Privacy Policy

1. About this policy

This Privacy Policy explains how Genesis Chain Financial Group Pty Ltd (ABN 48 625 098 937, ACN 625 098 937) trading as CreditPolicy.ai and CreditPolicy.com.au (we, us, our) collects, holds, uses and discloses personal information.

We are bound by the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). This policy covers everything we operate under the CreditPolicy name, together called the Service:

• the CreditPolicy web application at creditpolicy.ai and creditpolicy.com.au, including the broker workspace, Client AI, scenarios and servicing, document generation, forms and the admin tools;
• the Client Portal, the branded Fact Find and document-collection pages a broker sends to their client (for example portal.creditpolicy.ai or a link such as creditpolicy.ai/l/your-broker);
• the CreditPolicy mobile app for iPhone and Android;
• our Model Context Protocol (MCP) server at https://creditpolicy.ai/api/mcp, used through AI assistants such as Claude, ChatGPT, Perplexity, Cursor and similar clients;
• the CreditPolicy Form Filler Chrome extension;
• ask by email, where a broker emails a question to our answer address and gets a reply;
• our APIs, integrations, emails, support channels and marketing website.

If you do not agree with this policy, please do not use the Service.

2. Who we deal with

The Service is a business tool for licensed Australian mortgage and finance brokers, their staff and their licensees. Three groups of people appear in this policy:

• Brokers and their staff (account holders). Your information is information about you: your name, email, billing details and how you use the Service.
• Your clients (borrowers, guarantors, directors, trustees and other people in a client file). Client information is personal information about your clients that you put into the Service, or that they give us directly through the Client Portal. We handle it on your behalf. Section 10 sets out how responsibility is split.
• Visitors and correspondents: people who browse our website, use the chat widget, email us or sign up for updates.

The Service is not intended for anyone under 18, and the Client Portal is used by borrowers only because their broker sends them to it.

3. What personal information we collect

3.1 Brokers and staff (information you give us)

3.2 Your clients (information about the people in a client file)

3.3 Information we collect automatically

3.4 Information from third parties

• Sign-in providers. If you sign in with Google (web and mobile) or Apple (mobile), we receive your name, email address and a unique identifier from that provider. Apple may give us a private relay address instead of your real one.
• Connected AI assistants. When you connect the Service to an AI assistant via MCP, we receive the requests that assistant sends on your behalf (section 9).
• Payment processors. From Stripe: subscription status, payment success or failure, the last four digits and brand of your card for receipting. From Apple and Google via RevenueCat: whether an in-app subscription is active, its product and renewal date, and a purchase identifier.
• Public registers. We verify business details against the Australian Business Register (ABN Lookup) and may read your public website to set up your branding.
• Email authentication. When you email a question in, we receive the sender-authentication results (SPF, DKIM, DMARC) that Amazon SES computes for your message, so we know it really came from you.
• Your client's bank-statement provider. If you use an illion BankStatements link in your portal, the statements go from illion to you under your own illion account. We do not receive them from illion; we only record that your client said they completed that step.

3.5 Sensitive information and identity documents

We do not ask for sensitive information as defined in the Privacy Act (such as health information, racial or ethnic origin, political opinions, religion or criminal record). Please do not enter it, and do not ask your clients to, unless it is strictly necessary for the matter you are assessing. If you do, you confirm you have the person's consent for us to handle it as described here.

The Service does handle identity documents and financial documents about your clients, because lenders require them. Specifically:

• Driver licences, passports and other identity documents can be uploaded by you or by your client through the Client Portal. We read the name, document number, expiry and date of birth from them to run the ID check described in section 11, and store the document in your client file.
• Tax File Numbers are never stored. Every document uploaded through the Client Portal is scanned for a visible TFN before it is saved. If one is found, the number is permanently covered in the saved copy and the original is discarded; if that cannot be verified, the file is rejected and the client is asked to cover the TFN and try again. Our AI extraction is instructed never to return a TFN, bank account number, passport number or licence number as text, and dates that look like a TFN are scrubbed. Please do not type TFNs into notes, chat or forms.
• Information about your client's credit history, defaults or repayment history may be credit information or credit eligibility information in your hands. Section 12 explains how that is treated.

4. How we collect personal information

We collect personal information directly from you wherever reasonably practicable: when you sign up, subscribe, use the Service, email a question in, contact support, or connect an AI assistant. We collect information about your clients from you, in the course of you using the Service, and directly from your clients when you send them a Client Portal link.

