the heartbeat is what lets us see how long a visit really lasted and who is on the site right now. It stops while the tab is hidden, so a forgotten tab does not count as an hour of reading.
• What you click — the kind of thing you did, where you did it and when: clicking a call to action, opening the chat, tapping a quick reply, sending a message, being shown the contact form and submitting it, adjusting the figures, asking us to get it sorted, using a calculator, opening a guide, asking for a person, or following a link off the site. Some of these carry a short label. One of them carries part of what you wrote: when you send a message in the chat, the first sixty characters of it are recorded as that label.Why: so we can see which question in the conversation people struggle with and fix the question. The message label is the part worth knowing about: it is a copy of the beginning of what you typed, and it sits in our measurement records as well as in the transcript of your conversation.

What we do not collect

• We do not run a credit check, obtain a credit report or a credit score, or collect credit reporting information as the Privacy Act uses that term.
• We do not ask for bank account or card numbers, bank logins, or your transaction history.
• We do not ask for identity documents — no driver licence, no passport, no tax file number.
• We do not ask for sensitive information as the Privacy Act defines it: health, race, religion, political opinions, sexual orientation, criminal record or biometrics. Please do not type any of it into the conversation.
• We do not record your IP address in our own records of your enquiry or your visit.
• We do not buy personal information, and we do not obtain information about you from data brokers or list vendors.
• We do not send what you type to an external AI or language-model provider. The assistant is a set of rules running on our own server, and the conversation does not leave it to be answered.

Three ways, and all three of them are you or your own browser. We do not obtain information about you from anybody else — not from a register, not from a data broker, not from another business.

• The conversation itself. What you type is sent to our own server as you go, so the assistant can answer. The assistant is a set of rules running there, not an external AI service, so the words you type are not passed to a language-model provider.
• A measurement beacon. A small message to our own server on each page view, on each of the clicks listed above, and on a heartbeat while the tab is visible. It is sent in the background so it cannot slow the page down.
• The address of the page you arrive on. The campaign tags and click identifiers in the link you followed are read once, on arrival, and kept in your browser's session storage for the rest of the visit — because the second page you open no longer carries them.

Those tags and your timezone are also sent with the conversation itself, not only with the beacon. That is deliberate: the beacon is the first thing an ad blocker or a private window stops, and if the timezone is lost we end up promising someone in Perth a call at an hour that only suits Sydney.

One clarification, because the previous version of this page got it wrong. Nothing you type goes to an advertising or analytics provider — not a word of the conversation, not a figure, not your name. No advertising or analytics tag is loaded on this site at all, so there is currently nothing for one to be told — not even that a conversation happened. Section 6 says what would change if that were switched on.

This is the section that matters most, so it is the longest. Handing your enquiry on is the service, and the honest way to describe it is to name what actually goes rather than to summarise it.

A licensed finance broker — the disclosure this service exists to make

It happens in two steps, and the first is earlier than most people expect.

The moment you submit your details

The moment you submit your name, mobile and email, an alert goes to the broker's mailbox — and, where one is configured, to their phone as a text message — so somebody can ring you while you are still at your desk. It carries:

• your name, your mobile number and your email address
• what you are financing and the amount, as far as the conversation has got
• the score so far — the total, the intent part and the financeability part
• the reference for your enquiry

That happens even if you never finish the conversation. Submitting your details is the moment your information reaches somebody else, and the wording you agree to at that moment says so.

When you ask us to get it sorted

The full record follows. In the email that reaches the broker who will call you:

Two of those deserve to be pulled out, because a reasonable person would not expect them. The first is your notes: anything you typed that did not answer one of our questions is passed on in your own words, exactly as you wrote it. The second is the advertising click identifier. When you arrive from a Google ad, your click carries an identifier, and that identifier travels with your enquiry to the broker so that a settlement months later can be traced back to the advertisement that produced it. It is an advertising identifier attached to a named person and handed to another business, and you should know that rather than discover it.

