Privacy Policy

Last updated: 20 August 2026

About this policy

First Aboard Pty Ltd (ACN 699 291 122, ABN 23 699 291 122) ("FirstAboard", "we", "us", "our") respects your privacy. This policy explains how we collect, use, hold, disclose and protect personal information, and how you can access or correct it or make a complaint.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Even where a small-business exemption might apply, we choose to comply with the APPs because we handle sensitive financial and identity information, and because the brokers we serve must comply and rely on us to do the same.

This policy covers our broker onboarding platform, our website, and the FirstAboard PDF desktop app (together, the "Services"). By using the Services, you agree to this policy.

The two roles we handle information in

We handle personal information in two different roles, and it matters which one applies:

On behalf of brokers. When a broker uses FirstAboard to collect information from their own clients, that client information is collected for and on behalf of the broker. The broker decides what is collected and why. We store and process it securely on their instructions. The broker is the first point of contact for that information, and the broker’s own privacy policy also applies to it.
For our own business. We also collect personal information directly, for example from brokers who create an account, people who contact us, visitors to our website, and customers of FirstAboard PDF.

Where this policy talks about information we hold "on behalf of a broker", requests to access, correct or delete that information should usually go to the broker first. We will assist the broker as needed.

The personal information we collect

Depending on how you interact with us, we may collect:

Broker account information: name, business name, email address, phone number, login and authentication details, and billing details.
Client onboarding information (collected on behalf of brokers): name, contact details, date of birth, residential history, employment details, financial details (income, assets, liabilities and expenses), identity documents (such as a driver licence or passport), uploaded documents and photos, and electronic signatures.
Website and enquiry information: contact details you choose to give us, such as an email address you submit to a waitlist or a support request.
Payment information: subscription and billing details, processed by our payment provider (we do not store full card numbers ourselves).
Technical information: IP address, device and browser type, and usage data collected through cookies and similar technologies, used to keep the Services secure and working.

FirstAboard PDF does its everyday work (viewing, editing, redaction and OCR) on your own computer, and those files are not uploaded to us. Some optional features (Request signatures, Sign on your phone and the AI assistant) do send your document or its contents to our servers. We explain what we collect and keep under "FirstAboard PDF" below.

Sensitive information and identity documents

Some of the information collected through the broker platform is "sensitive information" or government-related identifier information under the Privacy Act, including financial details and identity documents.

We collect this information only with consent and only as needed for the broker to provide their services. Identity documents may be processed using automated text recognition (OCR) through Microsoft Azure AI Document Intelligence to read the details on the document. This processing takes place in the Azure Sydney region (Australia).

Payslips uploaded during onboarding may also be read automatically so your broker can review your income figures. The text recognition step runs in the Azure Sydney region. The recognised text is then analysed by an Azure OpenAI model; before that step we remove tax file numbers, bank account details, street addresses and your name from the text. Microsoft may process that reduced text on Azure infrastructure outside Australia. Your broker reviews and remains responsible for all figures produced this way.

Your broker can also ask our system to help them draft their own file notes. If they use it, the notes your broker has written and a summary of your file (age, occupation, the loan you are seeking, your suburb and your financial totals) are sent to Anthropic, our AI provider, which drafts suggested wording using its Claude model. Names are removed before this is sent and put back afterwards, so the AI provider does not receive your name. This happens only when your broker chooses to use it - it never runs on its own. Anthropic processes the text as our service provider and does not use it to train its AI models. What comes back is a suggestion only: your broker reviews it, decides what to keep, and remains responsible for what is recorded in your file. We keep a record that the feature was used, but not the content sent or returned.

We do not adopt, use or disclose a government-related identifier (such as a licence or passport number) as our own identifier for you, except as permitted by the Privacy Act.

How we collect information

We collect personal information in these ways:

Directly from you, wherever practical: when a broker signs up, when a client completes an onboarding flow a broker has invited them to, or when you contact us.
From your use of the Services: technical and usage information collected automatically through cookies and similar technologies.
From third parties, where you have authorised it or where it is reasonably necessary, such as our payment provider confirming a payment.