Where we collect personal information about an individual from someone other than that individual (for example, from you about your client), we rely on you to have told that individual what APP 5 requires, including that you use third-party software and AI-assisted tools (section 10). Where you turn on the disclosures step, the Client Portal shows your client a collection notice in your name and records their acknowledgement, but the APP 5 notice is yours to give whether or not you use that step.

5. Why we collect, hold, use and disclose personal information

We use personal information for these purposes:

1. To provide the Service: create and administer your account, authenticate you, answer your policy questions with citations, run scenario and serviceability assessments, read and organise documents, store your client and deal records, generate documents and fill forms, run your Client Portals, and deliver results to the channel you asked from (web, mobile, email, extension or a connected assistant).
2. To operate the AI features: process your queries, documents and client-file context through our retrieval systems and third-party large language models (section 7).
3. To bill you: manage subscriptions, trials, promo codes, referral rewards, credits, invoices, renewals, failed payments and refunds.
4. To support you: respond to enquiries, troubleshoot, onboard and train you. Our support staff may view your account in a read-only preview when you ask for help; every such session is logged and expires after an hour.
5. To secure the Service: detect and prevent fraud, abuse, unauthorised access and breaches of our Terms; apply rate limits; keep audit logs; investigate incidents.
6. To improve the Service: understand which features are used, diagnose faults, measure performance, test variations of pages such as onboarding, and develop new features. Where we use content for improvement we aggregate or de-identify it wherever practicable.
7. To communicate with you: send service messages (billing notices, security alerts, policy-library updates, changes to these documents) and, where permitted, marketing (section 16).
8. To meet our legal obligations: comply with laws, court orders and regulatory requests, and keep the records tax and corporations law require.

We do not sell personal information. We do not disclose personal information to third parties for their own marketing purposes.

6. Where the Service sends information at your direction

Some features exist only to send information where you tell us to. When you use them, the disclosure is yours and the recipient's own privacy terms apply:

• Client Portal invitations and disclosures go to the client email address you enter, under your branding, from our mail servers.
• Exports (PDF, CSV, JSON, zip) download to your device, and a webhook export posts the client file to a public https address you configure, such as your CRM or an automation service like Zapier or Make. We validate the address, never follow redirects and never return the upstream response to the page.
• DocuSign: when you send a filled form for signature, the PDF and the signer's name and email are sent to DocuSign under our DocuSign account and the envelope is delivered by DocuSign.
• Connected AI assistants receive whatever the assistant asks for on your behalf (section 9).
• Team members on a team plan can see the shared brand kit, templates and disclosures, and the client files the team shares.

7. How the AI features work, and what that means for your data

CreditPolicy answers questions by searching an index of lender credit policy documents and then using large language models to compose an answer with citations back to the source material. The same models read documents, extract facts into client files, match form fields to a client file, draft documents, transcribe dictation and assist Client AI.

What is sent to a model provider depends on the feature:

• Policy questions and comparisons: your question, the relevant passages retrieved from the policy library, and any scenario or client context you include.
• Document reading (intake, portal uploads, forms): the document itself, as text or page images, so the model can classify it and read the facts out.
• Client AI, document drafting and the form filler: the parts of the client file needed for that task.
• Dictation: the audio clip you record, which is transcribed and then discarded by the model provider.

Our model providers are OpenAI (United States) and Google (Gemini API, United States and other Google locations). Both are engaged on API terms under which content submitted through the API is not used to train their general-purpose models, and we rely on and hold them to those terms. We also use Cohere (Rerank API, United States) to put the lender-policy excerpts we retrieve for a question in order of relevance; it receives your question and those excerpts and returns a ranking. We do not use your client records or uploaded documents to train models that serve other customers. We retain your questions and the answers so you can see your history, so we can support you, and so we can diagnose faults.

AI output can be wrong. Generated answers and extracted facts may be incomplete, out of date or incorrect, and lender policy changes frequently. You must verify any output against the lender's current policy document, the source document and the lender's own assessment before relying on it. This is reinforced in our Terms of Service.

8. Automated decision-making

The Service does not make decisions about any individual by automated means that have a legal or similarly significant effect on them. In particular, it does not decide whether anyone gets credit, on what terms, or whether an identity is accepted.

