Privacy Policy

We collect the following types of personal information:

Information You Provide

• Account Information: Email address, display name, and password (encrypted)
• Profile Information: Investment goals, experience level, risk tolerance, learning preferences, and progress tracking data. Optional financial profile (if you complete the wizard): age, household type, state, occupation, income, monthly expenses by category, assets and liabilities by category. This profile is not sent to the AI provider.
• Payment Information: Processed and stored securely by Stripe (PCI-DSS compliant). We only store the last 4 digits of your card and billing postal code
• Communications: Feedback, support requests, and any correspondence with us
• Referral Information: If you refer friends, we collect their email addresses (with your consent to share)

Information Collected Automatically

• Usage Data: Pages visited, features used, time spent, interactions with educational content, quiz results, calculator inputs, Scenario Explorer inputs (starting capital, allocation, time horizon, optional income for the CGT estimate)
• Device Information: Browser type, operating system, IP address (anonymised), screen resolution
• Cookies: Session cookies (essential), authentication tokens, and optional analytics cookies

We use your personal information for the following purposes (APP 6):

Primary Purposes

• Provide and personalise educational services and tools
• Process one-time payments for AI credits and donations
• Track your learning progress and customise content recommendations
• Authenticate your account and prevent unauthorised access
• Respond to support enquiries and feedback

Secondary Purposes (with your consent where required)

• Send quarterly newsletters with market insights (opt-out available)
• Send important service updates and announcements
• Analyse usage patterns to improve our platform (anonymised data)
• Conduct research to develop new features and educational content
• Process referral rewards and track referral program participation

Legal Obligations

• Comply with Australian taxation laws (GST, income reporting)
• Respond to lawful requests from government authorities
• Prevent fraud, abuse, and illegal activities

We do not sell, rent, or trade your personal information. We share your data only in the following limited circumstances:

Third-Party Service Providers

• Stripe: Payment processing (see Stripe Privacy Policy)
• Supabase: Secure database hosting and authentication (Australia, Sydney region)
• Anthropic (USA): AI model provider. Receives your chat messages and attachments, and the Scenario Explorer inputs listed above together with the computed historical ranges. Anthropic's standard API terms apply; we do not hold a zero-data-retention agreement, and Anthropic's published policy states API inputs and outputs may be retained for up to 30 days.
• Vercel: Website hosting and content delivery (global CDN with Australian edge nodes)
• Google Analytics 4 (Google LLC, USA): page-view and interaction analytics, loaded only after you accept analytics cookies (see Section 6). Vercel Analytics: cookieless page metrics.
• Resend (USA): transactional email delivery (account, alert and feedback emails); receives your email address and the email content.

These providers are contractually bound to protect your data and use it only for the purposes we specify.

Legal Requirements

• If required by law, court order, or government authority
• To protect our legal rights or defend against claims
• To prevent fraud or illegal activity

Business Transfers

• If Ripper Wealth Pty Ltd is acquired or merged, your data may be transferred to the new owner (you will be notified in advance)

We implement industry-standard security measures to protect your personal information:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Strict role-based access controls; only authorised personnel can access personal data
• Authentication: Secure password hashing (bcrypt), optional two-factor authentication (2FA)
• Regular Audits: Security reviews and penetration testing
• Data Backups: Encrypted backups with secure retention policies
• Incident Response: Procedures to detect, respond to, and notify you of data breaches as required by law

While we take all reasonable steps to protect your data, no system is completely secure. You are responsible for keeping your password confidential.

Under the Privacy Act 1988 and Australian Privacy Principles, you have the right to:

• Access Your Data (APP 12): Request a copy of all personal information we hold about you (free of charge)
• Correct Your Data (APP 13): Request correction of inaccurate or outdated information
• Delete Your Data: Request deletion of your account and personal information (subject to legal retention requirements)
• Export Your Data: Download your data in a portable format (CSV/JSON)
• Opt Out of Marketing: Unsubscribe from newsletters at any time (link in every email)
• Restrict Processing: Request that we limit how we use your data
• Complain: Lodge a complaint with us or the Office of the Australian Information Commissioner (OAIC)

To exercise these rights, email us at adrian@ripperwealth.com.au. We will respond within 30 days.

We use the following types of cookies:

• Essential Cookies: Required for login, authentication, and security (cannot be disabled)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Understand how you use our platform (anonymised, opt-in only). Choose "Decline" in the cookie notice to keep analytics off.

You can manage cookies through your browser settings. Disabling essential cookies may affect site functionality.

We retain your personal information for as long as necessary to:

• Provide our services (while your account is active)
• Comply with legal obligations (e.g., tax records for 7 years)
• Resolve disputes and enforce our terms

Chat conversations: We retain your chat history indefinitely while your account is active. This supports your long-term wealth education journey. You can manually delete individual conversations or your entire chat history at any time from your account settings.

Account deletion: When you delete your account, we will delete your personal data within 30 days, except for:

• Transaction records (required by law for 7 years)
• Anonymised usage data for research purposes (only if you opted in)
• Data required for legal compliance or pending disputes

Research consent: If you opt in to anonymised research in your profile settings, your financial data may be included in aggregate benchmarks. We enforce a minimum cohort size of 23 users to prevent re-identification. You can withdraw consent at any time.

Our Service is intended for individuals 18 years and older. We do not knowingly collect personal information from children under 18. If we discover such data, we will delete it immediately.

Your data is primarily stored and processed in Australia:

• Database: Supabase (AWS Sydney, ap-southeast-2 region)
• Website hosting: Vercel (global CDN with Australian edge nodes for low latency)

Some data processing occurs with US-based providers:

• AI chat and simulator: Anthropic (USA), standard API retention (see Section 3)
• Payments: Stripe (USA, PCI-DSS compliant)
• Email: Resend (USA)
• Analytics: Google (USA), only with your consent

These providers comply with data protection standards equivalent to Australian law (GDPR compliance, contractual data processing agreements).

We may update this Privacy Policy from time to time. Material changes will be communicated via email at least 14 days before taking effect. Continued use after changes constitutes acceptance.

You can view previous versions by contacting us.