At the point of collection through the onboarding flow, we provide a short collection notice telling you who we are, why the information is being collected, and that this policy applies.

Why we collect and use information

We use personal information to:

provide, operate and improve the Services;
let brokers collect information from, and serve, their clients;
verify identity where that is part of the broker’s onboarding flow;
process payments and manage subscriptions;
communicate with you, including by email and SMS, about your account, support requests and service updates;
keep the Services secure, prevent misuse, and maintain audit and access logs;
meet our legal and regulatory obligations.

We do not sell your personal information, and we do not use it for advertising or share it with advertising networks.

FirstAboard PDF

FirstAboard PDF is a desktop application. For everyday tasks such as opening, viewing, editing, redacting and OCR, your files are processed on your own computer and are not uploaded to us.

Three optional features are an exception, because they need our servers to work:

Request signatures (sending a document to other people to sign). When you use it, we upload and store the document, your recipients’ names and email addresses, and, as each person signs, their typed name, signature image, IP address and browser details, together with an audit trail of the signing. Once everyone has signed, the completed PDF is emailed to you and all signers.
Sign on your phone (signing on your mobile and sending it back to the app). Your drawn signature passes through our servers to get it from your phone to your computer.
AI assistant (the AI chat panel). When you send a message to the assistant, your message, the earlier messages in that conversation, and the text and file name of the document you have open are sent securely to our servers and passed to Anthropic, our AI provider, which generates the reply using its Claude model. The assistant can answer questions about your document and general questions. Nothing is sent unless you send a message, and nothing is sent automatically. We do not store your document text, your messages or the replies; we keep only usage metering (how much of your monthly AI allowance you have used). Anthropic processes the text as our service provider and does not use it to train its AI models. Only use the AI assistant with documents you are comfortable sharing that way.

Apart from these features, we do not see, collect or store the contents of the files you work on.

For your subscription, we handle account and billing information (for example your name, email and subscription status) through our payment provider, Stripe.

Anything you send through Request signatures or Sign on your phone is stored on our infrastructure (Supabase, in the Sydney region) in a private location that is not publicly reachable. We keep these documents and signing records for as long as needed to provide the signing service and our records, and you can ask us to delete them at any time by emailing support@firstaboard.com. Encryption at rest is provided by our hosting platform; the app itself does not add a separate layer of encryption to these files.

Open banking and the Consumer Data Right

The broker platform can include an optional open-banking step. In that step, the broker adds their own secure open-banking link (for example a Consumer Data Right (CDR) provider such as Frollo, or another provider they choose). The client authorises that provider directly.

FirstAboard does not collect, store, sync or have access to a client’s bank-account data obtained through the Consumer Data Right. We simply record that the client was asked to connect, and whether they confirmed that they did. The handling of any CDR data is governed by the chosen provider and the client’s consent with that provider.

When we disclose information, and to whom

We do not sell your personal information. We disclose it only:

to the broker the information was collected for;
to trusted service providers who help us run the Services, under arrangements requiring them to protect the information and use it only for our purposes;
where required or authorised by law, or to protect our legal rights.

The main service providers we use are:

Supabase - database, authentication and file storage (hosted in Australia, Sydney region).
Microsoft Azure - identity-document and payslip text recognition (Document Intelligence, Australia, Sydney region) and payslip income analysis (Azure OpenAI; text is de-identified first and may be processed outside Australia).
Vercel - hosting of our web application (United States and global edge network).
Stripe - payment and subscription processing (United States and global).
Resend - delivery of transactional email (United States).
Twilio - delivery of SMS messages (United States and global).
Anthropic - AI processing for the optional AI assistant and form-reading features in FirstAboard PDF, and for the optional note-drafting feature brokers can use in the onboarding platform (United States; names are removed before note-drafting text is sent).

We keep this list current. If our providers change, we will update this policy.

Sending information overseas

Some of our service providers store or process information outside Australia. In particular, hosting, payments, email, SMS and our optional AI features may involve recipients in the United States. Identity-document processing and our primary database storage take place in Australia (Sydney).

