How we handle personal information

In brief

• This policy explains how EagleEye handles personal information: what we collect, why, who we share it with, how we protect it, and how you can see it, correct it or complain.
• Our website collects very little. If you use the demo form, we receive your name, company and work email, and we use them only to reply to you. The site sets no cookies of its own and runs no analytics of our own.
• When we work for a client, we read that client's financial records, which contain personal information about its staff, suppliers and customers. We do that for the client alone, on its instructions and under its agreement with us. That information is never pooled with another client's and never used for our own purposes. Before we receive any client data, we will make sure our people see it only for a task the client approves, time-limited and recorded.
• No artificial intelligence or language model finds, values or decides anything in our checks, and a person at the client makes every decision.
• You can contact us at any time at contact@eagleeye.io.

1. Who we are

In this policy, "EagleEye", "we", "us" and "our" mean EagleEye. We provide independent, read-only oversight of the money moving in and out of large organisations. Our software reads a client's exported files or read-only connections, runs fixed checks, and shows the client's own people what it finds, with the records behind each finding. It never pays, posts or changes anything in a client's systems.

We handle personal information in line with the Privacy Act 1988 (Cth) (the Privacy Act) and the Australian Privacy Principles in it (the APPs). We commit to doing so whether or not the Act applies to us as a small business, and our client agreements require us to.

This policy is our APP privacy policy. It is written to meet APP 1. It is available free of charge at https://eagleeye.io/privacy.html, and we will send you a copy in another form if you ask.

2. Who this policy covers

This policy covers personal information about:

• Website visitors: people who visit https://eagleeye.io.
• Prospects and contacts: people who ask for a demo, write to us, meet us, or are introduced to us, and people who work for our clients, partners, suppliers and advisers and deal with us.
• Client users: people at our clients who use our platform, including the people a client names to make decisions on findings.
• People whose information is in client data: staff, contractors, suppliers, customers and others whose details appear in the financial records a client gives us. For this information we act for the client (see 2.1).
• Job applicants: people who apply to work with us.

2.1 When we act for a client

When a client gives us its records, the client decides why and how that information is used. We handle it only to provide our services to that client, on its instructions and under our agreement with it. If your information is in a client's records, the client's own privacy policy explains how it handles your information, and you can contact the client directly. We still comply with the Privacy Act for that information, and we help the client respond to any request or complaint you make. If you contact us about it, we will pass your request to the client within five business days and help it respond.

2.2 What this policy does not cover

This policy does not cover the personal information of our own employees, which we handle as an employer, or websites and services run by others that our site may link to.

3. The personal information we collect

The personal information we collect depends on how you deal with us.

Website visitors. Our website does not ask you to sign in and sets no cookies of its own. Our web host's servers automatically record technical details of each request, such as your IP address, browser type, the page requested and the time. We do not use these records to identify you. See section 9.

Prospects and contacts. If you use the demo form: your name, company and work email. If you write to us or meet us: your name, organisation, role, contact details and what you tell us. If someone introduces you to us: the details they give us.

Client users. Your name, work email, role, the entities you can see, your sign-in records, and the decisions you make in the platform (approve, query, hold, release or close), with the time of each. Every decision is recorded on the finding, by whom and when, because that record is part of the evidence the client relies on.

People whose information is in client data. The records a client gives us may include, for example:

• for staff and contractors: name, an employee or payroll identifier, pay rates, hours, rostered shifts, pay and allowance amounts, superannuation amounts, and bank account details for pay;
• for suppliers and customers who are individuals or sole traders, and for contacts at businesses: name, business name, ABN, address, contact details, bank account details, invoices, payments, credits and statements;
• for cardholders: name, the last four digits of the card number, and the transactions on the card.

We ask each client for only the fields each check needs.

Job applicants. Your application, CV, references and the notes of our conversations with you.

4. How we collect it

We collect personal information:

• from you, when you use the demo form, email us, meet us, use our platform or apply for a role;
• from our clients, as exported files or through read-only connections the client sets up, when the client has engaged us to run checks on its records;
• from your organisation or a colleague, when they name you as a contact or a decision maker, or introduce you to us;
• from public sources, such as public business registers; before we receive any client data, these will be recorded as a dated snapshot before a check runs, never looked up during one; and
• automatically, through our web host's server logs (section 9).

If we receive personal information we did not ask for, we decide within a reasonable time whether we could have collected it under the APPs. If we could not, we destroy or de-identify it as soon as practicable, where lawful to do so.