And in the fuller record sent to their system

Where the receiving business takes leads into its own system rather than by email, the record sent is fuller. It contains everything above, and also:

• the whole qualification record as captured, including the property answers and how you used the conversation — questions answered, how many times you changed the figures, how many visits you have made, whether you asked for a person, and the phrases that were read as high intent
• the lead score in full: the total out of 100, its intent, financeability, commercial value and engagement parts, and the written list of reasons behind every one of them
• your consent records — which permissions you hold, their version numbers, where and when you gave them, and whether and when you withdrew them. The wording itself stays with us rather than being copied into their system
• the rest of the advertising identifiers: utm_content, the ad group, the landing-page topic, when the click was first seen, and Google's gbraid and wbraid identifiers and Facebook's fbclid where one of those was the one attached to your click
• our reference for you, the status of your enquiry and its timestamps, and the name of the specialist it was assigned to

What is not in it, at any point:

• the wording of the consent you agreed to, which stays with the record that evidences it
• the measurement records of your visit: your visitor identifier, your page views and what you clicked stay here

One control on that transfer is worth naming, because it is the difference between a rule and a habit. The record that goes into a broker's own system is not sent at all unless your permission to be contacted is live at the moment it is sent. If you have withdrawn it, the transfer stops and the enquiry is held here with a note saying why, for somebody to deal with. The same happens if we cannot read your consent history in full — we treat “we cannot confirm it” as “we do not have it”.

Our own people.

Your enquiry appears in our internal console. Access is limited by role: an administrator account sees the pipeline, and a broker account sees only the enquiries assigned to it and nothing else, whatever address they type.

Service providers.

The companies that host the site and its database, relay our email and send our text messages, and — where a measurement tag is configured, as section 6 describes — measure the site for us. They handle information on our instructions, for that purpose and no other. We will tell you which ones we use if you ask.

Where the law requires it.

A court order, a regulator's lawful request, or an obligation we cannot refuse. Otherwise, nobody.

Your enquiry goes to one licensed finance broker, chosen by what you are financing. We are not paid for making that introduction, and nobody buys your details from us — not as a data set, and not per name.

We do not sell your information to anyone else, and we do not send it to a panel of buyers. If we ever wanted to, we would ask you first: that is a different permission from the one you gave.

Findnance is not paid a referral fee, and Findnance receives no commission when a loan settles. The person who owns Findnance is employed as a finance broker at the brokerage your enquiry goes to, and may handle your enquiry personally. If your loan settles, they are paid a share of the commission that brokerage earns — that is the only money your enquiry produces for anyone here. Nobody pays us for your details, and you are never charged.

No third-party analytics or advertising tag is loaded on this site, so nothing about your visit is sent to Google or to any other overseas measurement provider for that purpose. Our own measurement stays on our own servers.

Where information goes overseas we take reasonable steps to see that the recipient handles it consistently with the Australian Privacy Principles, using the contractual terms those providers publish for that purpose. You should still know the plain position: Australian privacy law does not necessarily apply to an overseas recipient, and pursuing one under it may not be practical.

Some of the other service providers described above may also store or process information outside Australia. We have not listed the countries here because which providers we use is an operational decision rather than something set out on this page — email us and we will tell you which providers hold your information and where.

We do not use advertising cookies, third-party analytics or tracking pixels on this site.

To understand which pages are useful we count visits ourselves. Your browser stores a random identifier in local storage — not a cookie — so repeat visits within a session are counted once rather than several times. It is not linked to you unless you give us your contact details, and it is not shared with anyone.

Everything this site writes to your device, by name

This is the complete list. If you open your browser's developer tools and look, these are the keys you will find and nothing else.

• fn_vid

  Local storage

  a random visitor identifier. It is generated in your browser, it is not derived from anything about you, and it means nothing on any other site.

  Why: so a person who visits three times is counted as one visitor rather than three.

  How long: Until you clear your browser's site data.

• fn_sid

  Session storage

  a random session identifier, generated the same way.

  Why: so the pages you open in one sitting are counted as one visit.

  How long: Until you close the tab.

• fn_touch

  Session storage

  the campaign tags and advertising click identifiers in the link you arrived through, the page you landed on, and the site that referred you.

  Why: the second page you open no longer carries them, so they are read once on arrival and kept for the rest of the visit. They travel with an enquiry if you make one — section 5 says where.

  How long: Until you close the tab.

• fn_chat

  Local storage

  two identifiers — one for your enquiry and one for your conversation. Nothing you typed is stored on your device: the conversation itself lives on our server, and these are the handle to it.

  Why: so you can close the tab and come back to the conversation where you left it rather than starting again.

  How long: Until you clear your browser's site data, or until the conversation is finished and the handle is removed.

• fn_unsubscribed

  Cookie

  the single character 1, and nothing else. No identifier, and nothing that links it to you.

  Why: so the page that confirms you have unsubscribed is confirming something that actually happened, rather than anything a link with the right address in it claims.

  How long: One hour. It is set only if you unsubscribe.

Clearing your browser's site data removes all of them. Nothing on this site stops working without them, except that a conversation you left half-finished can no longer be resumed.

