Privacy Policy

1. Who we are and what this policy covers

FolioRow ("we", "us", "our") is a financial scenario modelling tool (the "Service") operated from Australia. This policy explains what personal information we collect when you use the Service, why we collect it, how we store and protect it, and the choices you have.

The Service provides general information and illustrative projections only. It is not financial, tax or legal advice. You can run the calculator without creating an account. We collect the personal information described below only if you create an account or save a scenario.

2. Information we collect

We collect three kinds of information.

Account and profile information you give us

• Email address
• First name and last name
• Country or region

Scenario data you choose to save

When you save a project, we store the scenario you built: its title, notes, calculation period, scenario items (such as income, expense and bank account items) and the figures, rates, tax brackets and assumptions you entered. Scenarios may reveal details about your finances, so please enter only what you are comfortable storing. You do not need to use real figures or real names to use the tool.

Technical information

Our service providers may automatically log technical data such as your IP address, browser and device type, and the time of your requests, for security and reliability.

We do not ask for bank account numbers, card details, tax file or other government identification numbers, passwords for financial services, or account logins for other financial institutions. Please do not enter them in free-text fields.

3. How we use your information

We use your information only to run and improve the Service:

• Create and secure your account, and let you sign in
• Save, load and display the scenarios you create
• Contact you about your account, service changes, security issues or support requests you send us
• Understand which regional rules or settings may be relevant to you, based on your country or region
• Keep the service secure, prevent misuse and fix errors
• Meet our legal obligations and handle legal claims

We do not sell your personal information. We do not use your saved scenarios for advertising, and we do not provide financial, tax or investment advice based on them.

4. Legal bases for processing

Some privacy laws, including the EU and UK General Data Protection Regulation (GDPR), require us to state our legal basis for using your personal information. Where those laws apply, we rely on:

• Contract: to provide the account and saved-scenario features you ask for.
• Legitimate interests: to keep the service secure, prevent misuse and improve it, where these interests are not outweighed by your rights.
• Legal obligation: where we must keep or disclose information by law.
• Consent: where we ask for it, for example for optional marketing emails. You can withdraw consent at any time without affecting earlier processing.

Where Australian privacy law applies, we collect personal information that is reasonably necessary for the functions described in this policy, and we tell you about it when we collect it.

5. Where your information is stored

The Service runs on Google Firebase, a cloud platform provided by Google. Your profile and saved scenarios are stored in Cloud Firestore, a database hosted by Google, in the USA. Sign-in is handled by Firebase Authentication, which stores your email address and sign-in credentials. The app itself is served through Firebase Hosting.

Google acts as a service provider that processes information on our behalf. Google handles this information under its own terms and privacy commitments, which you can read on Google's and Firebase's websites.

We do not run our own servers that store your information outside these services.

6. Sharing and disclosure

We share personal information only in these situations:

• Service providers: companies that host, secure or support the Service on our behalf, including Google (see section 5), and any others we list there.
• Legal reasons: where required by law, court order or a regulator, or to protect our rights, users or the public from fraud, abuse or security threats.
• Business changes: if the Service is sold, merged or transferred, your information may move to the new owner, who must handle it under terms no less protective than this policy.
• With your consent: for any other purpose, only after we ask you.

We do not sell your personal information, and we do not share it with advertisers or data brokers. Your saved scenarios are private to your account.

7. International data transfers

The Service is operated from Australia and used worldwide. Your information is stored in the Google data centre location named in section 5, and may be processed or accessed in other countries where Google or its sub-processors operate. Those countries may have different privacy laws from your own.

Where the law requires safeguards for transfers out of your country (for example from the EU or UK), we rely on the mechanisms our providers offer, such as standard contractual clauses or an applicable adequacy decision. If you are in Australia, we take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles. Contact us if you would like more detail.

8. Retention and deletion

We keep your profile and saved scenarios for as long as your account is open. You can delete individual saved projects in the app and you can ask us to delete your account at any time using the contact form on our contact page.

When you ask us to delete your account, we will delete your profile and saved scenarios within 30 days, except where we must keep certain information to meet legal obligations or resolve disputes. Backups and logs held by our providers are overwritten on their normal cycles. We may delete accounts that have been inactive for 12 months.

9. Security

We protect your information using the security features of Google Firebase, including encrypted connections (HTTPS) and database access rules that restrict each account to its own data. We limit who can access the database and keep our software up to date.

No online service is completely secure, and we cannot guarantee the security of information you send or store. Please use a strong, unique password and keep it private. If we become aware of a data breach likely to harm you, we will notify you and the relevant regulators as the law requires.

10. Your rights and choices

Wherever you live, you can ask us to access, correct or delete the personal information we hold about you. Submit a request through the contact form in the menu, using the email address on your account so we can verify it is you. We may need to verify your identity first, and we aim to respond within 30 days.

Australia. Under the Privacy Act 1988 and the Australian Privacy Principles, you can ask for access to and correction of your personal information. If you are unhappy with how we handle a complaint, you can contact the Office of the Australian Information Commissioner (OAIC).

European Economic Area and United Kingdom. Where the GDPR applies, you also have the right to restrict or object to certain processing, to receive your information in a portable format, and to withdraw consent. You can complain to your local data protection authority (in the UK, the Information Commissioner's Office).

California and other US states. Depending on where you live, you may have rights to know what we collect, and to request deletion or correction. We do not sell or share personal information for cross-context behavioural advertising, and we will not discriminate against you for exercising your rights.

Elsewhere. If your local law gives you other privacy rights, we will honour them where they apply to us.

11. Cookies and local storage

The Service uses cookies or similar browser storage only where needed to keep you signed in and to remember basic settings, such as your acknowledgement of our disclaimer. Our providers may also use them for security and to keep the service working.

You can clear or block cookies and local storage in your browser settings, though parts of the Service may then stop working.

12. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new effective date, and if the changes are significant, we will notify you by email or in the app before they take effect.

13. Contact and complaints

For questions, requests or complaints about privacy, please use our contact form on our contact page.

We will acknowledge your complaint promptly and aim to resolve it within 30 days. If you are not satisfied, you may contact the privacy regulator in your country (see section 10).