Privacy Policy

Navexa Services Pty Ltd (ACN 639 386 539 / ABN 47 639 386 539), an Australian company ("us", "we", or "our"), operates the Navexa platform, including our website at www.navexa.com, our iOS and Android applications, and our application programming interfaces (the "Service").

This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data.

We use your data to provide and improve the Service. By using the Service, you agree to the collection and use of information in accordance with this policy. Unless otherwise defined in this Privacy Policy, terms used have the same meanings as in our Terms and Conditions.

Information Collection and Use

We collect several different types of information for various purposes to provide and improve our Service to you.

Types of Data Collected

Personal Data

While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you ("Personal Data"). Personally identifiable information may include, but is not limited to:

• Email address
• Cookies, Usage Data and Device Data

Aggregated (or De-identified) Data

"Aggregated Data" means information we have combined or anonymised so that it cannot reasonably be used to identify you or any other individual. Examples include: average brokerage fees paid across all users, total portfolio value managed on Navexa, or statistical breakdowns by broker or asset class. Aggregated Data is not Personal Data for the purposes of this Privacy Policy.

Usage Data

We may also collect information on how the Service is accessed and used ("Usage Data"). On our website, this may include your Internet Protocol address (e.g. IP address), browser type and version, the pages you visit, and the time and date and duration of your visit. In our mobile applications, it may include the screens you open, the actions you take, and the time and date and duration of your session.

Device Data

When you use our mobile applications we also collect information about the device you use ("Device Data"). This may include the device model, operating system and version, application version, language and region settings, and a device identifier. We collect crash reports and diagnostic data so we can find and fix faults.

If you turn on push notifications, we collect a push notification token issued by Apple or Google for your installation of the app. We use it only to send you the notifications you have enabled. You can turn notifications off at any time in your device settings, and uninstalling the app ends collection entirely.

Tracking, Cookies and App Storage

On our website we use cookies and similar tracking technologies to hold certain information and to understand how the site is used. Cookies are files with a small amount of data which may include an anonymous unique identifier. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our website.

Examples of Cookies we use:

• Session Cookies. We use Session Cookies to operate our Service.
• Preference Cookies. We use Preference Cookies to remember your preferences and various settings.
• Security Cookies. We use Security Cookies for security purposes.
• Analytics, Advertising and Marketing Cookies. These help us understand how the Service is used, measure how our advertising performs, and link a newsletter sign-up to the visits that led to it. The providers involved are named on our sub-processors page.

Our mobile applications do not use cookies. They store information on your device and use the Device Data described above for the same purposes. Browser cookie settings do not apply to them. You control what the apps collect through your device settings — including notification permissions and, on iOS, app tracking permission — and by uninstalling the app.

Our application programming interfaces, including our Model Context Protocol server, use neither cookies nor device storage. Requests are authenticated with credentials you issue, and we log them to operate and secure the Service.

Use of Data

Navexa uses the collected data for various purposes:

• To provide and maintain the Service
• To notify you about changes to our Service
• To allow you to participate in interactive features of our Service when you choose to do so
• To provide customer care and support
• To provide analysis or valuable information so that we can improve the Service
• To create, analyse, and publish Aggregated Data (for example, industry-wide fee benchmarks or anonymised market insights)
• To monitor the usage of the Service
• To detect, prevent and address technical issues

Aggregated Insights

We may share or publish Aggregated Data for research, marketing, analytics, or informational purposes. Aggregated Data never contains Personal Data, and we take reasonable steps to ensure it cannot be re-identified. Because Aggregated Data cannot be linked back to you, individual opt-out is not offered.

Transfer of Data

Your information, including Personal Data, may be transferred to — and maintained on — computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction.

We store your data in Australia. The Microsoft Azure infrastructure that hosts the Navexa application, its databases and its file storage is located here, and if you are outside Australia your data is transferred to Australia and stored there.

Some processing nonetheless takes place overseas, principally in the United States. This includes the artificial-intelligence processing described below, customer support messaging, payment processing, product analytics, advertising measurement, and the services that connect your broker and bank accounts. Every provider that receives your financial data, documents or payments is named on our sub-processors page, together with what it does and what information it receives. So while your data is stored in Australia, parts of it do leave Australia in the course of providing the Service.

