Privacy Policy

1. Information We Collect

1.1 Information About Clients and Prospective Clients

We collect the personal information we need to respond to enquiries, enter into and administer agreements, take payments, onboard and support clients, administer Devices, and run our business. Depending on how you deal with us, this may include:

(a) Identity and contact information: name, email address, phone number, business name, ABN, and postal or contract address;

(b) Enquiry, waitlist and booking details: the answers you give in our forms (such as your preferred start month), the consent wording you accepted and when, and how you found us (such as campaign tags and the referring page);

(c) Payment and billing information: deposits, subscriptions, invoices and payment status. Card and bank details are handled by our payment processor; we do not store full card or bank account numbers;

(d) Agreement and electronic signing records: the agreement you are offered and sign, the name you type to sign, your consent to sign electronically, signing times, your browser details, and a one-way scrambled (hashed) form of your IP address, together with the signed agreement and a signing certificate;

(e) Communications: emails, messages and support requests between you and us. To give our team context, our client records keep email subjects, participants, dates and short previews of our correspondence with you;

(f) Meetings: calendar details of calls with us and, where a call is recorded or transcribed with the participants' consent, the transcript and AI-generated notes and summaries of that call;

(g) Marketing preferences: whether you have subscribed to or unsubscribed from our emails, and basic delivery information about the emails we send you;

(h) Device administration information: device model, serial number, asset tag, allocated client, device location, remote management status, licensing status, health monitoring status, and return or offboarding logistics.

1.2 Information Stored on Your Device (Not Centrally Stored by Us)

The Platform generates and stores the following data locally on the Device allocated for your use. Except for the limited remote access, health monitoring, licensing, and offboarding activities described in this Privacy Policy, we do not routinely access or centrally store this data:

• AI-generated content (for example scripts, images, audio, video and social media captions)
• Knowledge base data (business research, indexed documents, cached information)
• Operational data (task logs, agent activity, cost monitoring, system metrics)
• Configuration and credentials (API keys, OAuth tokens, preferences) stored in encrypted form
• Financial tracking data where wealth management features are enabled

This data is yours. It resides on Provider-owned hardware allocated to you during the term, which may be in your possession or otherwise allocated for your use. We do not routinely browse Client Content.

1.3 Information Collected via Our Website

When you visit aiwealthhub.app or submit a form, we may collect:

(a) the details you enter in our enquiry, waitlist, booking or onboarding forms; and

(b) standard technical information recorded by our hosting provider, such as IP address, browser type, device information and pages visited.

We do not currently use third-party advertising cookies or tracking pixels on our website.

1.4 Sensitive Information

We do not intentionally collect sensitive information (as defined in the Privacy Act), such as health information, racial or ethnic origin, political opinions, or biometric data. Clients must not put health information or other sensitive information into the Platform unless we have first agreed in writing how it will be handled.

2. How We Use Your Information

We use the personal information we hold for:

• Responding to enquiries and managing waitlist places, bookings and deposits
• Contract administration — preparing, signing and managing your agreement
• Payment processing — taking deposits and payments and issuing invoices
• Onboarding, support and maintenance — setting up the Platform, providing support and delivering software updates
• Device administration and offboarding — allocating Devices, validating licences, monitoring health status, arranging returns, and preparing Devices for redeployment
• Client relationship management — keeping our records of your account, our correspondence and our meetings up to date, including AI-generated summaries that our team reviews
• Communication — service updates, technical notices, and responding to your enquiries
• Marketing — sending you information about our services, which you can opt out of at any time (section 9)
• Legal compliance — meeting regulatory requirements, court orders, or law enforcement requests

3. Where Your Information Is Stored

3.1 Our Business Records

The information described in section 1.1 is held in our business systems: our client relationship management (CRM) system, our operations database and secure file storage, and the other service providers listed in section 4. Access is limited to authorised personnel of Serenite Group and the service providers that operate these systems for us.