What it does do, using computer programs including AI models, is produce information that you, the broker, use in your own decisions: serviceability calculations, lender-policy comparisons, which facts appear in a client file, whether an uploaded identity document matches the name and date of birth your client confirmed, and whether a document shows signs of alteration that you should review. Each of those produces a result or a flag for a human to look at; none of them acts on its own. A human, you, makes every credit-related decision, and your client can ask you to review anything the Service produced about them.

We publish this section because the Privacy Act's new transparency requirements for automated decision-making (APP 1.7 to 1.9) come into effect on 10 December 2026, and we would rather say now what the computer programs in the Service use and do.

9. Connecting third-party AI assistants (MCP)

You can connect the Service to AI assistants and developer tools that support the Model Context Protocol, for example Claude (Anthropic), ChatGPT (OpenAI), Perplexity, Gemini, Cursor, Visual Studio Code and others.

How the connection works. You start the connection from inside the assistant. You sign in to CreditPolicy through an OAuth 2.0 flow and expressly authorise the assistant on a consent screen that names the assistant, where it will send you back to, and every tool it will be able to use, including the ones that change your client files or send email. We never receive your password for the assistant, and the assistant never receives your CreditPolicy password. The assistant receives a scoped access token that you can revoke at any time from Settings in CreditPolicy or from the assistant's own connector settings. Developer tools that cannot do OAuth can use a personal key you create in Settings; those keys are shown once, stored hashed, limited to ten live keys, and revocable the same way.

What data flows where. When you use a connected assistant:

• the assistant sends your prompt (and anything you include in it) to our MCP server;
• we process that request as described in this policy and return the result (policy excerpts, citations, comparisons, assessments, or your own client and deal records) to the assistant;
• that returned data then sits inside your conversation with the assistant and is handled under that provider's privacy policy and terms, not ours. It may be stored in your chat history with that provider, processed outside Australia, and subject to that provider's own retention, logging and human-review practices.

What this means for you. If you include a client's personal information in a prompt to an assistant, or ask the assistant to retrieve a client file from CreditPolicy, that information is disclosed to the assistant's operator. You are responsible for deciding whether that is appropriate, for having the necessary consent, and for your own privacy obligations to your client. Review the assistant's privacy policy before connecting it, and avoid putting client-identifying information into an assistant unless you have a clear basis for doing so.

Scope of access. The connector gives read-only access to the lender policy library, and read and write access to your own client files, scenarios, documents and portals. It can email a client their portal invitation under your branding when you ask it to. It cannot delete policy content, change your subscription, reach other users' data or sign in as you anywhere else. Every change it makes is logged on the client file.

Our role. We do not control, endorse or accept responsibility for any third-party assistant. We may suspend, restrict or discontinue MCP access, or access for a particular assistant, at any time.

10. Your clients' personal information: how responsibility is split

When you put your client's personal information into the Service, or send your client a portal link, you remain the organisation with the relationship to that person and the primary privacy obligations to them. We handle their information on your behalf and under your instructions, as your service provider.

By using the Service you represent and warrant that:

• you have collected your client's personal information lawfully and fairly, and for a lawful purpose connected with their finance application;
• you have given your client the notice APP 5 requires, including that you use third-party software providers and AI-assisted tools to assess their position, and that their documents may be processed outside Australia by those providers;
• you have any consent required under the Privacy Act, Part IIIA of the Privacy Act and the Privacy (Credit Reporting) Code for you to disclose that information to us and, where you choose to use a connected AI assistant, DocuSign, a webhook destination or a bank-statement provider, to those recipients;
• you will not enter, or ask your client to provide, personal information that is not reasonably necessary for the matter; and
• you will comply with your own privacy policy and your aggregator's and licensee's requirements.

You indemnify us for claims arising from your failure to do these things, as set out in our Terms of Service.

If your client asks you for access to, or correction of, information held in the Service, you can action it yourself in the application. We will assist you on request. If your client contacts us directly, we will verify who they are, tell them which broker holds their file, and refer the request to you unless the law requires us to act ourselves.

11. The Client Portal (for your clients)

This section is written so that a broker's client can read it too. If you have been sent a CreditPolicy portal link by your broker, this is what happens to your information.

Whose portal it is. The portal is run by CreditPolicy on behalf of your broker, under your broker's name and branding. Your broker is collecting the information for your finance application; CreditPolicy stores and processes it for your broker. Your broker's privacy policy applies to how they use it.

Signing in. You sign in with a one-time code emailed to the address your broker entered. We never ask you for a password. The link itself is signed and expires; attempts to guess a code are limited.

