# eFile Vault — Privacy Policy Version: 2026-09-16.1 Effective: 15 September 2026. Account and download features apply when made available. VENTURESTACK PTY LTD (ABN 55 699 711 272) operates eFile Vault. Contact us at info@venture-stack.com.au for privacy enquiries, access or correction requests and complaints. This policy covers the website, account and download service, desktop application and related hosted features. ## 1. Purpose and application This policy describes our handling of personal information. It is not an unlimited consent request, a guarantee of security, a service-level agreement, or a waiver of your statutory rights. We comply with privacy obligations to the extent they apply to us. References to Australian Privacy Principles describe relevant handling requirements and do not represent that every law or exemption applies identically to every activity. When you use eFile Vault for an organisation, that organisation may control account membership, workspaces, access and information it supplies. Its handling is also governed by its own arrangements. Describing it as responsible for Customer Data does not remove any obligations that apply independently to us. ## 2. Information handled Depending on the features you use, we may handle: - Account and identity information: email address, verification/account identifiers, name and organisation details you provide, authentication/session information and membership or entitlement records. Password authentication is provided through our authentication service; do not include passwords in enquiries. - Website enquiries and support: name, organisation, email, topic, message, correspondence and diagnostic material you choose to provide. Avoid sending confidential matter content or sensitive personal information unless it is needed and you are authorised. - Acceptance and download evidence: verified account identifier and email, name and organisation declared by the user, exact terms/privacy/consent wording and document versions, hashes of those documents, server timestamps, record/request identifiers, and technical request context such as IP address and browser information where captured. User-supplied information is not necessarily independently verified. - Workspace and filing information: matter names, folders, file names, senders, recipients, dates, tags, tasks, notes, comments, membership and permission information, and search data. Search processing may include extracted document/email text and derived searchable terms. Do not assume searchable data is anonymised or that hosted processing excludes document content. - Connected service information: account/provider identifiers, access grants and tokens used for the mail or storage integrations you enable; and messages, attachments and metadata handled through the requested filing functions. - Commercial information: plan, seat count, billing contact, payment references and status when billing is enabled. A payment processor handles card information through its payment flow; the filing app is not intended to collect card details directly. - Technical information: device/browser/app version, network/request information, authentication/security events and error or operational logs generated by the services used to provide the product. We do not represent that all logs exclude personal information. Customer files may contain information about clients, staff or third parties, including sensitive information. You must assess your authority to supply and process that material. Where consent or another legal condition is required, it must be met for the relevant handling; your general acceptance of this policy is not consent on behalf of every person in your documents. ## 3. Collection and choices Information can come directly from you, your organisation or authorised users, integrations you connect, and technical operation of the Service. Mail access follows the provider permissions you authorise. The account-and-download flow requires an account and recorded acceptance before an installer is authorised. If you decline information reasonably necessary for those functions, we may be unable to provide them. We distinguish acknowledgement that this policy has been provided from any specific consent. For website registration and download access we request consent to handling the account information you supply and acceptance/download records for those stated purposes, as described here. That consent does not cover advertising, sale of data, unrelated analytics, general AI training or unspecified future purposes. Processing may also be authorised or required independently by law; consent is not asserted as the only basis for every activity. You may contact us about withdrawing a consent. Withdrawal affects consent-based future handling to the extent applicable, may prevent dependent functions being supplied, and does not invalidate earlier lawful handling or require deletion of records lawfully retained for another reason. Additional consent, when needed for a particular optional feature or sensitive information, must be sought at that point rather than assumed from this policy. ## 4. Purposes We handle information to register and authenticate accounts; verify and administer access; organise, index, search, display and share information according to requested features and permissions; process enquiries and payments; operate, maintain, troubleshoot and secure the Service; investigate abuse; administer acceptance and downloads; establish, exercise or defend legal rights; and meet legal obligations. Any additional use or disclosure must have an applicable legal basis and, where required, appropriate notice or consent. This policy does not grant us a licence to sell personal information or use private customer files for unrelated marketing or AI training. No marketing consent is bundled into the download acceptance step. ## 5. Storage, integrations and recipients You select a local or supported cloud-drive folder for the document library. The desktop application and