Privacy Policy

1. Introduction

Gateway Financial Group Pty Ltd (ACN 15 627 115 619), trading as Gateway AI ("we", "our", or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services at gatewayai.com.au.

By accessing or using our services, you agree to this Privacy Policy. If you do not agree with the terms of this policy, please do not access our services.

2. Information We Collect

Personal Information

We may collect personal information that you voluntarily provide to us when you:

• Register for an account
• Subscribe to our services
• Fill out a form or contact us
• Participate in promotions or surveys

This information may include:

• Name and contact details (email, phone number, address)
• Business information (company name, ABN/ACN)
• Account credentials
• Payment information
• Any other information you choose to provide

Automatically Collected Information

When you access our services, we may automatically collect:

• Device information (browser type, operating system)
• IP address and location data
• Usage data (pages visited, features used, time spent)
• Cookies and similar tracking technologies

Information from Third Parties

We may receive information about you from third-party services you connect to our platform, such as:

• Integration partners (e.g., email providers, CRM systems)
• Authentication providers
• Payment processors

Financial and Accounting Data

If you use Gateway Accounts, we collect and process financial information including:

• Invoices, bills, and payment records
• Bank transaction data (including via open banking connections)
• Employee payroll information (names, tax file numbers, superannuation details, pay rates)
• Tax-related information (GST, PAYG withholding, BAS data)
• Receipts and documents uploaded for processing

This information is stored securely and used solely for providing accounting services within the platform. We do not share your financial data with third parties except as required to operate the service (e.g., open banking providers).

Open Banking Data

If you connect a bank account via our open banking integration (powered by Basiq), we may access:

• Account balances and details
• Transaction history (descriptions, amounts, dates)
• Account holder information

This data is accessed with your explicit consent via the Consumer Data Right (CDR) framework. You can revoke access at any time through your bank or through the Gateway AI platform. We do not store your bank login credentials — authentication is handled securely by the open banking provider.

Health and Fitness Data

If you use Gateway Fit, we collect health and fitness information including:

• Body measurements (height, weight, body composition)
• Fitness goals and preferences
• Workout logs and exercise history
• Meal plans and nutritional preferences
• Progress photos (if you choose to upload them)

Health and fitness data is treated with additional sensitivity. We do not share this data with third parties for marketing purposes. This data is used solely to provide personalised fitness programs and track your progress.

Document and Image Data

If you use our document capture, signing, or document generation features, we process:

• Uploaded documents, receipts, and images
• Electronically signed documents
• Generated documents and templates

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send administrative information, updates, and security alerts
• Respond to your comments, questions, and support requests
• Personalise your experience and deliver relevant content
• Monitor and analyse trends, usage, and activities
• Detect, prevent, and address technical issues and fraud
• Comply with legal obligations

4. How We Share Your Information

We may share your information in the following circumstances:

• Service Providers: With third-party vendors who perform services on our behalf (hosting, payment processing, analytics)
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• Legal Requirements: When required by law or to protect our rights
• With Your Consent: When you have given us permission to share your information

We do not sell your personal information to third parties.

5. Artificial Intelligence and Automated Processing

We use artificial intelligence (AI) technologies to provide and improve certain features of our Services. This includes:

• Document Capture: Uploaded receipts, invoices, and documents may be processed by third-party AI services (Anthropic Claude) to extract text, amounts, and other information. The document content is sent to the AI provider for processing and is not retained by them beyond the processing request.
• Fitness Programs: AI may be used to generate personalised workout programs and meal plans based on your profile and goals.
• Voice Assistant: Voice interactions may be processed using AI speech-to-text and text-to-speech services (OpenAI).
• AI Chatbot: Conversations with the AI chatbot are processed by AI language models to generate responses.

AI-generated outputs are provided as suggestions and should be verified by you. We do not guarantee the accuracy, completeness, or suitability of any AI-generated content. See our Terms of Service for further disclaimers.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication measures
• Secure data storage facilities

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as necessary to:

• Provide our services to you
• Comply with legal obligations
• Resolve disputes and enforce our agreements

When your information is no longer needed, we will securely delete or anonymise it.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Remember your preferences and settings
• Understand how you use our services
• Improve our services and user experience
• Provide relevant advertising

You can control cookies through your browser settings. However, disabling cookies may affect the functionality of our services.

9. Your Rights

Under the Australian Privacy Act 1988, you have the right to:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal requirements)
• Opt-out: Unsubscribe from marketing communications
• Complaint: Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

To exercise these rights, please contact us using the details below.

10. Third-Party Services

Our services may contain links to third-party websites and integrate with third-party services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.

Third-party services we use include:

• Anthropic (Claude AI): Document analysis, AI chatbot, content generation
• OpenAI: Text-to-speech for Voice Assistant
• Basiq: Open banking data aggregation (bank account connections)
• DocuSeal: Electronic document signing
• Mailgun: Transactional and marketing email delivery
• MobileMessage: SMS delivery
• Cloud hosting providers: Server infrastructure and data storage

11. International Data Transfers

Your information may be transferred to and processed in countries other than Australia. When we transfer data internationally, we ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy.

12. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us immediately.

13. Data Breach Notification

In the event of a data breach that is likely to result in serious harm to any individual whose personal information is involved, we will:

• Notify affected individuals as soon as practicable
• Notify the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988
• Take reasonable steps to contain and remediate the breach
• Provide information about the breach including what data was involved and steps individuals can take to protect themselves

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last Updated" date. We encourage you to review this policy periodically.

15. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us: