This policy explains how Worthbase handles personal information, in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
Who we are
Worthbase is operated by Arigato Consulting Pty Ltd (ACN 657 703 065), New South Wales, Australia (“we”, “us”).
What we collect
- Account details: your name, email address and sign-in information, handled by our sign-in provider, Clerk. We refresh your name and verified email from Clerk so emails reach your current address.
- Financial records you add: the people and entities in your workspaces, your assets and liabilities, transactions, valuations, goals, property addresses, tax settings, and the names of the files you import. We don't keep the files themselves.
- Billing details: your plan, subscription status and billing history. Card details are collected and held by Stripe, not by us.
- Connected apps: which AI apps you've connected and when, so we can alert you to a new one.
- Technical information: request logs such as IP address, time and the app you connected with, used for security and troubleshooting.
- How you use Worthbase: see Analytics.
How we use it
To provide the service: keeping your records, calculating figures, answering your AI app's requests, managing your subscription, keeping the service secure, contacting you about your account and understanding how people use Worthbase so we can improve it. We don't sell your information, and we don't use your financial records for advertising or to train AI models.
Analytics
We use PostHog (servers in the United States) to understand how people use Worthbase so we can improve it. It records how you use our website and account pages (pages visited, clicks and session recordings) and which features your AI app uses, linked to your account when you're signed in. We don't record your financial information or the content you add. Visitors in the EU, UK and Switzerland are only counted anonymously, and nothing is recorded if your browser sends Global Privacy Control or Do Not Track.
Emails we send
- Welcome: once, when your subscription starts, with setup tips.
- Weekly digest: on by default, once a week at 8am your time (Monday unless you choose another day). It includes your net worth and biggest changes. You can hide dollar amounts or turn it off in your email settings, and every digest has an unsubscribe link.
- Alerts: security alerts (a new AI app connected, someone joined your workspace) and billing alerts (trial ending, payment failed). You can turn billing alerts off; security alerts can only be turned off in settings. An optional alert for large daily net worth moves is off unless you turn it on.
- From Stripe: payment receipts and refund confirmations.
Who we share it with
- Service providers that run Worthbase for us: Cloudflare (hosting, storage and inbound email), Clerk (sign-in), Stripe (payments), Resend (sending email) and PostHog (product analytics). They only use it to provide their service to us.
- AI apps you connect. When you ask a connected app (such as Claude or ChatGPT) about your finances, we send it the information it requests. That provider handles it under its own privacy policy and your settings with them.
- Price providers. To price your holdings we request prices for ticker symbols (for example “CBA.AX”) and exchange rates. These requests don't include any personal information.
- People you invite to a workspace can see that workspace's records, according to the role you give them.
- Anyone else only where the law requires it.
Overseas disclosure
Your workspace data is stored in Cloudflare's Oceania region where possible, but our service providers may store or process information outside Australia, including in the United States and Japan. We choose providers with strong security practices and contractual protections.
Cookies
We use only the cookies needed to keep you signed in (set by Clerk). We don't use advertising cookies. Analytics keeps a random visitor id in your browser's local storage.
Security
Data is encrypted in transit and at rest, each workspace is stored separately, and access is checked on every request. See our security page for more. If a data breach is likely to cause you serious harm, we'll notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
Keeping and deleting
We keep your records while your account is open, so your history stays complete. If you ask us to delete your account, we delete your workspaces and personal information within 30 days, except what we must keep by law (such as billing records, which Stripe also keeps). Backups are kept for up to 30 days, so deleted data leaves our backups within that time.
Your rights
You can access and export your records at any time from your account page, and ask us to correct or delete your personal information. If you're unhappy with how we've handled a privacy matter, contact us first and we'll respond within 30 days. You can also complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Contact
Email privacy@worthbase.app.