integrations process file content to carry out requested functions. Choosing your own folder does not mean that no personal information reaches hosted systems: account information, metadata, notes, search data and acceptance records may be hosted separately. File bytes may also be supplied to us if you deliberately send them for support. Your storage provider operates under your separate arrangements. The current services and locations are: - Supabase: account authentication, PostgreSQL database, backend functions and private installer storage. Our project's primary region is Sydney, Australia (ap-southeast-2), verified in the project settings. Account, workspace, search and acceptance records are held in that project. Supabase's corporate, support and subprocessor arrangements can involve the United States and Singapore. Primary-region storage is not an assurance that support, logs, edge execution or every other processing operation stays in Australia. - Netlify: website hosting and delivery, enquiry capture and notification, and server functions for account and download requests. Netlify processes information in the United States and through its international delivery and service infrastructure. Website requests and enquiries therefore may be processed overseas even though the app's primary database is in Australia. Netlify hosts the website, not the customer-selected document library. - Resend: transactional account, invitation and recovery emails are sent through Resend from our notify.efilevault.com.au subdomain, configured to dispatch through Tokyo, Japan. Sending region does not determine data residency: Resend states that message content, delivery logs, email metadata and account/API records are stored in the United States. Recipient addresses and authentication links are processed for delivery; recipients’ own email providers also handle those messages. - Microsoft 365: our info@venture-stack.com.au mailbox receives enquiry notifications, support correspondence and privacy requests. Microsoft's storage location depends on the tenant and service configuration, and its operations can involve the United States and other countries. We do not represent that our mailbox, delivery, security or support processing is exclusively Australian. A sender's own email provider also participates in delivery. - Google and Microsoft: Gmail and Microsoft mail APIs are used when you connect those mailboxes. Google Drive, OneDrive, iCloud Drive or another folder-sync provider may hold files where you select that provider's local synced folder. Those providers' account, region and retention arrangements are separately controlled by you or your organisation; they can involve Australia, the United States and other locations under your configuration and their terms. - GitHub: private source-code and deployment management. Customer matter records and enquiry submissions are not intended to be copied into the source repository. Build/developer account information is processed under GitHub's arrangements, including in the United States. The initial free pilot does not collect payment-card details or use a paid checkout. Stripe is a planned payment integration, not a requirement to participate in this pilot. Customer AI search is not included in the pilot; the app contains an operator-controlled internal AI integration, and enabling any customer AI processing requires a separate assessment and appropriate notice or consent. An installed software dependency alone does not mean customer information is sent to its developer. Information may also be disclosed to personnel and contractors who need it for the relevant work; communications and security providers; your authorised organisation members; professional advisers and insurers; and authorities or other recipients where law requires or permits it. In a genuine business transaction, relevant information may be disclosed to advisers or prospective successors under appropriate arrangements and applicable law. The countries identified above are the presently identified likely locations, not an undertaking that every network route, support recipient or service subprocessor operates only in those countries. Provider infrastructure and customer-selected integrations can change. Contact us for the current information reasonably available about a particular service. Where overseas disclosure occurs, applicable Australian privacy requirements continue to apply. Acceptance of this policy does not waive overseas-disclosure protections or provide blanket consent to an exception to them. ## 6. Security and customer controls Security arrangements depend on the component and deployment and include access controls, authentication and protected connections where configured. We take the steps required by applicable law. No system is immune from error, unauthorised access or loss, and no absolute protection, end-to-end encryption or guaranteed restoration is represented. Some hosted search data can contain readable content or sensitive terms; do not assume all stored data is encrypted in a manner inaccessible to the operator. You are responsible for your devices, account security, user permissions, connected services and independent backups. Notify us of suspected unauthorised access. These responsibilities do not excuse our own legal duties. Where a breach triggers a legal assessment or notification requirement, we will respond as required by that law; no fixed contractual notification deadline is created by this policy. ## 7. Retention and legal records We use category-based retention reviews. The periods below are our ordinary retention settings or review targets, not a promise of recovery or a justification for retaining information that applicable law requires us to destroy sooner. We assess the purpose, sensitivity, account status and any legal obligation or actual or reasonably anticipated dispute before disposal. - Enquiries that do not become a customer relationship: ordinarily reviewed for deletion within 12 months after the enquiry is resolved. Duplicated