Legal

Privacy Policy

Last updated: 13 October 2026

ConcaveIQ is operated by WhyPred Pty Ltd (“we”, “us”). We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what personal information we hold, where it comes from, how we use and disclose it, and how you can access, correct or remove it.

Are you an adviser, licensee or fund manager? You can check whether we hold a record about you and ask us to remove or correct it, without an account, at Remove or correct your information.

1. The personal information we hold

ConcaveIQ is a business-information service about the Australian financial-services industry. We hold three kinds of information:

• Professional register information about individuals — for financial advisers and other people named on public registers: name, adviser or representative number, licensee and practice affiliation, business location (suburb, state, postcode), qualifications, years of experience, register history and any disciplinary or banning information the register publishes.
• Business information — about firms, licensees, funds and other organisations, including business contact details the organisation itself publishes (office phone numbers, shared inboxes such as info@, and website addresses), funds and products, and investment views the organisation publishes on its own website. This is generally not personal information, but it may sometimes identify a sole trader or a named individual.
• Customer and visitor information — for people who use ConcaveIQ: name, username, work email, hashed password, organisation, billing details processed by our payment provider, saved lists, research reports, chat history with the assistant, usage counts and security logs. For people who lodge a removal or correction request: name, email, relationship to the record and the details provided.

We do not collect home addresses, personal mobile numbers, personal email addresses, dates of birth, government identifiers of individuals, or sensitive information (such as health, political or religious information). We do not harvest personal email addresses from websites.

2. How we collect it

• Public registers: the ASIC Financial Advisers Register, AFS licensee and authorised-representative registers (licensed CC BY 3.0 AU by ASIC), the ACNC charity register, the Australian Business Register and APRA statistical publications.
• Organisations’ own publications: public pages of firm and fund websites, read by automated tools, from which we extract business contact details, product information and published investment views. We record the source page for everything we extract.
• Directly from you: when you hold an account, use the service, contact us or lodge a request.

Where we collect personal information about advisers from public registers rather than from them directly (APP 5), this policy and the removal page are our notice to them. Unsolicited personal information we receive and could not have collected is destroyed or de-identified (APP 4).

3. Why we collect, use and hold it

• To provide a market-intelligence service that helps financial-services businesses understand the market: who is licensed, where, under which licensee, how the market is changing, and which organisations to approach in a business capacity.
• To derive classifications (for example, whether a practice describes itself as serving wholesale clients) and summaries from published information.
• To operate customer accounts, bill, secure the service, prevent misuse, and meet our legal obligations.
• To handle access, correction, removal and complaint requests.

We do not sell personal information to data brokers, and we do not use register information to profile individuals as consumers.

4. Who we disclose it to

• Our customers — financial-services businesses with paid accounts, who may view, search and export register and business information for business-to-business purposes under contractual restrictions (see our Terms), including compliance with the Privacy Act, the Spam Act 2003 and the Do Not Call Register Act 2006.
• Service providers who process data for us under confidentiality obligations: cloud hosting and storage providers, AI model providers used to classify text, answer questions and research firms, web-reading services used to retrieve public web pages, and our payment processor. AI providers process the text we send to produce a result; we do not permit them to use it to train their models where that option is offered. A current list of service providers is available on request.
• Authorities, where required or authorised by law.

5. Overseas disclosure

Some service providers store or process information outside Australia, principally in the United States and the European Union. We take reasonable steps, including contractual terms, to ensure those providers handle information consistently with the APPs (APP 8).

6. Direct marketing

We do not send direct marketing to the individuals described in our data. Our customers may use business contact information to approach organisations; our Terms require them to do so lawfully, identify themselves, and honour opt-out requests. If you are contacted by a ConcaveIQ customer and do not wish to be, ask them to stop — and you can ask us to remove your record so it no longer appears in the service.

If you are a customer, we may send you service and product updates; you can opt out at any time using the link in the message or by contacting us (APP 7).

7. Quality and security

Register data refreshes weekly from its source, and derived fields carry the source and date they came from. We act on corrections promptly (APP 10). Information is encrypted in transit, stored with access controls limited to authorised staff, passwords are hashed, exports are watermarked to the account that produced them, and access is logged (APP 11). If a data breach is likely to cause serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

8. Retention

Register information is replaced each time the source register updates; historical snapshots are kept to show market movement. When a removal request is approved, the record is suppressed from every view, search, export and AI answer and is excluded from future processing. Customer account data is kept while the account is active and for up to seven years afterwards for legal and tax purposes, then deleted or de-identified.

9. Access, correction and removal

You may ask to access the personal information we hold about you (APP 12), to correct it (APP 13), or to remove it from ConcaveIQ. Use the online request form or email hello@concaveiq.com. We may need to verify your identity. We respond within 30 days and do not charge for making a request. Removal from ConcaveIQ does not alter the public government registers; to change those, contact the register operator (for example ASIC).

10. Anonymity and cookies

You can browse our public pages and lodge a removal request without an account (APP 2), though we need a contact email to reply. We use one essential session cookie to keep customers signed in, and store your theme preference in your browser. We use no advertising or cross-site tracking cookies.

11. Complaints

If you have a privacy concern, contact us first at hello@concaveiq.com. We will acknowledge it within 7 days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

12. Changes and contact

We will update this policy as the service changes and show the date of the latest version above. Privacy Officer, WhyPred Pty Ltd — hello@concaveiq.com.