Privacy Policy

1. About This Policy

Elderon Pty Ltd (ABN pending registration) (“Elderon”, “we”, “us”, “our”) is an Australian company that operates the Elderon R&D Tax platform (the “Platform”). The Platform is a workflow and document-management tool designed to assist qualified R&D tax consultants and accounting firms in preparing claims under the R&D Tax Incentive (Division 355 of the Income Tax Assessment Act 1997 (Cth)).

This privacy policy describes how we collect, hold, use, disclose and otherwise handle personal information in connection with the Platform. We are bound by the Privacy Act 1988 (Cth) (the “Privacy Act”) and the Australian Privacy Principles (“APPs”) contained in that Act.

In this policy, “Customer” means the organisation (typically an accounting or consulting firm) that has contracted with Elderon to use the Platform, and “Authorised User” means an individual granted access to the Platform by a Customer.

2. Information We Collect

The Platform is designed to hold primarily business data relating to R&D tax claims. The personal information we collect is limited to the information of Authorised Users and, incidentally, any personal information contained within Customer-uploaded business records.

2.1 Account Information

When an Authorised User account is created, we collect the user’s name, email address, role within the Platform, and the organisation they belong to. Single sign-on (SSO) is not currently offered; users sign in with an email address and password, with optional two-step sign-in.

2.2 R&D Claim Data

Customers and Authorised Users upload or enter business data for the purpose of preparing R&D tax claims. This may include project descriptions, AusIndustry scoping narratives, expense records, employee timesheets, financial figures, and supporting documentation. This data may incidentally contain personal information (for example, employee names appearing in timesheets or expense records).

2.3 Document Uploads

Files uploaded to the Platform (such as CSV files, supporting documents, and evidence packs) are stored in the Platform’s PostgreSQL database, held by Neon, encrypted in transit and at rest by the database provider.

2.4 Audit Log Metadata

Every data mutation within the Platform is logged. Audit log records include the Authorised User’s user ID, IP address, timestamp, action type, and a summary of the change made.

2.5 Authentication Metadata

We collect session tokens, login timestamps, and IP addresses for authentication and security purposes. Passwords are hashed using bcrypt and are never stored in plain text.

3. How We Use Information

We use personal information for the following purposes:

• Providing and operating the Platform, including generating AI-assisted assessments, document drafts, and expense categorisations.
• Authenticating Authorised Users and managing access to Customer accounts.
• Maintaining audit logs for security, compliance and accountability.
• Securing the Platform and detecting, preventing, and responding to security incidents.
• Complying with applicable laws and legal obligations, including the Privacy Act and taxation record-keeping requirements.

We do not use personal information for marketing purposes. We do not sell personal information. We do not use Customer Data or personal information to train artificial intelligence or machine learning models.

4. AI Processing Disclosure

The Platform includes AI-assisted features that process content submitted by Authorised Users. Content that may be sent to an AI provider includes: AusIndustry scoping field text, expense descriptions, timesheet descriptions, voice transcript text, text extracted from uploaded documents, and company URLs used for auto-fill features.

AI features are provided by Anthropic’s Claude API. Anthropic’s API endpoints are located in the United States. Under Anthropic’s commercial terms, content submitted through the API is not used to train its models.

When an AI feature is used, the structured claim data it needs and the text extracted from relevant uploaded documents are sent to the AI provider. User credentials, session tokens and audit log data are not sent. When web research is used to find published sources, short search queries drawn from the project description are run through Anthropic’s web search tool. Voice notes, where used, are first transcribed by the user’s web browser (in Google Chrome, Google processes the audio); if the browser cannot, they are transcribed by Fireworks AI in the United States.

AI output is advisory only and is reviewed by the registered tax agent before it is relied on.

4.1 Automated Decisions

The Platform does not make decisions about individuals. Computer programs, including AI models, are used to suggest how expenses are categorised, to draft and assess R&D activity descriptions, to match timesheet entries to projects and to calculate estimated tax offsets for companies. The personal information these programs may use is limited to names, roles, hours and pay rates of people recorded in timesheets and expense records. Every suggestion is shown with its source and is accepted, changed or rejected by a person before it is used, and no decision that significantly affects an individual’s rights or interests is made by a program alone.