3.2 Your Client Content — Local Processing Model

The AI Wealth Hub Platform operates primarily on a local data model. This is a core design principle:

• Business data, AI-generated content, knowledge base, configuration, credentials, and operational data are stored locally on the Device allocated for your use
• Client Content on your Device is not copied into our business records, except where you ask us to handle it while providing support
• We do not have routine access to Client Content stored on your Device
• The Device transmits only the limited health and licensing signals described in section 6.2

3.3 Provider-Owned Device and Offboarding

The Device may be owned by Serenite Group Pty Ltd and allocated to you for Platform access during the term of your agreement. Device ownership is separate from ownership of your Client Content. On termination, expiry, or return of a Device, we may assist with reasonable export or retrieval of Client Content where requested and technically practicable, then remove, disable, wipe, or redeploy Provider IP and Platform software.

3.4 Catalogue Model — Your Choices, Your Responsibility

The Platform provides a catalogue of automations and integrations that you may choose to enable. You decide which automations to activate, which third-party services to connect, and how to use the Platform's capabilities. Because ordinary use of the Platform occurs locally on your Device and we do not routinely review Client Content or ordinary usage, you are responsible for which integrations you enable and what data is transmitted.

4. Service Providers We Use

We use the following service providers to run our business. Each handles personal information only to provide its service to us:

• Twenty — client relationship management (CRM): contacts, companies, deals, and records of our emails and meetings
• Cloudflare — our operations database, secure file storage for agreements, and our licensing and electronic signing services
• Google Workspace — email, calendar, document storage, and meeting notes (including AI-generated notes where a call is recorded or transcribed)
• Stripe — payment processing
• Xero — accounting and invoicing
• Postmark — sending our emails
• Vercel — hosting our website and client operations portal
• Tailscale — the secure private network we use for remote access to Devices

We may change these providers from time to time; this section will be updated when we do.

5. Third-Party Services and Overseas Disclosure

5.1 Our Service Providers

Several of the providers listed in section 4 are based outside Australia or store and process information in other countries, most commonly the United States. Cloudflare and Vercel operate global networks, so information may be processed in the country closest to where a request is made.

5.2 Client-Controlled Integrations

The Platform supports integration with a range of third-party services. You choose which services to connect. The Platform does not automatically connect to any third-party service without your action. Each integration you enable is governed by your own agreement with that third-party provider, which may process data outside Australia, including in the United States.

5.3 Social Media Publishing

Where you enable automated social media publishing, the Platform will transmit content to your connected social media accounts via third-party scheduling services you have configured. You are solely responsible for the content published to your accounts.

6. Remote Access to Your Device

6.1 When We Access Your Device

Remote access to your Device is a support service provided for your benefit and for Platform administration. We may access your Device remotely through secure remote access tooling, including SSH over Tailscale VPN, for setup, configuration, maintenance, troubleshooting, software updates, security, Client-requested support, and offboarding. Remote access occurs only:

• At your request — when you contact us for support, troubleshooting, or configuration assistance
• Scheduled maintenance — for software updates or maintenance, with reasonable prior notice
• Offboarding — to assist with export, retrieval, removal, disabling, wiping, or redeployment of Platform software and Provider IP
• Urgent circumstances — where immediate access is necessary to prevent data loss, security incidents, critical system failure, or legal or technical risk

We do not routinely browse Client Content. Any access to Client Content is limited to what is reasonably necessary to provide support, maintain the Platform, troubleshoot issues, complete offboarding, or comply with legal obligations.

6.2 Device Health Monitoring

Your Device transmits a periodic health status signal (“health ping”) to our licensing and administration platform. This contains Device online/offline status, system health indicators, licence validation data, and technical identifiers reasonably needed to administer the allocated Device. The health ping does not intentionally transmit Client Content, files, credentials, or personal information.