What we collect from you. Your answers to the Fact Find questions your broker chose; the documents you upload; your address (looked up through Google's Places service as you type, so that it is complete and correctly formatted); your messages to your broker; your confirmation that you completed the bank-statement step; your electronic signature on your broker's disclosure documents, with the time and the IP address it was signed from; and the technical data in section 3.3.

Documents you upload are checked before they are saved: the file type and size are verified, every page is scanned for a Tax File Number (section 3.5), the document is classified (payslip, statement, licence and so on), the facts a lender needs are read out of it into your broker's file, and it is checked for signs of alteration. Those checks use the AI providers in section 7. A document that fails the TFN check is not saved.

Identity check. If you upload a driver licence or passport, we compare the name, date of birth and expiry on it with the details you confirmed, and flag the result for your broker. This is a document check only. It is not a government Document Verification Service check, a biometric check or a credit check, and it does not decide anything on its own; your broker decides whether your identity is verified.

Bank statements. If your broker uses an illion BankStatements link, that step takes you to illion's own service in a frame inside the portal. Anything you enter there (your bank login, your consent) goes to illion, not to us, and illion's privacy policy applies. We only record that you told us you completed the step.

What we do not do. We do not run credit checks, we do not contact your bank, we do not share your information with anyone other than your broker, their team, and the service providers in section 14 that operate the portal, and we never sell it.

Your rights. You can ask your broker, or us at privacy@creditpolicy.ai, for access to or correction of your information, or to delete it. Because your broker holds your file, we will ordinarily act on your broker's instruction, but if we cannot reach your broker or the law requires us to act, we will deal with you directly.

12. Credit information

We are not a credit provider, a credit reporting body or a credit-related service provider under Part IIIA of the Privacy Act, and we do not obtain credit reports or credit eligibility information from credit reporting bodies.

Information you or your client enter about financial position, credit history, defaults or repayment history may nonetheless be credit information or credit eligibility information in your hands. Where that is so, your handling of it, including your decision to enter it into the Service or a connected AI assistant, is governed by Part IIIA and the Privacy (Credit Reporting) Code and remains your responsibility. We handle it as confidential information under this policy and our Terms.

13. The mobile app, the Chrome extension and ask by email

13.1 Mobile app

The CreditPolicy app for iPhone and Android is a chat client for the same account and uses the same servers and providers as the web app. Specific to the app:

• Sign in with Google, or with Apple where offered, gives us your name, email (or an Apple relay address) and an identifier.
• Face ID, Touch ID or your device unlock can be used to lock the app. The biometric check happens entirely on your device through the operating system; we never receive your biometric data, only a yes or no.
• Camera and photo library are used only when you choose to attach a photo of a document to a question; the image is uploaded to your account like any other attachment.
• Microphone is used only when you choose to dictate; the recording is transcribed by OpenAI (section 7) and the audio is not kept.
• AI data sharing needs your permission. Before the app sends your first question, attachment, voice note or client details to our AI providers (OpenAI, Google Gemini and Cohere, section 7), it explains what is sent and why and asks you to agree. Nothing is sent until you do. You can withdraw that permission at any time in Account > Privacy & security; the app then sends nothing further to those providers until you agree again.
• Your session is stored on the device encrypted with a key held in the device keychain or keystore, and is excluded from device backups on Android.
• Subscriptions bought in the app are billed by Apple or Google. We use RevenueCat to recognise the purchase; it receives your CreditPolicy user identifier (a random ID, not your name or email), the product bought and the purchase receipt, and tells us whether the subscription is active. We do not see your Apple or Google payment details.
• Deleting your account can be done from Account in the app or at creditpolicy.ai/delete-account; see section 19.

13.2 The Form Filler Chrome extension

The Form Filler is an optional Chrome extension that fills web forms you open (for example a lender, aggregator or insurer application) from one of your CreditPolicy client files.

Where it can run. The extension only has permission to talk to creditpolicy.ai. For every other website you want to fill a form on, you grant it access to that site the first time, from the extension's own panel; Chrome shows you the request. It never runs on a site you have not allowed.

What it reads. Only when you press Fill or Next, it reads the fillable fields on the page in your active tab: each field's label, name, type, section heading, the options of drop-downs and radio buttons, and any value already in the field, plus the page's address and title. It does not read pages in the background, does not record your browsing history, and does not read passwords, card details, one-time codes or the page's query string.

