Privacy Policy

RoundRock Labs Pty Ltd (ABN 50 698 674 967) (“RoundRock Labs”, “we”, “us”, or “our”) respects the privacy of everyone who uses our services. This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with our websites and products, including WealthWise.pro and Digital Bill.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we handle personal information of individuals in the European Economic Area (EEA) or United Kingdom, we also comply with the GDPR and UK GDPR to the extent applicable.

1. What Personal Information We Collect

We may collect the following categories of personal information:

Account and identity information

• Name and email address (when you register or contact us)
• Password (stored in hashed form only — we never see your plain-text password)
• Business name and role (for Digital Bill business accounts)

Financial and asset data (WealthWise.pro)

• Account balances, asset values, and liability amounts that you manually enter or connect via integrations
• Retirement scenarios and projection inputs you create
• Bank account and financial institution connection credentials, where you choose to use open-banking or data-feed integrations (handled via third-party providers — we do not store raw banking credentials)

Business knowledge data (Digital Bill)

• Documents, voice recordings, and other content you or your team upload to train the Digital Bill knowledge base
• Staff names and roles within your organisation, as entered by the business owner
• Queries submitted by staff and the responses generated

Usage and technical data

• IP address, browser type, device type, and operating system
• Pages visited, features used, and time spent in the application
• Error logs and crash reports

Payment data

Payment card and billing information is collected and processed directly by our payment provider. We receive only a token reference and basic transaction confirmation — we do not store card numbers or CVV codes.

Communications

• Emails and messages you send to us (support requests, enquiries)

2. How We Collect Personal Information

We collect personal information:

• Directly from you when you register, use our Services, or contact us;
• Automatically through cookies and analytics tools when you use our websites;
• From third-party integrations (for example, financial data providers) where you explicitly authorise us to connect to them on your behalf.

You are not required to provide personal information to browse our marketing website. However, providing certain information is necessary to create an account and use our products.

3. Why We Collect and Use Personal Information

We collect and use personal information for the following purposes:

• To provide and operate our Services — including account creation, authentication, generating projections and AI-driven responses, and maintaining the knowledge base.
• To process payments — billing, invoicing, and subscription management.
• To improve our Services — analysing usage patterns, diagnosing technical issues, and developing new features.
• To communicate with you — responding to support requests, sending service-related notices, and (where you have opted in) product updates.
• To comply with legal obligations — including tax, financial record-keeping, and responding to lawful requests from government authorities.
• To protect our Services and users — detecting fraud, abuse, and security incidents.

4. How We Share Personal Information

We do not sell your personal information. We share personal information only in the following circumstances:

Service providers (sub-processors)

We use trusted third-party providers to operate our Services. These providers process personal information only under our instruction:

• Supabase(database, authentication, and file storage) — data is hosted on infrastructure in the United States.
• Anthropic(AI language model provider) — queries and context are sent to Anthropic's API to generate responses. Anthropic is based in the United States. Please see Anthropic's privacy policy for information on how they handle API data.
• Voyage AI(text embedding provider) — text is sent to Voyage AI's API to generate vector embeddings for semantic search.
• Vercel(application hosting and edge infrastructure) — based in the United States.
• Payment processor— payment card data is handled by our payment provider under their own PCI-DSS compliance.

Overseas disclosure

As noted above, several of our sub-processors are located in the United States. By using our Services, you consent to your personal information being transferred to and processed in countries outside Australia, including the United States, where privacy laws may differ from those in Australia. We take reasonable steps to ensure our sub-processors handle your information in a manner consistent with the Australian Privacy Principles.

Legal requirements

We may disclose personal information where required by law, court order, or lawful request by a government or regulatory authority.

Business transfers

In the event of a merger, acquisition, or sale of business assets, your personal information may be transferred to the relevant successor entity. We will provide notice if such a transfer occurs.

5. Cookies and Analytics

We use cookies and similar tracking technologies to operate and improve our Services. These may include session cookies (deleted when you close your browser) and persistent cookies (stored for a defined period).

We may use analytics tools to understand how users interact with our Services. Where possible, analytics data is anonymised or aggregated. You can control cookies through your browser settings, although disabling certain cookies may affect Service functionality.

6. Data Security

We implement industry-standard technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, or destruction. These include encryption in transit (TLS), encryption at rest, access controls, and row-level security on our database.

No method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we will notify you of a data breach where required by Australian law (the Notifiable Data Breaches scheme under the Privacy Act 1988).

7. Data Retention

We retain personal information for as long as necessary to provide our Services and meet our legal obligations. When you close your account, we will delete or anonymise your personal information within a reasonable period, except where we are required to retain it by law (for example, financial records required under the Corporations Act 2001 or tax legislation).

8. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you;
• Correct personal information that is inaccurate, incomplete, or out of date;
• Complain about a breach of the APPs.

If you are in the EEA or UK, you may also have additional rights under the GDPR or UK GDPR, including rights to erasure, restriction of processing, portability, and objection.

To exercise any of these rights, please contact us at hello@roundrocklabs.ai. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

9. Privacy Complaints

If you believe we have breached the Australian Privacy Principles or your privacy rights, please contact us first so we can attempt to resolve your concern. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10. Children's Privacy

Our Services are not directed at children under 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or via a notice within the relevant Service. The updated policy will state its effective date. Your continued use of our Services after the effective date constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us: