Privacy Policy

This policy explains how Dividend Guardian handles personal information. We are responsible for that handling. We apply the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) where they apply to us.

• Account information: your email address and the identifiers needed to link your account to Supabase’s passwordless sign-in service. Dividend Guardian does not ask you to create a password.
• Free Dividend Guardian Check information: the tickers and approximate share counts you type into the free check, together with the result we compute from them. We store this so that you can unlock the full breakdown and return to it later. It is deleted automatically after 30 days. If you give us an email address to unlock the result, that address is stored with it.
• Monitored portfolio information: if you subscribe, the tickers and share counts we monitor for you. We do not ask for and do not store your purchase prices or cost base.
• Billing information: your subscription status and the Stripe customer and subscription identifiers needed to manage billing. Full card numbers are collected and stored by Stripe, never by us.
• Usage and technical data: pages viewed, features used, approximate location derived from IP address, browser and device type, and error diagnostics. This includes a first-party record of which steps of sign-up you reached: for example that a check was run, that a result was unlocked, or that a checkout was started. It records how many holdings were involved and which ticker was highlighted. It never records your share counts or your income figures. Vercel Web Analytics records anonymised page views on public marketing pages without cookies. Google Analytics records page views, referral source, approximate location, browser and device data on those public pages using first-party measurement cookies. If you accept analytics cookies, the Meta (Facebook) pixel records page views, which step of the funnel you reached, the market you selected, how many holdings were involved, and, if you subscribe, which plan you chose and its price. Saved checks, dashboards, authentication, unsubscribe, status and API routes are excluded. We do not send your email address, your holdings, your share counts or your income figures to any of these services, and the goal you type and the band your dividend income falls into are kept out of the Meta pixel entirely.
• Communications: support messages you send us, optional screenshots you attach to feedback, and delivery records for transactional email. Screenshots may contain whatever is visible when you capture them, so review an image before attaching it.

What we deliberately do not collect: we do not ask for and cannot access your broker credentials, bank accounts, tax file number, or identity documents. We do not collect sensitive information as defined in the Privacy Act.

We use personal information only for the following purposes:

• to compute your Dividend Guardian Check, assess dividend health, and calculate your estimated income and exposure;
• to send you a link back to the Dividend Guardian Check you asked for, and the alerts and summaries you subscribed to receive;
• if you separately opt in, to send occasional product updates and dividend-income education; this consent is optional and can be withdrawn;
• to understand how many people complete each step of sign-up, so we can tell whether the product is working;
• to take payment, issue receipts and manage your subscription;
• to keep the Service secure, diagnose faults and prevent abuse; and
• to comply with our legal and tax obligations.

We do not sell personal information, we do not trade it, and we do not use your portfolio data for advertising or for our own trading.

Your portfolio information is never sent to an AI provider. Income and payday estimates are ordinary arithmetic. Dividend-health status and ranking are produced by published application rules.

If an announcement source is connected, we may use an automated model to analyse public company announcement text. That optional company-level process extracts a quote-backed development which the published rules may include in a company’s status. It runs separately from your portfolio. We send the ticker and public text, not your email address, share counts or any information that identifies you. The result is stored against the company, not against you.

We disclose personal information only to the service providers we need to run the Service, and only for that purpose:

• Stripe: payment processing (United States, Australia).
• Vercel: application hosting and content delivery (United States, with edge locations worldwide).
• Google Analytics: website measurement and referral attribution (United States and other processing locations).
• Meta Platforms: advertising measurement and audiences, through the Meta pixel on public marketing pages. Events about you are sent only where you have accepted analytics cookies; the pixel’s script itself is fetched on every visit, so Meta sees that request either way (United States and other processing locations).
• Supabase: database storage and passwordless authentication (service region selected by us).
• OpenAI: optional analysis of public company announcement text, when that feature is connected (United States).
• Resend: transactional and alert email delivery (United States).
• Market data providers: for prices, dividends and corporate actions. We send them ticker symbols, never your identity.

Some of these providers are located overseas, principally in the United States. By using the Service you consent to that disclosure. We take reasonable steps to ensure overseas recipients handle your information consistently with the APPs, but you acknowledge that we may not be able to enforce Australian privacy law against them (APP 8.2).

We may also disclose information where required by law, a court order, or a regulator such as ASIC or the OAIC, or to a purchaser as part of a sale of the business, in which case this policy will continue to apply to that information.

We hold data in encrypted form in transit (TLS) and at rest. Access is limited to those who need it to operate the Service. No system is perfectly secure, and we cannot guarantee absolute security.

We keep your account and portfolio data while your account is active. If you close your account we delete or de-identify it within 90 days, except where we must keep records longer, for example billing records, which Australian tax law requires us to retain for five years.

If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

We use strictly necessary cookies to keep you signed in and to secure forms. These cannot be turned off without breaking the Service.

We use Vercel Web Analytics on public marketing pages to understand page views and referral sources. It uses anonymised, aggregated data and no cookies. We also use Google Analytics on public marketing pages for page measurement and referral attribution. Google Analytics uses first-party measurement cookies and receives page, browser, device and approximate location information. Saved checks, dashboards, authentication, unsubscribe, status and API routes are excluded. Google advertising signals and ad personalisation are disabled.

We also use the Meta (Facebook) pixel on those same public pages. Unlike the two services above, it is an advertising tool: once it is switched on it sets the _fbp cookie, sends Meta the page you are on and which step of the funnel you reached, and Meta may use that to show you our ads elsewhere and to build advertising audiences.

The pixel’s script is loaded for every visitor, but it starts switched off, using Meta’s own consent setting. Switched off it sends Meta no events about you at all. It is switched on only if you accept analytics cookies, and declining leaves it off. Being plain about the cost of that arrangement: because the file is fetched from Meta on every visit, Meta can see that request and the page it came from even if you never accept. We load it that way because a pixel that is absent until someone accepts cannot be verified as correctly installed by us or by Meta.

The same exclusions apply — saved checks, dashboards, authentication, unsubscribe, status and API routes are never sent to it. The purchase confirmation page is the one further place it runs, so that a completed subscription can be matched to the advertising that led to it.

Alongside these we store a small amount of information in your own browser, which never leaves your device except as described above: your answer to the cookie question, the article that sent you here, and, once you have accepted, how far through the funnel you have got, so that leaving for the payment page and coming back does not lose your place. The last two are cleared when you close the tab.

We do not send email addresses, holdings, share counts or income amounts to any analytics or advertising service. We also keep first-party funnel events in our own database without recording share counts or income amounts.

Under the Privacy Act and the APPs you may:

• Access the personal information we hold about you (APP 12);
• Correct anything inaccurate or out of date (APP 13);
• Delete your account and the data associated with it;
• Request a copy of your portfolio data; and
• Unsubscribe from non-essential email at any time via the link in any message.

To exercise any of these, email privacy@dividendguardian.com.au. We will respond within 30 days.

If you think we have mishandled your personal information, contact us first at privacy@dividendguardian.com.au or at Sydney NSW 2000, Australia. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

The Service is not directed at anyone under 18 and we do not knowingly collect their personal information. If you believe a minor has given us information, contact us and we will delete it.

We may update this policy. The effective date at the top of this page always reflects the current version, so it is worth checking back here from time to time.