What it sends to us. That field list and the client you picked are sent to the Service, which matches the fields to that client file using the AI providers in section 7 and returns a value for each field the file supports. We record that a page was filled (the website address, number of fields and the client), the model used and its cost, in your activity log and credit usage. We do not keep the page's contents.

What it changes. It types the matched values into the page in your own browser. It never submits a form, never presses a Submit, Lodge, Apply, Pay or similar button, never ticks declaration, consent or privacy boxes, and never answers a consent question asked as a drop-down or radio button. The only button it presses is the form's own Next or Continue, and only when you ask it to fill every page. What happens to information you then submit to that website is governed by that website's own privacy policy.

Sign-in. The extension uses your existing CreditPolicy sign-in in the same browser by reading our own website's session cookie; it does not read cookies from any other site. Settings you choose in the extension are stored in your browser only. You can remove the extension at any time from Chrome's extensions page.

13.3 Ask by email

You can email a question to our answer address from the email address on your account. The message, including any attachments, is received by Amazon SES in Ireland, held briefly in Amazon S3 in the same region, authenticated (we only answer a message whose sender authentication aligns with your account's address), processed like a question asked in the app, and answered by reply. The question and answer appear in your saved chats. Please do not email identity documents or anything containing a TFN.

14. Who we disclose personal information to

We disclose personal information to the following categories of recipient, only as needed for the purposes in section 5:

We require our service providers to protect personal information consistently with the Privacy Act and to use it only for the purposes we engage them for.

15. Security

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These include:

• encryption in transit (TLS, with HSTS) and encryption at rest for the database and file storage;
• row-level access controls in the database so each broker and each team can reach only their own client files, and a separate allow-list of the profile fields a user can change;
• hashed and salted password storage; one-time login codes that are rate-limited and locked after repeated wrong attempts;
• OAuth 2.0 with scoped, revocable tokens for connected assistants, and hashed personal keys;
• signed, expiring links for the Client Portal, with uploads confined to the client's own folder and checked for type, size and TFNs;
• dedicated signing keys for each kind of token, so one can be rotated without affecting the others;
• browser security headers including a Content-Security-Policy, and a Chrome extension limited to the sites you allow;
• rate limits on sign-up, sign-in, contact, email and MCP actions, and bounds on uploads and processing;
• access logging and audit trails, including a log of every support preview of a customer account;
• least-privilege access for our personnel, granted only where needed for support or maintenance, and never to card numbers, TFNs or your clients' bank logins (we never have those);
• regular patching of our infrastructure and dependencies, and periodic security reviews of the code.

No method of transmission or storage is completely secure. We cannot guarantee absolute security. You must keep your account credentials confidential and notify us immediately at security@creditpolicy.ai if you suspect unauthorised access.

Eligible data breaches. We comply with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. If we suffer an eligible data breach that is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as required. Where a breach affects your clients' information, we will notify you promptly so you can meet your own obligations to them.

16. Overseas disclosure

Our core application data (authentication, your account, your client files and uploaded documents) is hosted in Australia (Sydney). However, several of our service providers process personal information outside Australia: principally in the United States (AI model processing, address lookup, billing, app-store subscription syncing, analytics and live chat), Ireland (transactional email and email-in), and potentially other jurisdictions where those providers operate infrastructure. The AI assistants you choose to connect also process the data they receive wherever they operate.

Before disclosing personal information to an overseas recipient, we take reasonable steps under APP 8.1 to ensure the recipient does not breach the APPs, including by contracting on terms that restrict use and require protection of the information. By using the Service you acknowledge that:

• personal information may be disclosed to the overseas recipients listed in section 14; and
• where you connect a third-party AI assistant, the data returned into that assistant is disclosed at your direction and under that provider's terms, which may involve overseas processing outside our control.

Overseas recipients may be subject to the laws of their own jurisdictions.

17. Direct marketing

We may send you marketing communications about the Service where you have consented or where you would reasonably expect it, consistent with APP 7 and the Spam Act 2003 (Cth). Our product updates and marketing email are sent through Amazon SES (section 14), and the list and preference records behind them are held on our own systems in Australia.

Every marketing message includes a working unsubscribe link, and we keep a suppression record so we do not re-contact you. You can also opt out at any time by emailing privacy@creditpolicy.ai. Opting out of marketing does not stop service messages (billing notices, security alerts, policy-library updates, portal activity and changes to these documents), which are part of providing the Service.