Both of our AI features that touch client information are de-identified before anything is sent:

Payslip income analysis (Azure OpenAI): tax file numbers, bank details, addresses and names are removed before analysis, and Microsoft may process that reduced text outside Australia.
Broker note drafting (Anthropic, United States): client names are replaced with placeholders before the text is sent and restored afterwards, so the provider does not receive the client’s name. It runs only when the broker chooses to use it.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles. We remain accountable for that information as required by the Privacy Act.

How we store and protect information

We take the security of personal information seriously and use measures appropriate to its sensitivity, including:

encryption of data in transit (HTTPS/TLS), and encryption at rest provided by our hosting platforms;
database access controls, including row-level security so each broker can only access their own clients’ information;
private, access-controlled file storage that is not publicly reachable;
passwordless sign-in for brokers using passkeys, with rate limiting and monitoring to resist automated attacks;
append-only audit logging of sensitive actions, which our staff can review across the platform to confirm the Services behaved as described. That review shows brokers, dates and actions; it does not show client names or any information from a client’s file;
restricting access to staff and providers who need it to operate the Services.

No method of transmission or storage is completely secure, but we work to protect personal information and to continually improve our safeguards.

Data breaches

We maintain a data-breach response process. If we become aware of a data breach that is likely to result in serious harm, we will assess it promptly and, where the Notifiable Data Breaches scheme requires, notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, including the steps you should take in response.

Where a breach affects information we hold on behalf of a broker, we will also notify the broker promptly so they can meet their own obligations.

How long we keep information

We keep personal information only for as long as we need it for the purposes described in this policy, or for as long as required by law. We retain information we hold on behalf of a broker in line with the broker’s account and instructions.

When information is no longer needed, we take reasonable steps to destroy it or to de-identify it.

Records of deletion. When a broker deletes a client’s file from FirstAboard, we keep a permanent record that the deletion happened. That record holds the client’s name as it stood at the time, the broker who deleted it, the date, whether the broker confirmed they held their own copy of the record, and how many files were removed. It does not hold the client’s contact details, identity documents, financial information or answers - those are destroyed with the file.

We keep it for two reasons. Brokers are credit licensees with their own legal duty to retain client records, so this is their evidence that a file was destroyed deliberately rather than lost. And it is our evidence that we warned them before it happened. The record cannot be edited or deleted through the Services, including by our own staff. If you would like to know whether such a record exists about you, email support@firstaboard.com.

Direct marketing and electronic messages

We may send you information about our Services. We only send marketing messages where we are permitted to, and every commercial electronic message we send will identify us and include a working unsubscribe option, in line with the Spam Act 2003 (Cth). You can opt out of marketing at any time by using the unsubscribe link or by contacting us, and we will action your request promptly.

Account, billing, security and other service messages are not marketing and may still be sent while you hold an account.

Cookies and analytics

Our website and web application use cookies and similar technologies that are necessary to run the site, keep you signed in, and keep the Services secure. We do not use advertising trackers. You can control cookies through your browser settings, although some features may not work without them.

Accessing and correcting your information

You can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

For client onboarding information we hold on behalf of a broker, please contact that broker first, as they control that information; we will assist them as needed. For other requests, contact us using the details below. We may need to verify your identity before acting on a request, and in limited cases the law allows us to decline, in which case we will explain why.

Children

The Services are intended for brokers and their adult clients and are not directed at children. We do not knowingly collect personal information from anyone under 18 for our own purposes. If you believe we hold such information, please contact us and we will take appropriate steps.

Complaints

If you believe we have mishandled your personal information or breached the Australian Privacy Principles, please contact us using the details below. We will acknowledge your complaint and aim to resolve it within a reasonable time.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

Changes to this policy

We may update this policy from time to time. The current version is always available at firstaboard.com/privacy, with the "last updated" date shown at the top. Significant changes will be reflected on this page.

Contact us

For any privacy question or request, contact:

First Aboard Pty Ltd (ABN 23 699 291 122)
Email: support@firstaboard.com