Privacy Policy

About this policy

First Aboard Pty Ltd (ACN 699 291 122, ABN 23 699 291 122) ("FirstAboard", "we", "us", "our") respects your privacy. This policy explains how we collect, use, hold, disclose and protect personal information, and how you can access or correct it or make a complaint.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Even where a small-business exemption might apply, we choose to comply with the APPs because we handle sensitive financial and identity information, and because the brokers we serve must comply and rely on us to do the same.

This policy covers our broker onboarding platform, our website, and the FirstAboard PDF desktop app (together, the "Services"). By using the Services, you agree to this policy.

The two roles we handle information in

We handle personal information in two different roles, and it matters which one applies:

• On behalf of brokers. When a broker uses FirstAboard to collect information from their own clients, that client information is collected for and on behalf of the broker. The broker decides what is collected and why. We store and process it securely on their instructions. If the broker connects an outside service, such as their own AI assistant or their client management software (CRM), we send client information to that service on the broker’s instruction (see "Claude and other services a broker connects"). The broker is the first point of contact for that information, and the broker’s own privacy policy also applies to it.
• For our own business. We also collect personal information directly, for example from brokers who create an account, people who contact us, visitors to our website, and customers of FirstAboard PDF.

Where this policy talks about information we hold "on behalf of a broker", requests to access, correct or delete that information can go to the broker or to us. The broker usually knows the file best, so we may work with them to respond.

The personal information we collect

Depending on how you interact with us, we may collect:

• Broker account information: name, business name, email address, phone number, login and authentication details, billing details, approvals for apps you connect, and a record of what is done through those connections.
• Client onboarding information (collected on behalf of brokers): name, contact details, date of birth, place and country of birth, citizenship status, residential history, employment details, financial details (income, assets, liabilities, expenses, bank account details and bank statements), dependants’ details, identity documents (such as a driver licence, passport, Medicare card or birth certificate) and the identity numbers on them, answers about needs, objectives and risks (which can include health information, such as planned medical treatment), uploaded documents and photos, and electronic signatures.
• Website and enquiry information: contact details you choose to give us, such as an email address you submit to a waitlist or a support request.
• Payment information: subscription and billing details, processed by our payment provider (we do not store full card numbers ourselves).
• Technical information: IP address, device and browser type, and usage data collected through cookies and similar technologies, used to keep the Services secure and working.

FirstAboard PDF does its everyday work (viewing, editing, redaction and OCR) on your own computer, and those files are not uploaded to us. Some optional features (Request signatures, Sign on your phone and the AI assistant) do send your document or its contents to our servers. We explain what we collect and keep under "FirstAboard PDF" below.

Sensitive information and identity documents

Some client information collected through the broker platform needs particular care. Identity documents carry government-related identifiers (numbers issued by government), such as driver licence, Australian passport, Medicare and birth certificate numbers. Some answers, such as planned medical treatment that may affect a loan, can be health information, which is "sensitive information" under the Privacy Act. Financial details, including bank account details, are not "sensitive information" as the Privacy Act defines it, but they can cause serious harm if misused.

We collect this information only with consent and only as needed for the broker to provide their services. Identity documents may be processed using automated text recognition (OCR) through Microsoft Azure AI Document Intelligence to read the details on the document. This processing takes place in the Azure Sydney region (Australia).

Payslips uploaded during onboarding may also be read automatically so your broker can review your income figures. The text recognition step runs in the Azure Sydney region. The recognised text is then analysed by an Azure OpenAI model; before that step we remove tax file numbers, bank account details, street addresses and your name from the text. Microsoft may process that reduced text on Azure infrastructure outside Australia. Your broker reviews and remains responsible for all figures produced this way.

Your broker can also ask our system to help them draft their own file notes. If they use it, the notes your broker has written and a summary of your file (age, occupation, the loan you are seeking, your suburb and your financial totals) are sent to an Azure OpenAI model (Microsoft), our AI provider for this feature, which drafts suggested wording. Names are removed before this is sent and put back afterwards, so the AI provider does not receive your name. Microsoft may process that de-identified text on Azure infrastructure outside Australia; it is stored in Australia. This happens only when your broker chooses to use it - it never runs on its own. Microsoft processes the text as our service provider and does not use it to train its AI models. What comes back is a suggestion only: your broker reviews it, decides what to keep, and remains responsible for what is recorded in your file. We keep a record that the feature was used, but not the content sent or returned.

The payslip reading and note drafting features above are our own AI features. Before text is sent to the Azure OpenAI model, we take steps to remove the client’s name and some other details, as described above. Claude, an AI assistant a broker can choose to connect, works differently: it receives client information with names and other details left in. See "Claude and other services a broker connects".