One permission is recorded when you submit your contact details. You give it by sending the form with the agreement shown on it — there is no tick box, because ticking a box you cannot leave unticked is theatre rather than a choice. It cannot be declined and still leave you with an enquiry, for the plain reason that we have no way to pass an enquiry to a broker who is not allowed to ring you; declining it and not enquiring are the same thing. It is stored against the exact wording you were shown and a version number for it, so what you agreed to can still be reproduced years later, after the wording on the site has changed.

Being contacted about your enquiry

“I agree to Findnance passing my details to the licensed brokerage it works with, and to a broker there contacting me about this enquiry. The person who owns Findnance is a broker there, paid a share of the commission if a loan settles. I have read the Privacy Policy.”

This is what makes the call you receive a call you asked for. It names the broker as a separate business rather than describing them as ours, because that is who rings you. Your agreement to this policy sits inside that wording; we do not record it as a separate permission.

Marketing is not in that

Enquiring does not join you to anything. That is our position rather than a permission we record, and it is this:

“Findnance will only email you about this enquiry. Joining our mailing list is a separate choice, and enquiring does not make it for you.”

That is a notice, not a permission, and we do not file it as one. Enquiring does not put you on our mailing list. An earlier version of this page said it did, and that was accurate at the time: everyone who submitted their details had a marketing record written for them, against a sentence that only told them it would happen. That was a notice being filed in the drawer marked consent. It has been stopped rather than reworded.

How somebody actually joins the mailing list

By asking. A marketing permission is only ever recorded against this sentence, written in the first person because what the record has to prove is that you asked rather than that you were told:

“Yes — I would also like Findnance to email me finance rate updates, guides and offers. I can unsubscribe from any message.”

There is a tick box on the contact form for it. It starts unticked, ignoring it costs you nothing, and declining it does not stop you enquiring or change anything about how your enquiry is handled. The box carries the sentence above word for word, and that same sentence is what gets stored with the record — so what you were shown and what we hold cannot drift apart.

What the mailing list is

Roughly one email a month about commercial finance: what has changed in the market, what lenders are doing, and the occasional piece on a particular kind of deal. It is not a drip campaign about your enquiry, and it is not a reason we collected your details — your enquiry is handled by a broker whether or not you are on it.

If we ever include a paid placement or a sponsored item, it will be marked as advertising where you can see it. We will not hand the list to anyone else to mail, and being on it does not put you in front of any third party — see section 5.

Every one of those emails carries a link that takes you off, without a login or a reply. Section 9 sets out what happens when you use it, including the part that matters most: coming off is permanent unless you ask us to put you back.

We do not ask for consent to a credit check, because we never run one. If a credit check happens later it belongs to the broker or the lender, and they have to ask you for it themselves, in their own words.

You can withdraw any permission at any time. Withdrawal is recorded by stamping the existing record with the date and time, not by deleting it — see section 10 for why, and section 9 for what the stamp then prevents. Where your enquiry has already gone to a broker, the record of your permissions went with it, including any withdrawal recorded before it was sent.

Every commercial message we send carries an unsubscribe link. One click, no account, no login, no reason required, and no page that asks you to type your address in.

The link is signed and does not expire. One in a two-year-old email still works, because a link that has quietly timed out is a link that keeps sending mail to somebody who asked it to stop. It asks you to confirm with a button rather than acting the moment it is opened, because mail scanners and link previewers fetch every link in a message and would otherwise unsubscribe people who never opened it.

The one thing that could break such a link is us changing the key that signs it, and that is worth telling you about because you would have no way of noticing. In production the system refuses to sign an unsubscribe link with any key that has another job, precisely so that rotating a credential for some unrelated reason cannot quietly leave a few thousand people holding a button that no longer works. Links signed under an older arrangement keep being honoured.

If you have enquired more than once from the same email address, unsubscribing stops all of them, not only the enquiry the link came from. It also keeps you off: an address that has unsubscribed cannot be put back on the list by enquiring again. The system refuses to record a new marketing permission for it, and writes the attempt down rather than acting on it. The only way back on is to ask us.

Unsubscribing here stops the mail we send. It does not reach a mailing list the receiving broker has built from your enquiry in their own system — that one is theirs, and you have to tell them. It also does not cancel a callback you asked for: being contacted about your enquiry is the other permission, and it is separate. To stop that as well, tell the specialist, or email support@findnance.com.au.

Every message we send identifies us by name and ABN, so you can always tell who it came from.

Each row has two last lines and they are different kinds of statement. Then is what we undertake will happen. Today is what you would find if you looked at our database this afternoon. Where the two differ, the second one is the true description of the system and the first is a promise we are held to.