Netlify form submissions are reviewed for removal within 90 days after transfer to the support mailbox and resolution, unless needed for a complaint or security investigation. - Routine support correspondence: ordinarily reviewed within 24 months after resolution. Material contractual, complaint, security or dispute evidence may instead follow the relevant legal-record period; unrelated attachments should not be kept merely because the correspondence is retained. - Unverified, unused registrations: ordinarily reviewed after 30 days for removal. Active account and workspace information is kept while needed to administer the relationship and requested functions. After closure, unnecessary operational account information is ordinarily reviewed within 90 days. An individual's departure does not automatically erase an organisation's continuing workspace records. - Acceptance, consent, account-closure and material contractual evidence: the ordinary review point is seven years after the account relationship ends or the relevant dealing is completed, whichever is later. We retain only information reasonably needed to establish the dealing or address legal obligations or claims; this period is not a statutory requirement applying to every record. Earlier disposal or de-identification may be appropriate, and a documented legal hold may justify longer retention. Exact historical document wording may remain available without retaining unnecessary identifying data. - Routine application/security diagnostic logs under our control: ordinarily reviewed within 90 days. Hosting and authentication providers operate their own log and backup cycles, which depend on service and plan. Logs needed for a specific incident may be retained as incident evidence for the period justified by that incident. - Customer-selected libraries, local app data and connected mailbox copies: retention is also controlled by you, your organisation and your providers. The app's recovery features use a nominal 30-day recovery period where supported; expiry cleanup depends on the app running, permissions, file integrity and storage availability. That is neither guaranteed restoration nor a promise that every copy is erased on day 30. Recycle-bin, backup, synced and independently retained copies can follow different cycles. Resend currently describes 30-day email and log retention for its standard Free, Pro and Scale plans, seven-day backups, and deletion of remaining customer data within 90 days after service termination, subject to its contractual arrangements. These are provider-described cycles, not a guarantee that every delivered email or independent copy is removed at those times. Our own invitation and joining records are reviewed with account and material contractual evidence; recipient mailbox copies are controlled by their holders. These reviews involve operator action; not every category has automatic deletion. The account-acceptance database is designed to preserve evidence against ordinary edits. Authorised corrections, withdrawal records and lawful disposal require a controlled process that preserves an appropriate explanation without preventing applicable access, correction or destruction rights. Consent withdrawal does not retrospectively invalidate lawful processing or automatically remove evidence retained for another lawful purpose. Where applicable law requires destruction or de-identification when information is no longer needed, we act accordingly, subject to lawful exceptions. A legal hold is limited to relevant information, documented and reviewed; it is not indefinite retention because a dispute is merely imaginable. Backups and third-party replicas can have different deletion cycles. Information restored from a backup requires the relevant closure, correction and disposal decisions to be reapplied. Removing an account does not automatically remove files from your drive or copies independently held by other people. ## 8. Access, correction and complaints Email info@venture-stack.com.au with your request or complaint and sufficient information to locate the relevant records. We may seek reasonable identity/authority verification and clarification, and may redact third-party information or rely on a lawful exception. We will handle requests, explain refusals and any available complaint mechanisms, and charge any permitted access fee only in accordance with applicable law. We do not charge merely to make a privacy complaint. If information relates to an organisation's workspace, we may coordinate with its authorised contact where appropriate without overriding rights you have against us. To complain, identify the concern, relevant account and desired resolution. If unresolved, you may contact the Office of the Australian Information Commissioner at https://www.oaic.gov.au or another competent regulator. Applicable statutory timeframes and remedies are unaffected by the absence of a promised service-response time. ## 9. Website technologies and changes The website uses browser/session mechanisms needed for sign-in and operation, and hosting providers may process technical request information. The present website does not intentionally include advertising trackers; this is a description of the current implementation, not an irrevocable product commitment. Any future technology must be assessed for applicable notice/consent requirements before introduction. We may revise this policy to reflect changed practices or legal requirements. A revised notice does not itself authorise a new use or override a consent requirement. Material changes requiring notice or consent will be handled accordingly. Historical versions relevant to recorded acceptances may be retained as evidence. ## 10. Business contact VENTURESTACK PTY LTD — ABN 55 699 711 272. Enquiries, support, privacy and electronic notices: info@venture-stack.com.au. No street address is published on this website. This does not displace statutory service arrangements or any applicable obligation to provide an address in another context.