DRAFT. This document is a template awaiting review by a lawyer. It is not yet in force. Source: apps/docs/legal/privacy.md.
Privacy policy
This is a placeholder template prepared for review. It is not legal advice and must be reviewed by a qualified lawyer before it is published or relied on. Bracketed items are to be completed.
Last updated: [date]
[Operator legal name] (ABN [number]) ("we", "us") provides Mintage. We take your privacy seriously and handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, where they apply to you, other privacy laws such as the UK GDPR.
Self-hosted vs hosted Mintage
- Self-hosted. If you run Mintage on your own computer or server, your data stays on that machine. We don't receive it, and this policy applies only to information you send us directly (for example, when you contact support). You are responsible for securing your installation.
- Hosted. If you use a Mintage service we operate, we hold your data on your behalf as described below.
What we collect
| Kind | Examples | Why |
|---|---|---|
| Account details | Name, email address, password hash (never the password itself), two-factor secret, preferences | To create and secure your account |
| Financial records you enter or import | Accounts, balances, transactions, budgets, goals, trades, holdings, invoices, attachments such as receipts | To provide the service you've asked for |
| Entity details | Entity names, types, ABN, masked tax file number (only if you choose to enter it), SMSF member names and dates of birth | Tax and reporting features |
| Usage and security data | Sign-in times, IP address, audit log of changes | Security, fraud prevention, troubleshooting |
| Support communications | Emails and messages you send us | To help you |
We do not collect your internet banking or broker passwords. Mintage imports files you download yourself.
Some information you enter may be about other people (for example, household members or SMSF members). Please make sure they're aware you're recording it.
How we use it
We use personal information to provide, secure and improve Mintage; to respond to you; and to meet our legal obligations. We do not sell your personal information and we do not use your financial data for advertising.
Who we share it with
- Service providers who host infrastructure or send email for us, under confidentiality obligations. [List providers and locations.]
- Price and exchange-rate providers. Mintage requests prices by security code and exchange-rate data by currency. These requests don't include your holdings, balances or identity.
- People you invite. Members you add to an entity (including an accountant) can see that entity's data according to their role.
- Where required by law.
Overseas disclosure
[State whether data is stored or accessed outside Australia, and in which countries.]
Security
Passwords are hashed with scrypt, sessions use secure HttpOnly cookies, two-factor authentication is available, and every change is recorded in an audit log. No system is perfectly secure; we will notify you and the OAIC of an eligible data breach as the Notifiable Data Breaches scheme requires.
Keeping and deleting data
We keep your data while your account is active. You can export it at any time and delete your account from Settings → Data. Backups are cycled out within [period]. We may keep limited records where the law requires.
Your rights
You can ask to access or correct the personal information we hold about you. Contact us at [privacy email]. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
Changes
We'll update this page when our practices change and tell you about significant changes in the app.
Contact
[Operator legal name] · [address] · [privacy email]
See also the Terms of use and Disclaimer.