Privacy Policy

This policy explains how MJC Broker Assist handles personal information, and how we meet our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

It covers two distinct groups: the brokers and brokerage staff who hold Fin-XTract accounts, and the individuals whose information appears inside the financial statements those brokers upload.

When you create an account we collect your name, work email address, brokerage name and a hashed password. When you subscribe, Stripe collects your billing details and returns to us a customer reference, the plan you are on and the status of your subscription.

As you use the service we record operational metadata: the time of each extraction, which user ran it, how long it took, the confidence score returned by the verification pass, and whether a results pack was exported.

Financial statements are held in memory for the length of a run. They are not written to a storage bucket, a document table or an application log, and there is no endpoint that can retrieve one afterwards. When the results pack is produced, the source file is discarded.

The extracted figures and their page references are retained as part of the run record so that a results pack remains reproducible and a brokerage can reconstruct how a number was reached.

We use account information to authenticate you, to enforce the export quota on your subscription, to bill you, and to send service messages such as verification and password reset emails.

We use operational metadata to run the service, to report usage back to the account owner, to monitor accuracy, and to keep the cost of the artificial intelligence layer visible. We do not use your documents or your clients' figures to train any model.

Application data is hosted in Australian availability zones. Verification calls are made to a model endpoint in the Asia Pacific region. Stripe processes payment data in accordance with its own published policy and may do so outside Australia.

Where information is disclosed to an overseas recipient, we take reasonable steps to ensure it is handled in a way consistent with the Australian Privacy Principles.

Source documents: not kept. Run records and extracted figures: kept for as long as the account is active, and for seven years afterwards where a record is needed to evidence a past assessment. Account details: deleted within 30 days of a verified deletion request, subject to any record we must retain by law.

We disclose personal information to our processors as described above, to a professional adviser where necessary, and to a regulator or court where we are required to by law. We do not sell personal information and we do not disclose it for marketing by anyone else.

Within a brokerage subscription, the account owner can see the usage trail of every user under that subscription, including which extractions and exports each user produced.

Access tokens are short-lived and refresh tokens rotate. Passwords are hashed with bcrypt. Email verification is mandatory before an account can run an extraction. Payment webhooks are signature-verified.

No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

You may ask for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. Write to info@mjcbrokerassist.com.au. We will respond within 30 days and will not charge you for making the request.

Because uploaded documents are not retained, a request for access will cover account details, run records and extracted figures rather than the source statements themselves.

Where you upload a document containing information about a third party, you are the entity with the relationship to that person, and you remain responsible for having the consent and the notification required under the Privacy Act. We act as a processor for that content, on your instructions.

If you think we have mishandled your information, contact info@mjcbrokerassist.com.au and we will investigate. If you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

We will post any change to this policy on this page and update the date at the top. Material changes affecting document handling will also be emailed to account owners.