Privacy Notice

This Notice applies to the Ivanry website, applications, portfolio tools, broker integrations, billing, support, analytics and related services. It does not govern a broker, identity provider, payment provider, linked website or other third party acting under its own privacy policy.

• Identity and profile: name, email, date of birth, country, city, goals, referral source and authentication identifiers.
• Financial and portfolio: portfolio names, holdings, trades, tax lots, costs, prices, FX rates, cash, income, broker account identifiers, uploaded files and calculation choices.
• Broker and source records: imports, synchronisation metadata, raw broker rows, reconciliation warnings and data lineage.
• Billing: plan, Square customer and subscription identifiers, payment status and billing dates. Square handles full card details.
• Usage and device: source IP address, login time, browser or device user agent, feature use, diagnostics, security logs and cookie or local-storage identifiers.
• Research and AI: selected portfolios, source settings, prompts, evidence, generated outputs, feedback and token or cost telemetry.
• Communications: support messages, complaints, survey responses and records of legal acceptance.

We generally do not need government identifiers, health information or other sensitive information. Do not provide it unless specifically requested and lawful.

We collect information directly from you, from your use of the Service, from Google or Cognito when you authenticate, from Square when you subscribe, from brokers such as IBKR when you configure a supported connection or upload a report, and from market, news, fundamentals and FX providers used to provide requested features.

• create, authenticate and administer your account;
• import, calculate, reconcile, display and export your portfolio information;
• provide research organisation, alerts, technical comparisons, scenarios and AI-assisted summaries for your review;
• process subscriptions, cancellations and billing support;
• secure the Service, detect misuse, investigate errors and maintain audit trails;
• communicate service, security, billing and legal notices;
• improve reliability and features using appropriately limited or de-identified information where practical;
• comply with law, resolve disputes and protect users, the public and our rights.

We do not sell your portfolio data or financial products. We do not use your broker credentials to trade, and Ivanry does not execute orders, hold assets or provide custody.

We disclose only what is reasonably needed to:

• AWS for cloud hosting, storage, databases, authentication, logging and Bedrock/AgentCore features;
• Google for social sign-in where you choose it;
• Square for subscription checkout, payment and lifecycle management;
• IBKR or another supported broker when you initiate a supported connection or synchronisation;
• market-data, FX, news, company-information and AI providers needed for a feature;
• professional advisers, insurers, auditors, regulators, law enforcement or courts where lawful and necessary;
• a genuine purchaser or successor in a business transaction, subject to confidentiality and applicable law.

We require providers to handle information for authorised purposes, but their independently provided services may also be governed by their own policies.

Ivanry currently uses AWS infrastructure in the United States and providers that may process information in the United States and other countries where they or their subprocessors operate. Privacy protections may differ from Australia. We take reasonable steps required by Australian law when disclosing personal information overseas and select reputable providers with contractual and security controls.

AI systems may process portfolio facts, market evidence and your selected settings to generate research summaries and indicative signals. Outputs require human review and do not execute trades, determine access to essential services, or make a legally significant decision about you. We log limited run metadata for reliability, cost and audit purposes. Do not place unnecessary personal or sensitive information in prompts or custom sources.

We use cookies, browser storage and similar technologies that are necessary for authentication, security, preferences and application operation. We may use limited analytics to understand reliability and feature use. Browser controls can remove storage, but doing so may sign you out or prevent features from working.

We use safeguards designed for the nature of the information, including authenticated access, tenant scoping, encryption provided by AWS services, restricted cloud permissions, audit logging and secret separation. No internet service is completely secure. You should use a secure email or Google account, protect your device and tell us promptly about suspected unauthorised access.

We retain information while your account is active and as reasonably needed to provide the Service, meet legal and accounting obligations, resolve disputes, prevent fraud and preserve auditability. Portfolio deletion is normally scheduled after a 15-day recovery period. Access telemetry is currently configured to expire after 90 days. Security, billing, acceptance, de-identified and backup records may remain for longer where reasonably necessary, with backups expiring through normal cycles.

You can correct many profile and portfolio details in the Service and use available exports for transaction and calculation records. You may request access to or correction of personal information we hold. We may need to verify identity and may decline or limit a request only where the law permits, giving reasons where required.

Contact our privacy channel with a concern. We will acknowledge and investigate it within a reasonable period, normally aiming to respond within 30 days. If unresolved, you may contact the Office of the Australian Information Commissioner. Where the Notifiable Data Breaches scheme applies, we assess suspected breaches and notify affected people and the OAIC when legally required.

Ivanry is for adults aged 18 and over. We do not knowingly create accounts for children. If we learn that a child has provided personal information, we will take reasonable steps to restrict and delete it, subject to legal retention requirements.

We may update this Notice as practices, providers or laws change. We will publish a version and effective date and provide reasonable notice of material changes. Where required, we will ask for fresh acknowledgement or consent.

Ivanry is operated by Ivanry Family Trust, ABN 72 549 759 671. Use the support or privacy contact method displayed in the Service or account communications for access, correction, deletion or complaint requests.