• An enquiry we passed to a broker — your contact details, your answers, the conversation transcript and the indicative figures you were shown

  Seven years after your last activity on it

  Why: it is the record of an introduction that led somewhere. A question or a complaint about what we told you, or about being introduced at all, can be raised years after the event, and we would rather be able to answer it than say the file is gone.

  Then: Deleted, or reduced to figures that identify nobody.

  Today: Kept. Nothing expires it automatically. It is deleted when you ask us to delete it, which somebody does by hand.

• An enquiry that never reached the point of contact details

  Twelve months after your last activity

  Why: there is no relationship to evidence and nobody to answer to. It is kept only long enough to be useful for working out where the conversation loses people.

  Then: Deleted.

  Today: Kept. There is nothing in it that identifies you unless you typed something that does, and no job removes it at twelve months.

• An enquiry with contact details that was never passed to a broker

  Twenty-four months after your last activity

  Why: you asked us to help and we may not have finished. Within that window a specialist can still pick the enquiry up, which is the permission you gave when you submitted your details.

  Then: Deleted, except for what the mailing-list and consent rows below require.

  Today: Kept. Deleted when you ask, by hand. The twenty-four months is a commitment we have not automated.

• The event log against an enquiry — each dated entry recording something that happened to it, including the record of every message sent to you or about you and the address it went to

  For the life of the enquiry record it belongs to

  Why: the log is append-only by design. Entries are never edited and never removed one at a time, because a log that can be tidied is not evidence of anything — and the delivery entries are how we can tell you whether a message actually reached you.

  Then: Deleted with the enquiry it belongs to.

  Today: Appended to, and never edited or individually removed — that part is enforced by the system. It goes when the enquiry goes, which is by hand.

• The row written to our spreadsheet of enquiries, which the broker who handles your enquiry has access to

  The same period as the enquiry it belongs to

  Why: it is our spreadsheet, in our account, and the broker works from it rather than owning it. A copy we control is a copy we are answerable for.

  Then: Deleted with the enquiry.

  Today: Kept, and deletable on request — the row is removed by hand at the same time as the enquiry it came from. What we cannot reach is anything the broker exported or copied out of it, which is the row below.

• The copies that have genuinely left — the broker's own record of your enquiry in their systems, and anything they have exported

  Until the business holding it deletes it, which is their decision and not ours

  Why: once your enquiry has been handed over it is theirs as well as ours. We can delete our copy on request and we will, but we cannot reach into another business's system and we are not going to imply that we can.

  Then: Ask us and we will tell you who holds a copy so you can ask them directly.

  Today: Out of our reach entirely. We hold no ability to delete, amend or recall a copy once another business has received it.

• Consent records — the exact wording you were shown, its version, when you agreed, and when you withdrew

  Seven years after the consent is withdrawn, or after the enquiry record is deleted, whichever is later

  Why: kept deliberately after withdrawal. The record is the proof that we stopped and when we stopped, and keeping it is also what stops the same address being quietly added back by a later enquiry.

  Then: Deleted.

  Today: Kept, and this one is doing a job while it sits there: a withdrawn marketing record is what the system checks before it will record a new marketing permission for the same address. Deleting it early would switch that protection off.

• Measurement records — visits, page views and interactions

  Twenty-six months

  Why: long enough to compare a month against the same month last year, which is the longest comparison anyone here actually makes. Beyond that the individual rows are worth nothing and are only a liability.

  Then: Deleted, or aggregated into counts that identify nobody.

  Today: Kept. No job trims them at twenty-six months. They are covered by an access or deletion request like everything else — see section 12.

• Your email address on the mailing list

  Until you unsubscribe

  Why: there is no reason to hold a marketing address once the person has said stop.

  Then: Removed from the list. What survives is the consent record above, stamped with the date you withdrew.

  Today: This one does happen automatically, and immediately. Unsubscribing stamps every marketing permission held against your address, at every enquiry you have made, and the address stops appearing on the list from that moment.

Now the part most policies leave out. There is no timer. Nothing in this system expires a record, and there is no automatic deletion of any kind — not at seven years, not at twenty-six months, not ever. When something is deleted it is because a person went into the database and deleted it, because you asked. We would rather tell you that than let eight rows ending in the word “deleted” imply a machine is doing it. Building the scheduled job is on our list; until it is done, the periods above are promises kept by hand.

So if you want something gone before its period is up, ask, and we will delete it — see the next section. That request is the mechanism rather than a shortcut around one.

Three of the rows deserve saying plainly, because they are deliberate choices rather than oversights.

The event log is append-only. Entries are added and never edited or individually removed. That is the point of it: a log somebody can tidy is not a record of anything. It includes a dated entry for every message sent to you or about you, and that entry carries the address it was sent to. It is deleted whole, with the enquiry it belongs to.

Withdrawn consent is stamped, not deleted. When you unsubscribe or withdraw a permission we mark the existing record with the date and keep it. Deleting it would destroy the only evidence that you asked us to stop and that we did. It would also switch off the protection described in section 9: the stamped record is the thing the system reads before it will record a new marketing permission for your address, so it is what stops a later enquiry putting you quietly back on the list.

A copy that has left is out of our hands. Deleting our record does not delete the broker's. Be clear about where the line falls: the spreadsheet is ours and we will delete your row in it, but anything the broker has taken out of it, or written into their own system, is theirs. We will tell you who holds a copy so you can ask them. Any policy that promised otherwise would be promising something it cannot perform.

What is actually in place, rather than a list of reassuring words:

• The site is served over HTTPS in production, so what you type in the conversation is encrypted between your browser and our server.
• The internal console, the broker view and the internal data endpoints all sit behind authentication. If authentication is not configured, they refuse to serve at all rather than falling open.
• Access is separated by role. A broker sign-in resolves to one broker record and sees only the enquiries assigned to it; if that record cannot be resolved the answer is to show nothing, not to show everything.
• Sign-in cookies are signed, cannot be read by scripts in the page, are marked secure in production, and expire in hours rather than weeks. Repeated failed sign-ins from one address are throttled.
• The bulk export of enquiry data is switched off unless a separate secret is configured, and answers as not found otherwise.
• No enquiry is transferred into a broker's own system on this deployment — that route is switched off. What reaches the broker is the email described in section 5, and the record that would otherwise be sent to their system is written down here and goes nowhere.
• Everything significant that happens to an enquiry is written to the append-only event log described above, including every attempt to send a message about it and whether it succeeded.

What we will not claim: we do not tell you your information is encrypted at rest beyond whatever our hosting and database providers apply as standard, we hold no security certification, and no system is perfectly secure. If we ever have a breach likely to cause you serious harm, we will tell you and the OAIC, as the Privacy Act requires. There is more detail on our security page.

Email support@findnance.com.au and ask for a copy of what we hold about you, ask us to correct anything wrong or out of date, or ask us to delete it. We respond within a reasonable period — ordinarily 30 days — and we do not charge for access. As section 10 says, a deletion is carried out by a person working against the database rather than by pressing a button, which is why we take a request in writing and confirm back to you what went.

A copy means all of it: your answers, the transcript, every version of the figures, your score and the reasons behind it, the event log, the records of what was sent where and when, your consent records, and — this one was missing from an earlier version of the list — the measurement records of your visit. Once you start a conversation those are linked to your enquiry, which makes them information about you as much as anything else here: the sessions, the pages you opened, what you clicked, and the labels on those clicks, including the beginnings of messages you typed.

We may ask you to confirm who you are, in a way that fits the request. We will not demand documents to answer a simple question, and we will not hand somebody your enquiry just because they know your email address.

A few things we cannot delete on request: the record that you withdrew a permission, which exists to protect you, and the fact that an address unsubscribed. Our spreadsheet row goes with everything else — it is our spreadsheet. What we cannot delete is what the broker has in their own system, under their own policy, once your enquiry has reached them — ask them as well, and we will tell you who to ask. If we refuse any part of a request we will tell you why in writing, and how to complain about it.

Tell us first. Email support@findnance.com.au with “Complaint” in the subject line, or follow our complaints process. There is no fee and no form.

A privacy complaint can always go to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. It is free, it is independent, and it does not need our agreement. The OAIC will normally expect you to have raised it with us first and given us a chance to answer.

Whether an external dispute resolution scheme is also open to you for the finance side of a complaint depends on how our service is authorised. Where one applies to us it is named on our complaints page. The privacy route through the OAIC is open to you either way.

This service is for adults. The finance people enquire about here is not available to anyone under 18, and we do not knowingly collect information from a child.

We do not verify anybody's age — the conversation does not ask. So if you believe a child has given us their details, email support@findnance.com.au and we will delete them without asking you to justify it.

We change this policy when what we do changes, not the other way round. The date at the top of this page moves whenever the text does, so a date that has not moved means nothing has.

Where a change materially affects information we already hold about you, we will email the people affected rather than rely on you re-reading this page. The consent wording you agreed to is stored with its own version number, so what you were shown at the time stays recoverable even after this page has moved on.