We do not adopt, use or disclose a government-related identifier (such as a licence or passport number) as our own identifier for you, except as permitted by the Privacy Act.

How we collect information

We collect personal information in these ways:

• Directly from you, wherever practical: when a broker signs up, when a client completes an onboarding flow a broker has invited them to, or when you contact us.
• From your use of the Services: technical and usage information collected automatically through cookies and similar technologies.
• From third parties, where you have authorised it or where it is reasonably necessary, such as our payment provider confirming a payment.

Before a client starts the onboarding flow, they are asked to read and sign their broker’s Credit Guide and Privacy Disclosure. The same screen shows a short notice from us that names FirstAboard and links to this policy.

Why we collect and use information

We use personal information to:

• provide, operate and improve the Services;
• let brokers collect information from, and serve, their clients;
• verify identity where that is part of the broker’s onboarding flow;
• act on a broker’s instructions given through a service they connect, such as their own Claude;
• process payments and manage subscriptions;
• communicate with you, including by email and SMS, about your account, support requests and service updates;
• keep the Services secure, prevent misuse, and maintain audit and access logs;
• meet our legal and regulatory obligations.

We do not sell your personal information, and we do not use it for advertising or share it with advertising networks.

FirstAboard PDF

FirstAboard PDF is a desktop application. For everyday tasks such as opening, viewing, editing, redacting and OCR, your files are processed on your own computer and are not uploaded to us.

Three optional features are an exception, because they need our servers to work:

• Request signatures (sending a document to other people to sign). When you use it, we upload and store the document, your recipients’ names and email addresses, and, as each person signs, their typed name, signature image, IP address and browser details, together with an audit trail of the signing. Once everyone has signed, the completed PDF is emailed to you and all signers.
• Sign on your phone (signing on your mobile and sending it back to the app). Your drawn signature passes through our servers to get it from your phone to your computer.
• AI assistant (the AI chat panel). When you send a message to the assistant, your message, the earlier messages in that conversation, and the text and file name of the document you have open are sent securely to our servers and passed to Anthropic, our AI provider, which generates the reply using its Claude model. The assistant can answer questions about your document and general questions. Nothing is sent unless you send a message, and nothing is sent automatically. We do not store your document text, your messages or the replies; we keep only usage metering (how much of your monthly AI allowance you have used). Anthropic processes the text as our service provider and does not use it to train its AI models. Only use the AI assistant with documents you are comfortable sharing that way.

Apart from these features, we do not see, collect or store the contents of the files you work on.

For your subscription, we handle account and billing information (for example your name, email and subscription status) through our payment provider, Stripe.

Anything you send through Request signatures or Sign on your phone is stored on our infrastructure (Supabase, in the Sydney region) in a private location that is not publicly reachable. We keep these documents and signing records for as long as needed to provide the signing service and our records, and you can ask us to delete them at any time by emailing support@firstaboard.com. Encryption at rest is provided by our hosting platform; the app itself does not add a separate layer of encryption to these files.

Open banking and the Consumer Data Right

The broker platform can include an optional open-banking step. In that step, the broker adds their own secure open-banking link (for example a Consumer Data Right (CDR) provider such as Frollo, or another provider they choose). The client authorises that provider directly.

FirstAboard does not collect, store, sync or have access to a client’s bank-account data obtained through the Consumer Data Right. We simply record that the client was asked to connect, and whether they confirmed that they did. The handling of any CDR data is governed by the chosen provider and the client’s consent with that provider.

Claude and other services a broker connects

A broker can connect some outside services to their FirstAboard broker account. When they do, we send information to that service when the broker uses it. The broker chooses these services, and they work under the broker’s own agreement with the provider. They are not our service providers.

Claude, an AI assistant made by Anthropic. A broker can connect their own Claude to FirstAboard. To do this, the broker signs in to FirstAboard and approves the connection and the permissions it asks for. FirstAboard staff admin accounts cannot connect. If the broker approves it, the same kind of connection can also be used by an app on the broker’s own computer, such as Claude Code.

Depending on the permissions the broker approves, the broker can use Claude with this connection to:

• see the broker’s own account details and settings, such as the broker’s and their licensee’s names and contact details, email wording and business settings;
• see client files and documents, including identity documents (such as a driver licence, passport, Medicare card or birth certificate), the identity numbers on them, bank account details, bank statements, payslips, employment, income, assets, liabilities, expenses, dependants’ details, answers about needs, objectives and risks (which can include health information), the broker’s notes, the history of changes, e-sign records (including signers’ IP addresses and device details), and the broker’s activity log, which includes the names of clients the broker has deleted;
• change client files (including removing details, or archiving a client, which stops their links working) and the broker’s settings;
• send invitations (including to a second applicant), new links, reminders and document requests to clients;
• send a client’s file to the broker’s Salestrekker account, or link a client to the broker’s Quickli account.