We do not provide your personal information to other organisations for their direct marketing. We never market to your clients.

18. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Service and understand how it is used. In detail:

• Strictly necessary: authentication and session cookies set by our sign-in system; a short-lived cookie that carries you through onboarding; a signed referral cookie if you arrived through another broker's referral link (kept for 30 days so the referral can be attributed, see section 3.1); and, for our support staff only, a one-hour preview cookie when they view an account to help you. These cannot be disabled without breaking the Service.
• Preference: remembering your settings in the app, and in the extension.
• Analytics and performance: Microsoft Clarity records anonymised session replays (clicks, scrolls and page interactions) and generates heatmaps; Google Tag Manager manages our analytics tags; Vercel Speed Insights measures page-loading speed, sets no cookies and does not identify you. We may also show different versions of a page (for example onboarding) to different new users to see which works better.
• Support: our live chat widget, Zoho SalesIQ, sets cookies so a conversation survives a page refresh and a returning visitor's chat history stays with them. If you are signed in, we pass your name, email address, brokerage name and subscription plan to SalesIQ so the person helping you can see who they are talking to.

We do not show a cookie banner. If you previously declined analytics on an earlier version of our site, that choice is still honoured on the same browser: we do not load Clarity, Google Tag Manager or Speed Insights, and we turn off SalesIQ's page-by-page visitor tracking while the chat widget itself stays available. To opt out of analytics, block or delete cookies in your browser, or contact us using the details in this policy. Blocking strictly necessary cookies will prevent you from signing in.

The Client Portal and the mobile app do not load Clarity, Tag Manager or SalesIQ.

We do not currently respond to "Do Not Track" browser signals.

19. Data retention and deletion

We keep personal information for as long as we need it for the purposes in section 5, or as the law requires, and we are specific about what that means in practice:

Deleting your account. You can delete your account from Account in the mobile app or at creditpolicy.ai/delete-account. If you have no active paid subscription, deletion is immediate: your sign-in, profile, client files, scenarios, documents, portals, conversations and keys are deleted or de-identified in our live systems. If you have an active subscription, we cancel it and complete the deletion within 2 business days, and email you when it is done. Billing records, and logs we must keep, are retained as above. We do not delete an account at a team member's request without the account owner's instruction.

Your clients. When your account is deleted, your clients' information goes with it. If you want a client's information deleted while your account stays open, delete or archive the client file, or ask us.

20. Access, correction and deletion

You have a right under APP 12 and APP 13 to ask for access to the personal information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

Most information is available directly in Settings, and client files can be exported in full from the application. For anything else, email privacy@creditpolicy.ai. We will:

• acknowledge your request within 5 business days;
• respond within 30 days;
• verify your identity before releasing information;
• provide access free of charge, except that we may charge a reasonable, disclosed fee for the cost of retrieval where a request is substantial.

If we refuse access or correction, we will tell you why in writing and how to complain.

21. Complaints

If you think we have breached the APPs or mishandled your personal information, contact us first at privacy@creditpolicy.ai with the details. We will acknowledge within 5 business days and aim to resolve the complaint within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

• Online: oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

22. Children

The Service is not directed at, and must not be used by, anyone under 18. We do not knowingly collect personal information from children, except where a broker's client file necessarily records a dependant's existence and age for a serviceability assessment. If we learn we hold a child's information for any other reason, we will delete it.

23. Anonymity and pseudonymity

Under APP 2 you have the option of dealing with us anonymously or under a pseudonym for general enquiries and website browsing. This is not practicable for the Service itself, because we must identify account holders to authenticate them, bill them, secure their data and meet our legal obligations, and a Client Portal is tied to the client your broker is acting for.

24. Changes to this policy

We may update this policy at any time. The current version is always at creditpolicy.ai/privacy with the "Last updated" date at the top. If we make a change that materially affects how we handle your personal information, we will notify you by email or in-app notice before it takes effect. Continuing to use the Service after a change takes effect means you accept the updated policy.

25. Contact us

Privacy Officer Genesis Chain Financial Group Pty Ltd trading as CreditPolicy.ai and CreditPolicy.com.au ABN 48 625 098 937 | ACN 625 098 937 Registered / office: Ground Floor, 100 Douglas Parade, Williamstown VIC 3016, Australia Email: privacy@creditpolicy.ai Security: security@creditpolicy.ai General: hello@creditpolicy.ai Victoria, Australia