5. Disclosure to Third Parties

We disclose personal information only to the sub-processors necessary to operate the Platform. Our current sub-processors are:

We may disclose personal information to law enforcement or regulatory authorities if we are compelled to do so by law, court order, or enforceable government request. Where we receive such a request, we will notify the affected Customer unless we are prohibited from doing so by law.

We do not otherwise disclose personal information to third parties.

6. Storage and Security

Application data is hosted as follows:

• The application runs on Vercel in the Sydney region.
• The database, uploaded files and nightly backups are held by Neon (PostgreSQL) in the United States (US East). A second, encrypted copy of each daily backup is held in Vercel Blob storage in Sydney.

Security measures include:

• Encryption at rest for the database and stored files, provided by the hosting providers.
• TLS 1.2 or higher enforced on all connections in transit, with HTTP Strict Transport Security (HSTS) enabled.
• Multi-tenancy isolation: every database record carries an organisation identifier, and server-side filtering ensures no cross-tenant data access.
• Comprehensive audit logging of all data mutations.
• Passwords hashed using bcrypt (cost factor 12).
• Session tokens are cryptographically random, stored server-side only as a hash, expire after a period of inactivity, and can be revoked.
• Login rate limiting per IP address and a 15-minute account lockout after 5 failed attempts. Optional multi-factor authentication.

Access to production systems and data is restricted to Platform staff (currently the founder). All access is logged.

7. Cross-Border Disclosure

Customer Data is disclosed outside Australia in the following ways: the database, uploaded files and backups are held by Neon in the United States; claim data and document text submitted to AI features are processed by Anthropic in the United States; and, where used, voice notes are transcribed by Fireworks AI and emails are sent through Resend, both in the United States.

We take reasonable steps under Australian Privacy Principle 8 to ensure these providers handle the information consistently with the Australian Privacy Principles. A Customer that needs its data held in Australia should contact us before uploading data.

8. Retention

Customer Data is retained for the duration of the active subscription term plus 30 days after termination to allow for data export. After this period, Customer Data is deleted unless the Customer requests extended retention for tax-substantiation purposes. Note that the Australian Taxation Office requires a minimum 5-year retention period for tax records; Customers should ensure they retain their own copies of records independently of the Platform.

Audit logs are retained for 7 years, aligned to ATO record-keeping requirements for tax claims.

Database backups are retained on a 30-day rolling basis.

9. Access, Correction and Complaints

Under Australian Privacy Principles 12 and 13, individuals have the right to request access to the personal information we hold about them and to request correction of any inaccurate, out-of-date, incomplete, irrelevant or misleading information.

To make an access or correction request, or to lodge a privacy complaint, please contact us at alan@arconiccap.com. We will respond to access requests within 30 days.

If you are not satisfied with our response to a complaint, you may escalate the matter to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10. Notifiable Data Breaches

In the event of an eligible data breach under the Notifiable Data Breaches (NDB) scheme (Part IIIC of the Privacy Act), we will:

• Take immediate steps to contain the breach and mitigate harm.
• Assess whether the breach is likely to result in serious harm to affected individuals.
• Notify the OAIC and affected individuals as soon as practicable if the breach is assessed as an eligible data breach, and in any case within 30 days of becoming aware of the breach.
• Notify affected Customers within 4 hours of confirming a Critical or High severity incident.

Our incident response procedures are documented in a detailed runbook. Customers may request a copy of this runbook upon request.

11. Children

The Platform is a business-to-business service designed for use by qualified professionals. It is not directed at individuals under 18 years of age, and we do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this privacy policy from time to time. Where we make material changes, we will notify Customer organisation administrators in writing at least 30 days before the changes take effect. The “Last updated” date at the top of this policy indicates when it was most recently revised.

13. Contact

If you have questions about this privacy policy, wish to make an access or correction request, or wish to lodge a complaint, please contact us:

Email: alan@arconiccap.com

Postal address: Sydney, NSW, Australia