Before Claude sends a message to a client, or a client’s file to Salestrekker, it must first get a preview from us and then make a separate request to go ahead. Claude normally asks the broker before that second step, but the broker’s Claude settings can switch that off. The broker is responsible for checking each one.

Anything Claude sees through the connection is sent to the company that runs the broker’s Claude. That is usually Anthropic. It can be a cloud provider, such as Amazon Web Services or Google Cloud, if the broker has set Claude up that way. Names are not removed first, so it includes the details listed above. It may be stored and processed in the United States and other countries.

How long it is kept, and whether it may be used to improve AI models, depends on the broker’s agreement with that company, the broker’s Claude settings and the company’s own policies. For example, Anthropic may keep a chat longer, or use it for training, if the chat is flagged for a safety review or the broker sends feedback on it. If the broker uses a Claude work plan, their organisation may control these settings. We do not control or see any of them. This is different from the AI assistant in FirstAboard PDF, where Anthropic works as our service provider.

Claude can make mistakes. The broker is responsible for checking anything Claude produces or changes, and for any advice or decision about a client.

We keep a record of what is done through the connection: which tool was used, which client file or document it involved, when, and whether it worked. The record does not include the information Claude read, so it does not show what Claude saw. It is kept after a client file is deleted. For messages and some other changes Claude makes, we also keep the preview (for a message, who it went to and what it said) for about 7 days.

A broker can disconnect Claude at any time, and access stops from then on. Disconnecting, or deleting a client from FirstAboard, does not remove information Claude has already received. That information may stay in the broker’s Claude chats (or their organisation’s), on the broker’s own computer for some Claude apps, and with the company that runs their Claude. We cannot reach or delete it. Ask your broker, or that company, about it. You can still complain to us about how we sent it (see "Complaints").

Salestrekker and Quickli. A broker can link their own Salestrekker or Quickli account. When the broker sends a client’s file to Salestrekker, we send that client’s information to Salestrekker, which then handles it under the broker’s agreement with Salestrekker. Quickli is a tool brokers use to work out borrowing power. Linking it checks the broker’s Quickli login and notes which Quickli calculation belongs to the client. It does not send the client’s answers or documents to Quickli.

When we disclose information, and to whom

We do not sell your personal information. We disclose it only:

• to the broker the information was collected for;
• to a service the broker has chosen to connect, such as the broker’s own Claude (usually Anthropic) or client management software (Salestrekker), when the broker uses it;
• to trusted service providers who help us run the Services, under arrangements requiring them to protect the information and use it only for our purposes;
• where required or authorised by law, or to protect our legal rights.

The main service providers we use are:

• Supabase - database, authentication and file storage (hosted in Australia, Sydney region).
• Microsoft Azure - identity-document and payslip text recognition (Document Intelligence, Australia, Sydney region), payslip income analysis and broker note drafting (Azure OpenAI; text is de-identified first, may be processed outside Australia and is stored in Australia).
• Vercel - hosting of our web application (United States and global edge network).
• Stripe - payment and subscription processing (United States and global).
• Resend - delivery of transactional email (United States).
• Twilio - delivery of SMS messages (United States and global).
• Anthropic - AI processing for the optional AI assistant and form-reading features in FirstAboard PDF (United States). This is separate from a broker connecting their own Claude.

We keep this list current. If our providers change, we will update this policy.

Services a broker connects, such as Claude, Salestrekker and Quickli, are not our service providers. They are described under "Claude and other services a broker connects".

Sending information overseas

Some of our service providers store or process information outside Australia. In particular, hosting, payments, email, SMS and our optional AI features may involve recipients in the United States. Identity-document text recognition and our primary database storage take place in Australia (Sydney). Copies a broker sends to a service they connect may be stored elsewhere.

Both of our own AI features that touch client information take steps to remove the client’s name and some other details before text is sent to the AI model:

• Payslip income analysis (Azure OpenAI): tax file numbers, bank details, addresses and names are removed before analysis, and Microsoft may process that reduced text outside Australia.
• Broker note drafting (Azure OpenAI): client names are replaced with placeholders before the text is sent and restored afterwards, so the provider does not receive the client’s name. Microsoft may process that de-identified text outside Australia. It runs only when the broker chooses to use it.

