Privacy Policy · FeasiBiz

1. The short version

We collect what we need to run your account and your analyses, and nothing for advertising.
Your analyses are private to your account.
Payments are processed by Stripe. We never see or store your card number.
The optional AI summary is only created when you ask for one. It sends a compact summary of that analysis to Google's Gemini service: its key figures (such as prices, costs, NPV and payback), its warnings and insights, and the names you gave its products, campaigns and other items such as assets and loans, plus the name of a custom tax system if you use one. It never includes your name, email address, company name or the analysis title, so please keep personal information out of those names.
We only use the cookies needed to keep you signed in. There are no advertising or analytics cookies.
You can download your data or delete your account at any time in Account settings.

2. Information we collect

Account information

Your name, email address and password when you sign up, and optionally a company name. Your password is sent over an encrypted connection to our server, which passes it to our authentication provider. It is stored only as a one-way hash, and we never keep a readable copy. We also store your plan and basic account settings.

Your analyses

The assumptions you enter (for example product names, prices, costs, staff roles and wages, premises, equipment, loans and tax settings) and the results we calculate from them. This is usually business information, but it can include personal information if you enter it, for example a person's name as a staff role. Please avoid entering other people's personal information.

Billing information

If you choose a paid plan, Stripe collects your payment details and billing address on its own checkout page. We store a Stripe customer reference and your subscription details: the plan, its status, whether it is billed monthly or yearly, and the billing period and trial dates. Stripe keeps your invoices and payment history, which we can see in our Stripe account when we need to help with a billing question.

Messages

When you use the contact form we store your name, email address, subject and message. If you are signed in, the message is linked to your account.

Usage and technical information

Records of AI summaries you request (when, which AI model and how much processing it used), so we can apply your plan's monthly allowance.
When you were last active, and records of actions our administrators take on accounts.
A one-way hash of your IP address, kept for no more than three days, to limit repeated attempts such as many sign-in tries in a short time. We do not store your IP address itself for this.
When you sign in, sign up, or ask for a confirmation or password-reset email, we may pass your IP address to our authentication provider so that it can limit repeated attempts from the same address.
Our hosting provider records technical logs (such as IP address, browser type, the pages requested and when) for security and troubleshooting. These are kept for a limited period.

We do not ask for sensitive information as defined in the Privacy Act (such as health information or religious beliefs), and we ask you not to enter it.

3. How we use your information

To create and secure your account, sign you in and keep you signed in.
To store, calculate and show your analyses, and to export them when you ask.
To provide paid plans: working out which features your plan includes, handling subscriptions through Stripe and answering billing questions.
To create AI summaries when you ask for one.
To answer your messages and help you use FeasiBiz.
To send essential service emails, such as the link to confirm your email address or to reset your password. We do not send marketing emails.
To keep the service secure and working: preventing abuse, investigating problems and keeping records of administrative actions.
To meet our legal obligations.

We do not sell your personal information, we do not use it for advertising, and we do not use your analyses to train AI models.

We use a small number of service providers. Each receives only what it needs to provide its part of the service:

Supabase hosts our database and handles sign-in. It stores your account information and analyses, and may receive your IP address when you sign in, sign up or ask for an account email, to protect sign-in from abuse.
Vercel hosts the website and the servers that run the calculations.
Stripe processes payments and manages subscriptions if you choose a paid plan.
Google (Gemini API) writes AI summaries, only when you ask for one. It receives our instructions and a compact summary of that analysis: its key figures (such as prices, costs, yearly results, NPV and payback), the warnings and insights our calculations produced, settings such as the currency, the required return and the tax structure (including the name of a custom tax system), and the names you gave its products, campaigns and other items such as assets and loans. Those names can appear inside the warnings and insights. It does not receive your name, email address, company name or the analysis title. Google processes this under its Gemini API terms. Depending on the type of API access we use, Google may use submitted content to improve its products; Google states that it does not do this for paid access. For this reason, please don't put personal information in the names of products, campaigns, assets, loans or other items, or in the name of a custom tax system.
Our email delivery provider sends account emails, such as confirmation and password-reset links, on our behalf.

We may also share information with our professional advisers, or when the law requires it, for example in response to a valid request from a court or regulator.

5. Where your information is stored

Our service providers store and process data on servers that may be located outside Australia, including in the United States and other countries where they operate. When we disclose personal information overseas, we take reasonable steps to make sure it is handled in a way that is consistent with the Australian Privacy Principles, such as choosing established providers with strong security practices and contractual privacy commitments.

6. Cookies

We only use cookies that are needed to keep you signed in and to complete sign-in and password-reset links securely. These are set by our authentication provider (their names start with “sb-”). Because they are essential to the service, we don't show a cookie banner.

We do not use advertising, analytics or tracking cookies, and our pages don't load third-party trackers. Our fonts are served from our own website. Stripe's checkout and billing pages are hosted by Stripe on stripe.com and may set their own cookies, as described in Stripe's privacy policy.

7. How we protect your information

All connections to FeasiBiz are encrypted (HTTPS).
Passwords are stored only as one-way hashes by our authentication provider.
Database access rules (row-level security) limit each account to its own analyses. Administrative access is limited to authorised people, and administrative actions are logged. Our admin panel shows account details, plans and the names and dates of analyses, but not what is inside an analysis.
Calculations, payments and AI requests run only on our servers, and the secret keys for those services never reach your browser.
We limit repeated attempts to sign in, sign up, reset a password or send messages.
We use browser security settings that block common attacks, such as other sites framing our pages.

No system is perfectly secure. If we become aware of a data breach that is likely to cause serious harm, we will notify the people affected and, where required, the Office of the Australian Information Commissioner (OAIC).

8. How long we keep it

Account and analyses: while your account is open. When you delete your account, your profile, analyses, AI summaries, AI usage records and subscription records are deleted from our database straight away. Copies in our providers' backups are removed as those backups expire.
Messages: kept as long as reasonably needed to deal with them and for our records. If you delete your account, messages you sent are no longer linked to it. Ask us and we will delete them.
Payment records: Stripe keeps payment and invoice records for as long as the law requires.
Rate-limit records: the one-way hash of your IP address is deleted within three days.
Hosting logs: kept for the limited period set by our hosting provider.
Administrative records: records of administrators' actions are kept for security and accountability.

9. Your choices and rights

Access and copy: download your data as a file at any time from Account settings.
Correction: update your name and company name in Account settings. To change your email address, contact us.
Deletion: delete your account in Account settings, or ask us to do it.
AI: nothing is sent to the AI service unless you click the button to create a summary.

Under the Australian Privacy Principles you can ask for access to, or correction of, the personal information we hold about you. We will respond within a reasonable time, usually within 30 days. You may use a pseudonym as your name, but an account needs a working email address.

10. Children

FeasiBiz is a business tool for people aged 18 and over. We do not knowingly collect personal information from children.

11. Questions and complaints

If you have a question or a complaint about how we handle personal information, please contact us. We aim to respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au.

12. Changes to this policy

We will update this policy when the service or the law changes, and change the “Last updated” date above. If a change is significant, we will tell you by email or in the app before it applies.