Privacy policy

This policy explains what we collect, why we collect it, and what you can do about it. It's written to comply with the Australian Privacy Principles under the Privacy Act 1988.

What we collect

When you create an account: your email address, and a password we never see in readable form. Optionally your name and phone number.
When you fill in your profile: the stage you're at, the area you're looking in, and whether someone is buying with you. All optional.
When you use a calculator: nothing, unless you choose to save the result or email it to yourself. Calculations run in your browser.
When you download a guide: your email address, and which guide you took.
When you ask a question: the question itself, tied to your account.
Automatically: standard web analytics — pages visited, approximate location, device and browser — used to understand what's useful. We use Google Analytics for this, and the Meta (Facebook) pixel to measure our advertising. Both are described under Cookies and tracking below.

Why we collect it

To run your account, save your progress and keep your results.
To send you the things you asked for.
To answer your questions.
To follow up about a consultation, if you've indicated you're interested.
To send marketing emails only if you've actively ticked the box to receive them.

Marketing and consent

Marketing consent is always a separate, unticked box. If you don't tick it, you won't get marketing email. Every marketing email includes an unsubscribe link that works immediately, as required by the Spam Act 2003.

Where it's stored

Account data is held in Supabase (PostgreSQL), and the site runs on Vercel. Data is encrypted in transit and at rest. Access is limited to the smallest number of people who need it. Row level security means your records are only readable by you and, where necessary, by Jacob.

Who we share it with

We do not sell your information. We share it only with:

The infrastructure providers above, who process it on our behalf.
Our email provider, to deliver the emails you've asked for.
Our customer relationship system, so that a follow-up conversation has the context you've already given us.
Meta (Facebook), for advertising measurement only, as described under Cookies and tracking.
Google, for website analytics, as described under Cookies and tracking.
Anyone we're legally required to share it with.

If you go on to apply for a loan, that's a separate process with its own consents and its own credit guide. Nothing you enter on this website is passed to a lender without you explicitly agreeing to it.

Your rights

See what we hold. Your account settings show everything tied to your account.
Export it. Download a copy of your data from account settings.
Correct it. Edit your profile at any time.
Delete it. Deleting your account removes your profile, progress, saved calculations and questions. Some records may be retained where the law requires it.
Complain. Contact us first. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Cookies and tracking

We use a cookie to keep you signed in, which is essential and can't be turned off without breaking your account. We also keep the page and campaign that brought you here in session storage, so we can link them to an enquiry or signup you submit. That storage ends with your browser session.

We also set two cookies of our own that remember where your visits came from — for example a Google search, our Google Business Profile, or a Facebook or Google ad, including the ad's click reference. They hold no name, email or figures, and expire after 90 days. If you send us an enquiry, that information goes with it so we can see which of our channels are working.

We also use the Meta (Facebook) pixel. It's a small piece of code from Meta that tells us which of our Facebook and Instagram ads bring people to this site, and which of those visits turn into an enquiry. Meta sets its own cookies when it runs.

What we send Meta:

That a page was viewed, and which page.
That a calculator was used, and which one — never the figures you put into it. Your income, your deposit and the result stay on this site.
That a guide was requested, or a chat was booked.
If you give us your email address on one of our forms, a scrambled (hashed) version of it, so Meta can recognise you as the same person who saw the ad. Meta never receives the address itself.

Meta also receives your IP address and browser details automatically, as it would for any website that uses its pixel, and may use this information for its own purposes under Meta's own privacy policy.

To turn it off: use your browser's tracking protection or an ad blocker, or adjust your Facebook and Instagram ad settings. Blocking it does not affect anything on this site — the calculators, guides and your account all work exactly the same.

We also use Google Analytics. It tells us how many people visit, which pages they read, and where they came from — a Google search, our Google Business Profile, an ad, or a link someone sent them. Google sets its own cookies when it runs.

What Google receives:

The pages you view, and the site or campaign that brought you here.
That you submitted one of our forms, and which one — never your name, email, phone number or any figure you entered.
Your approximate location, device and browser, and your IP address, which Google collects automatically under Google's own privacy policy.

To turn it off: install the Google Analytics opt-out browser add-on, or block cookies in your browser settings. Everything on this site keeps working without it.

How long we keep it

Account data is kept while your account is open, and deleted when you close it. Lead and enquiry records are kept for as long as needed to respond to you, and then for the period required by financial services record-keeping obligations.

Contact

Email jacob@afgfin.com.au with any privacy question or request.

Last reviewed: this wording has not yet been reviewed by a legal professional, and the entity details still need to be filled in. Both must happen before the site goes live.