7. Artificial Intelligence and Automated Processing

7.1 How the Platform Uses AI

The Platform uses artificial intelligence systems to:

• Generate written content including scripts, social media captions, and business research summaries
• Generate visual and audio content including images, videos, and voiceover narration
• Analyse and index business knowledge and documents
• Automate content scheduling and publishing workflows
• Provide business insights and summaries based on data you provide

These systems (including large language, image, video and voice models) are probabilistic and their outputs may contain inaccuracies. All AI-generated content is subject to your review and approval before use or publication.

7.2 How We Use AI in Our Business

We use AI tools to help our team prepare notes and summaries of meetings and correspondence. A person reviews this information before relying on it.

7.3 No Automated Decisions

We do not make decisions about you that have legal or similarly significant effects using solely or substantially automated means. Decisions such as whether to offer you an agreement are made by people.

8. Disclosure of Personal Information

We may disclose your personal information to:

• Our service providers — the providers listed in section 4, for the purposes described
• Professional advisers — including lawyers and accountants, where necessary
• Law enforcement or regulatory bodies — where required by law, regulation, or court order
• A purchaser or successor — if our business is transferred, merged, or restructured

We do not sell, rent, or trade your personal information.

9. Marketing Emails

We may send you emails about our services, events and resources. Every marketing email includes an unsubscribe link, and you can also opt out at any time by emailing us. If you unsubscribe, we keep a record of that so we do not email you again. We will still send emails needed to administer your enquiry, agreement or service.

10. Data Security

10.1 Our Business Records

Our business records are protected through our service providers' security controls, encrypted connections, and access limited to authorised personnel. IP addresses captured when you sign an agreement are stored only in a one-way hashed form.

10.2 Platform Security (On Your Device)

The Platform software includes encrypted credential storage, input sanitisation, secure session management, and protections against common attack vectors. Remote support access is conducted via encrypted SSH over Tailscale VPN, with no public internet exposure of your dashboard.

However, no system is completely secure. Where the Device is in your possession or control, you are responsible for the physical security of the Device, maintaining a secure network environment, and safeguarding your API keys and credentials.

11. Data Breach Notification

In accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth), if we become aware of a data breach involving personal information that is likely to result in serious harm, we will take immediate steps to contain and remediate the breach, notify you as soon as practicable, and where required, notify the Office of the Australian Information Commissioner (OAIC).

12. Your Rights

12.1 Access (APP 12)

You can request access to the personal information we hold about you. Client Content on the Device allocated for your use is directly accessible to you through that Device.

12.2 Correction (APP 13)

You can request correction of any personal information we hold that is inaccurate, incomplete, out of date, irrelevant, or misleading. We will respond within 30 days.

12.3 Complaints

If you believe we have breached the APPs, you may lodge a complaint with us using the contact details below. We will investigate and respond within 30 days. If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

13. Data Retention

• Data on your Device: Client Content stored on the Device remains yours. On termination, expiry, or Device return, we may assist with reasonable export or retrieval where requested and technically practicable, then remove, disable, wipe, or redeploy Provider IP and Platform software
• Agreements, signing records and billing records: retained for the duration of our business relationship plus 7 years, for tax, accounting and legal compliance
• Client relationship records, correspondence records and meeting notes: retained while they are needed for the purposes in section 2, then deleted or de-identified
• Device administration records: retained for as long as necessary to manage Device allocation, support, warranty, insurance, return, audit, and legal obligations
• Enquiry, waitlist and booking details: retained for as long as necessary to respond to and manage your enquiry, then deleted or de-identified
• Unsubscribe records: retained so that we continue to respect your choice
• Third-party services you connect: governed by those providers' own policies

14. Children's Privacy

The Platform is designed for use by businesses and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children.

15. Changes to This Privacy Policy

We may update this Privacy Policy at any time. The current version is always published on this page with its effective date, and applies from that date.

16. Contact Us

If you have questions about this Privacy Policy, wish to exercise your rights under the APPs, or want to make a complaint, please contact us: