Privacy Policy

About this policy

First Aboard Pty Ltd (ACN 699 291 122, ABN 23 699 291 122) ("FirstAboard", "we", "us", "our") respects your privacy. This policy explains how we collect, use, hold, disclose and protect personal information, and how you can access or correct it or make a complaint.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Even where a small-business exemption might apply, we choose to comply with the APPs because we handle sensitive financial and identity information, and because the brokers and businesses we serve must comply and rely on us to do the same.

This policy covers our websites, firstaboard.com and thebrokersbriefcase.com.au, and the FirstAboard PDF desktop app, including its signing and Smart Fill features (together, the "Services"). By using the Services, you agree to this policy.

Our broker onboarding platform has its own privacy policy at app.firstaboard.com/privacy. That is the one a broker and their clients need: it covers client files, identity documents and a broker connecting their own Claude. Until 18 September 2026 a single policy covered all three products. We split it so each policy says what actually happens in the product you are using. Nothing about how we handle information changed when we split them.

The two roles we handle information in

We handle personal information in two different roles, and it matters which one applies:

• On behalf of our customers. When you send a document out for signature, or upload a form for Smart Fill, the document and the details of the people you ask to sign are yours. You decide what is in the document and who receives it. We hold and process it securely on your instructions, and your own privacy policy also applies to it. If you connect an outside service, such as your own Claude, we send that information to it on your instruction (see "FirstAboard PDF").
• For our own business. We also collect personal information directly, for example from customers who buy a subscription, people who contact us, and visitors to this website.

Where this policy talks about information we hold "on behalf of a customer", a request to access, correct or delete it can go to that customer or to us. The customer usually knows the document best, so we may work with them to respond.

The personal information we collect

Depending on how you interact with us, we may collect:

• Customer account information: name, email address, licence key, subscription status and billing details.
• Document and signing information (held on behalf of our customers): the document you upload, the names and email addresses of the people you ask to sign, and, as each person signs, their typed name, signature image, IP address and browser details, together with an audit trail of the signing. A document can contain anything you put in it, including sensitive information about you or someone else.
• Website and enquiry information: contact details you choose to give us, such as an email address you submit to a waitlist or a support request.
• Payment information: subscription and billing details, processed by our payment provider (we do not store full card numbers ourselves).
• Technical information: IP address, device and browser type, and usage data collected through cookies and similar technologies, used to keep the Services secure and working.

FirstAboard PDF does its everyday work (viewing, editing, redaction and on-device OCR) on your own computer, and those files are not uploaded to us. Four optional features are the exception, because they need our servers to work. We explain each of them, and what we keep, under "FirstAboard PDF" below.

Sensitive information in your documents

A document you work on can hold sensitive information, including identity documents and the government-related identifiers on them (numbers issued by government, such as a driver licence, passport or Medicare number), health information, and financial details such as bank account numbers and tax file numbers. Financial details are not "sensitive information" as the Privacy Act defines it, but they can cause serious harm if misused.

For everyday tasks that information stays on your computer. It reaches us only through the optional features described under "FirstAboard PDF", and then only for the document you chose to use them on.

You decide what is in a document and who you send it to. Where you hold a document containing someone else’s sensitive information, you are responsible for having the consent or authority to hold it and to send it to the people you name, and for any notice the law requires you to give them.

We do not adopt, use or disclose a government-related identifier (such as a licence or passport number) as our own identifier for you, except as permitted by the Privacy Act.

FirstAboard PDF

FirstAboard PDF is a desktop application. For everyday tasks such as opening, viewing, editing, redacting and on-device OCR, your files are processed on your own computer and are not uploaded to us.

Four optional features are an exception, because they need our servers to work:

• Request signatures (sending a document to other people to sign). When you use it, we upload and store the document, your recipients’ names and email addresses, and, as each person signs, their typed name, signature image, IP address and browser details, together with an audit trail of the signing. Once everyone has signed, the completed PDF is emailed to you and all signers.
• Sign on your phone (signing on your mobile and sending it back to the app). Your drawn signature passes through our servers to get it from your phone to your computer.
• AI assistant (the AI chat panel). When you send a message to the assistant, your message, the earlier messages in that conversation, and the text and file name of the document you have open are sent securely to our servers and passed to Anthropic, our AI provider, which generates the reply using its Claude model. The assistant can answer questions about your document and general questions. Nothing is sent unless you send a message, and nothing is sent automatically. We do not store your document text, your messages or the replies; we keep only usage metering (how much of your monthly AI allowance you have used). Anthropic processes the text as our service provider and does not use it to train its AI models. Only use the AI assistant with documents you are comfortable sharing that way.
• Smart Fill (turning a form you are sending into questions for the recipient to answer). When you use it, the form is uploaded to us. We read its text and render images of its pages. Where a page is a scan with no text of its own, that page is sent to Microsoft Azure AI Document Intelligence, in the Azure Sydney region (Australia), to be read. The page images and the text we found are then sent to Anthropic, our AI provider for this feature, which returns the list of questions and where each answer goes. Both process the document as our service providers and do not use it to train their AI models. If you give us your recipient’s email address, we email them the link ourselves.
• What Smart Fill keeps. We keep the form and the questions we worked out from it, so the same form does not have to be read again. When the filled document is produced we delete your recipient’s answers as separate records, but the completed document itself has those answers written onto it, and we keep that with the form. Where the form can be signed electronically, the completed document then goes straight into a signature request: we email your recipient a signing link and record the same signing evidence as Request signatures, including their IP address and browser details. Only use Smart Fill on documents you are comfortable sending this way.