Claude on the broker platform is different. When a broker uses their own Claude with FirstAboard, the client information Claude sees is sent with names left in, including identity documents, identity numbers and bank account details. It may be stored and processed in the United States and other countries, by Anthropic or by the cloud provider the broker’s Claude uses. See "Claude and other services a broker connects".

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles. We remain accountable for that information as required by the Privacy Act.

How we store and protect information

We take the security of personal information seriously and use measures appropriate to its sensitivity, including:

• encryption of data in transit (HTTPS/TLS), and encryption at rest provided by our hosting platforms;
• database access controls, including row-level security so each broker can only access their own clients’ information;
• private, access-controlled file storage that is not publicly reachable;
• passwordless sign-in for brokers using passkeys, with rate limiting and monitoring to resist automated attacks;
• for services a broker connects, such as Claude: the broker must sign in and approve the connection, FirstAboard staff admin accounts cannot connect, every request is checked so it reaches only that broker’s clients, and the broker can disconnect at any time;
• append-only audit logging of sensitive actions, which our staff can review across the platform to confirm the Services behaved as described. That review shows brokers, dates and actions; it does not show client names or any information from a client’s file;
• restricting access to staff and providers who need it to operate the Services.

No method of transmission or storage is completely secure, but we work to protect personal information and to continually improve our safeguards.

Data breaches

We maintain a data-breach response process. If we become aware of a data breach that is likely to result in serious harm, we will assess it promptly and, where the Notifiable Data Breaches scheme requires, notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, including the steps you should take in response.

Where a breach affects information we hold on behalf of a broker, we will also notify the broker promptly so they can meet their own obligations.

How long we keep information

We keep personal information only for as long as we need it for the purposes described in this policy, or for as long as required by law. We retain information we hold on behalf of a broker in line with the broker’s account and instructions. Copies a broker has sent to a service they connect, such as their client management software or their own Claude, are kept by that service under the broker’s agreement with it, not by us.

When information is no longer needed, we take reasonable steps to destroy it or to de-identify it.

Records of deletion. When a broker deletes a client’s file from FirstAboard, we keep a permanent record that the deletion happened. That record holds the client’s name as it stood at the time, the broker who deleted it, the date, whether the broker confirmed they held their own copy of the record, and how many files were removed. It does not hold the client’s contact details, identity documents, financial information or answers. Those are removed from FirstAboard with the file, and copies in our backups are removed as those backups expire, within 90 days. Deleting a file does not remove copies the broker has already sent to a service they connect, such as their client management software or their own Claude, or our record of what was done through a connection.

We keep it for two reasons. Brokers are credit licensees with their own legal duty to retain client records, so this is their evidence that a file was destroyed deliberately rather than lost. And it is our evidence that we warned them before it happened. The record cannot be edited or deleted through the Services, including by our own staff. If you would like to know whether such a record exists about you, email support@firstaboard.com.

Direct marketing and electronic messages

We may send you information about our Services. We only send marketing messages where we are permitted to, and every commercial electronic message we send will identify us and include a working unsubscribe option, in line with the Spam Act 2003 (Cth). You can opt out of marketing at any time by using the unsubscribe link or by contacting us, and we will action your request promptly.

Account, billing, security and other service messages are not marketing and may still be sent while you hold an account.

Cookies and analytics

Our website and web application use cookies and similar technologies that are necessary to run the site, keep you signed in, and keep the Services secure. We do not use advertising trackers. You can control cookies through your browser settings, although some features may not work without them.

Accessing and correcting your information

You can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

You can ask us or your broker for the client onboarding information we hold about you. Your broker usually knows your file best, so we may work with them to answer you, but we will not refuse a request only because the information was collected for your broker. If your broker has sent your information to a service they connect, such as their client management software or their own Claude, we do not hold that copy. Ask your broker, or the provider of that service, about it. You can still complain to us about how we sent it (see "Complaints"). For other requests, contact us using the details below. We may need to verify your identity before acting on a request, and in limited cases the law allows us to decline, in which case we will explain why.

Children

The Services are intended for brokers and their adult clients and are not directed at children. We do not knowingly collect personal information from anyone under 18 for our own purposes. If you believe we hold such information, please contact us and we will take appropriate steps.

Complaints

If you believe we have mishandled your personal information or breached the Australian Privacy Principles, please contact us using the details below. We will acknowledge your complaint and aim to resolve it within a reasonable time.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

Changes to this policy

We may update this policy from time to time. The current version is always available at firstaboard.com/privacy, with the "last updated" date shown at the top. Significant changes will be reflected on this page.

Contact us

For any privacy question or request, contact:

• First Aboard Pty Ltd (ABN 23 699 291 122)
• Email: support@firstaboard.com