Before disclosing Personal Data to an overseas recipient we take steps that are reasonable in the circumstances to ensure it is handled consistently with the Australian Privacy Principles, including through contractual protections such as Standard Contractual Clauses. Navexa will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

Disclosure of Data

Legal Requirements

Navexa may disclose your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of Navexa
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

Other Disclosures

We may disclose Aggregated Data publicly or to third parties. Such disclosures do not include your Personal Data and cannot be used to identify you.

Security of Data

The security of your data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

Service Providers & Processors

We may employ third party companies and individuals to facilitate our Service ("Service Providers"), to provide the Service on our behalf, to perform Service-related services or to assist us in analysing how our Service is used.

These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

This does not apply to the advertising providers named on our sub-processors page. Those providers also use the information they receive for their own purposes, in accordance with their own privacy policies.

How We Use Artificial Intelligence

We use third-party artificial-intelligence services to deliver several features. Every provider we use for this is named on our sub-processors page, together with what it does and what information it receives. None of them use your data to train their models.

AI is used in the following ways:

• Portfolio chat — when you ask Navexa a question, the text of your message and the portfolio data needed to answer it are sent for processing.
• Importing broker files — when you upload a CSV or spreadsheet, its contents are analysed to identify and extract your trades.
• Contract notes — when you forward a trade confirmation email to your personal Navexa import address, the email and any attachments are read and converted into trades.
• AMIT and tax statements — when you upload an annual tax statement, it is read and converted into the figures used in your tax reports.
• Customer support — when you message our support assistant, your message and contact details are processed to generate a response.

Documents you upload or forward for import commonly contain personal information beyond your trades — for example your name, postal address, broker account number, and holder identification number (HIN or SRN). Where a document is processed by AI, that whole document is processed.

Some of this processing takes place in Australia: the Microsoft Azure infrastructure that reads your documents and stores your data is located here. Other processing takes place overseas, in the United States — including by OpenAI, which means the contents of your documents and questions do leave Australia. Those transfers are protected by Standard Contractual Clauses and additional safeguards. Our AI providers retain prompts, responses and documents only briefly and solely to monitor misuse — currently up to 30 days in the case of OpenAI.

We do not use your data to train or improve any artificial-intelligence model, and neither do the providers we send it to.

AI-generated responses, and data extracted from your documents, are provided for information only. They may be incomplete or inaccurate, and they do not constitute financial, tax or accounting advice. You should check imported data and any figures used in a tax return before relying on them.

Apps and Assistants You Connect Yourself

Navexa has a public API. You can authorise a third party app or service to access your Navexa account through it — for example a broker or investing platform that displays your Navexa portfolio inside its own product, or your own AI assistant connected through our Model Context Protocol server at mcp.navexa.com. This is optional and off unless you set it up.

When you authorise one, your portfolio data is sent to that third party at your direction and under your control. They are not one of our sub-processors: we do not control how they handle, retain or use your data, and their own terms and privacy policy apply. You can revoke access at any time from your account settings.

Analytics and Advertising

We use third-party providers to measure how the Service is used and how our advertising performs. Each one is named on our sub-processors page, together with what it does and what information it receives.

Some are analytics providers, which help us understand how features are used on our website and in our mobile applications so that we can improve them. Others are advertising providers, which use cookies and similar identifiers to measure which advertising leads to sign-ups, and in some cases to show Navexa ads to you on other platforms.

You can limit what these providers receive. On our website, use your browser's cookie settings. In our mobile applications, use your device settings — including, on iOS, app tracking permission. Several advertising providers also offer ad personalisation controls in your account settings with them, although those controls affect the advertising you are shown rather than the information they receive.

Links to Other Sites

Our Service may contain links to other sites that are not operated by us. If you click on a third party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Children's Privacy

Our Service does not address anyone under the age of 18 ("Children"). We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from children without verification of parental consent, we take steps to remove that information from our servers.

Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. We will let you know via email and/or a prominent notice on our Service, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes are effective when posted on this page, unless we state a later effective date at the top of this policy, in which case they take effect on that date for existing users.

Contact Us

The Service is operated by Navexa Services Pty Ltd (ACN 639 386 539 / ABN 47 639 386 539). If you have any questions about this Privacy Policy, want to access or correct the personal information we hold about you, or wish to make a privacy complaint, please contact us:

• By email: navarre@navexa.com

We will acknowledge a privacy complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.