Apart from these features, and the Claude connection described next, we do not see, collect or store the contents of the files you work on.

Connecting Claude to FirstAboard PDF. You can connect your own Claude (an AI assistant made by Anthropic) to your FirstAboard PDF licence. You approve the connection, and you can disconnect it at any time. While it is connected, and only when you ask it to, Claude can upload a document to us, read that document’s text and see images of its pages, prepare a signature request, change the recipients on one, send it, check who has signed, cancel a request that has already gone out, and get a short-lived link to the signed document or to its certificate of completion, which records each signer’s name, email address, IP address and device details. Sending a request needs a preview and your explicit confirmation each time, and you should never set that step to approve automatically.

Anything Claude sees through that connection is sent to the company that runs your Claude. That is usually Anthropic. It can be a cloud provider, such as Amazon Web Services or Google Cloud, if you have set Claude up that way. Nothing is removed first, so it includes the document itself and the names, email addresses and signing details of the people you asked to sign. It may be stored and processed in the United States and other countries. How long it is kept, and whether it may be used to improve AI models, depends on your agreement with that company, your Claude settings and that company’s own policies. We do not control or see any of them. This is different from the AI assistant and Smart Fill above, where Anthropic works as our service provider. Disconnecting does not remove anything Claude has already received; ask that company about it. You can still complain to us about how we sent it (see "Complaints").

For your subscription, we handle account and billing information (for example your name, email and subscription status) through our payment provider, Stripe.

Anything you send through Request signatures, Sign on your phone or Smart Fill is stored on our infrastructure (Supabase, in the Sydney region) in a private location that is not publicly reachable. We keep these documents and signing records for as long as needed to provide the signing service and our records, and you can ask us to delete them at any time by emailing support@firstaboard.com. Encryption at rest is provided by our hosting platform; the app itself does not add a separate layer of encryption to these files.

How we collect information

We collect personal information in these ways:

• Directly from you, wherever practical: when you buy or activate a subscription, when you use one of the optional features above, or when you contact us.
• From your use of the Services: technical and usage information collected automatically through cookies and similar technologies.
• From third parties, where you have authorised it or where it is reasonably necessary, such as our payment provider confirming a payment.

When someone is asked to sign a document, the email inviting them names the person who sent it. Before they can sign, the signing page asks them to agree to signing electronically. What we record as evidence of that signature, including their IP address and browser details, is listed under "The personal information we collect".

Why we collect and use information

We use personal information to:

• provide, operate and improve the Services;
• send documents for signature on your instruction, and record who signed and when;
• act on your instructions given through a service you connect, such as your own Claude;
• process payments and manage subscriptions;
• communicate with you, including by email, about your account, support requests and service updates;
• keep the Services secure, prevent misuse, and maintain audit and access logs;
• meet our legal and regulatory obligations.

We do not sell your personal information, and we do not use it for advertising or share it with advertising networks.

When we disclose information, and to whom

We do not sell your personal information. We disclose it only:

• to the people you ask to sign a document, and to the customer a document belongs to;
• to a service you have chosen to connect, such as your own Claude (usually Anthropic), when you use it;
• to trusted service providers who help us run the Services, under arrangements requiring them to protect the information and use it only for our purposes;
• where required or authorised by law, or to protect our legal rights.

The main service providers we use are:

• Supabase - database, authentication and file storage (hosted in Australia, Sydney region).
• Vercel - hosting of our web application (United States and global edge network; our own server functions run in the Sydney region).
• Stripe - payment and subscription processing (United States and global).
• Resend - delivery of transactional email, including signing invitations and completed documents (United States).
• Microsoft Azure - reading scanned pages for Smart Fill (Document Intelligence, Australia, Sydney region).
• Anthropic - AI processing for the optional AI assistant and for Smart Fill (United States). This is separate from you connecting your own Claude.
• Sentry - error monitoring, so we can find and fix faults (United States). We switch off its collection of personal details, but a fault report can still carry technical details about the page or document it happened on.

We keep this list current. If our providers change, we will update this policy.

A service you connect, such as your own Claude, is not our service provider. It is described under "FirstAboard PDF".

Our broker onboarding platform uses some further providers. They are listed in its own policy, at app.firstaboard.com/privacy.

Sending information overseas

Some of our service providers store or process information outside Australia. In particular, hosting, payments, email, error monitoring and our AI features may involve recipients in the United States. Scanned-page reading for Smart Fill and our primary database storage take place in Australia (Sydney). Copies you send to a service you connect may be stored elsewhere.

Our own AI features (the AI assistant and Smart Fill) send your document, or its text and page images, to Anthropic as our service provider. Nothing is removed first, so what you send is what it receives. Anthropic does not use it to train its AI models.

Your own Claude is different. When you connect it, the documents and signing details it sees go to the company that runs your Claude under your agreement with that company, not ours, and may be stored and processed in the United States and other countries. See "FirstAboard PDF".

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles. We remain accountable for that information as required by the Privacy Act.

How we store and protect information

We take the security of personal information seriously and use measures appropriate to its sensitivity, including:

• encryption of data in transit (HTTPS/TLS), and encryption at rest provided by our hosting platforms;
• database access controls, so each customer can only reach their own documents and signing records;
• private, access-controlled file storage that is not publicly reachable;
• signing links that identify one recipient, expire, and can be cancelled by the sender;
• for a service you connect, such as Claude: you approve the connection, every request is checked so it reaches only your own documents, sending needs a preview and your confirmation, and you can disconnect at any time;
• rate limiting and monitoring to resist automated attacks;
• append-only audit logging of sensitive actions;
• restricting access to staff and providers who need it to operate the Services.

No method of transmission or storage is completely secure, but we work to protect personal information and to continually improve our safeguards.

Data breaches

We maintain a data-breach response process. If we become aware of a data breach that is likely to result in serious harm, we will assess it promptly and, where the Notifiable Data Breaches scheme requires, notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, including the steps you should take in response.

Where a breach affects information we hold on behalf of a customer, we will also notify that customer promptly so they can meet their own obligations.

How long we keep information

We keep personal information only for as long as we need it for the purposes described in this policy, or for as long as required by law.

Documents and signing records sent through Request signatures, Sign on your phone or Smart Fill are kept for as long as needed to provide the signing service and our records. You can ask us to delete them at any time by emailing support@firstaboard.com.

Smart Fill answers are handled differently: the answers your recipient types are deleted as separate records the moment the filled document is produced, so after that they exist only inside that document. We keep the completed document, the blank form and the questions we worked out from it.

Copies you have sent to a service you connect, such as your own Claude, are kept by that service under your agreement with it, not by us.

When information is no longer needed, we take reasonable steps to destroy it or to de-identify it.

Direct marketing and electronic messages

We may send you information about our Services. We only send marketing messages where we are permitted to, and every commercial electronic message we send will identify us and include a working unsubscribe option, in line with the Spam Act 2003 (Cth). You can opt out of marketing at any time by using the unsubscribe link or by contacting us, and we will action your request promptly.

Account, billing, security and other service messages are not marketing and may still be sent while you hold an account. An email a customer sends you through the Services, such as an invitation to sign a document, comes from that customer and is not our marketing.

Cookies and analytics

Our website and web application use cookies and similar technologies that are necessary to run the site, keep you signed in, and keep the Services secure. We do not use advertising trackers. You can control cookies through your browser settings, although some features may not work without them.

Accessing and correcting your information

You can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

If you were asked to sign a document, the document and the request belong to the customer who sent it. You can ask us or that customer, and we may work with them to answer you, but we will not refuse a request only because the document was sent by someone else. If a customer has sent your information to a service they connect, such as their own Claude, we do not hold that copy. Ask them, or the provider of that service, about it. You can still complain to us about how we sent it (see "Complaints"). We may need to verify your identity before acting on a request, and in limited cases the law allows us to decline, in which case we will explain why.

Children

The Services are intended for adults in business and are not directed at children. We do not knowingly collect personal information from anyone under 18 for our own purposes. If you believe we hold such information, please contact us and we will take appropriate steps.

Complaints

If you believe we have mishandled your personal information or breached the Australian Privacy Principles, please contact us using the details below. We will acknowledge your complaint and aim to resolve it within a reasonable time.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

Changes to this policy

We may update this policy from time to time. The current version is always available at firstaboard.com/privacy, with the "last updated" date shown at the top. Significant changes will be reflected on this page.

Contact us

For any privacy question or request, contact:

• First Aboard Pty Ltd (ABN 23 699 291 122)
• Email: support@firstaboard.com