5. Why we collect, use and hold it

We collect, use and hold personal information to:

• reply to enquiries and arrange demos and meetings;
• provide our services to clients, including running the checks, showing findings to the client's decision makers, preparing evidence and claims the client approves, and matching money received;
• manage client accounts, sign-in and security, and keep the record of decisions the client relies on;
• issue invoices and fee statements;
• protect our systems and our clients' data, and investigate and respond to security incidents;
• assess job applications;
• meet our legal obligations, and establish, exercise or defend legal claims; and
• for any other purpose you consent to, or that the law requires or permits.

We use and disclose personal information only for the purpose we collected it, for a related purpose you would reasonably expect (directly related, for sensitive information), or as the law allows.

We do not sell or rent personal information. We do not use client data for our own purposes, for marketing, or to build, train or improve anything for anyone else.

6. How our checks treat information about individuals

Our checks use fixed rules and statistics, never artificial intelligence or language models. Before we receive any client data, the same data will always give the same result. We do not put personal information into any artificial intelligence system or language model, or use it to train one, with one exception: only if a client agrees in writing, a language model may draft a plain-English explanation of one of its findings, from that finding's evidence, for the client's decision maker to read. It never finds, values or decides anything, it is processed in the region in the client's agreement, and nothing is used to train it. It is off unless the client agrees.

Some checks look at payments to or from individuals. For example, a check may flag a payroll line paid at a rate different from the agreed rate, or a supplier payment to a bank account that differs from the one on record. A flag is not a decision. It is shown, with the records behind it, to a person the client has named, and that person decides what to do. Our software does not make decisions about individuals, and our people take no decision on a finding.

Before we receive any client data, we will start replacing the names of individuals with codes as each file arrives, so real names appear only in what the client's own users see.

7. Sensitive information, tax file numbers and card numbers

Sensitive information. We do not ask for sensitive information, such as health information or trade union membership. It can appear in a client's records, for example as a health-related claim line or a union deduction in payroll. If it does, we handle it only as the client's checks need, with the same protection as the rest of the client's data, and for no other purpose. We do not collect sensitive information about you for our own purposes without your consent, unless the law allows it.

Tax file numbers. Our checks do not need tax file numbers. We ask clients to leave them out of every file, and if one reaches us we delete it. We do not use any government identifier, such as a tax file number or Medicare number, as our own identifier for anyone.

Card numbers. Before we receive any client data, we will set our intake to refuse files containing full card numbers, so that we keep no more than the last four digits.

Bank account details. Some checks compare the bank account a payment is going to with the account on record. We use bank account details only for that purpose and protect them as described in section 12.

8. Dealing with us without identifying yourself

You can browse our website without telling us who you are. You can ask us a general question without giving your name. To reply to a demo request, or to give someone access to our platform, we need to know who you are.

9. Cookies, analytics and our website

Our website:

• sets no cookies of its own and uses no browser storage to track you;
• runs no analytics or advertising trackers of our own;
• loads no scripts, fonts or other content from third parties (our fonts are served from our own site); and
• sends the details from the demo form only to EagleEye.

Our web host keeps standard server logs of each request, including IP addresses, for security and to keep the site running. We use them only for those purposes.

If we ever add cookies or analytics, we will update this policy before we do.

10. Who we disclose personal information to

We disclose personal information only as this policy describes. We may disclose it to:

• the client concerned, for personal information in client data, and for the record of decisions its users make in our platform;
• service providers who help us run our business, such as our web host, our email provider and, when it is in place, the provider that hosts our platform. They may use the information only to provide their service to us, under confidentiality and security obligations;
• counterparties named in a claim, when a client's decision maker approves a claim and we send it on the client's behalf. The claim contains only what is needed to support it;
• our professional advisers, insurers and auditors, under duties of confidence;
• a buyer of our business, or a prospective buyer under a duty of confidence, if all or part of our business is sold. Any client data stays bound by the client's agreement; and
• regulators, courts and law enforcement bodies, where the law requires or authorises it.

We never disclose one client's data to another client, and never combine it with another client's data.

11. Disclosure outside Australia

Website, email and enquiries. Our web host's server is in Singapore, so details sent through the demo form, and the host's server logs, are processed there. Our email provider may also store or process information outside Australia.

Client data. At the date of this policy, EagleEye does not host client data on any cloud service. When we do, each client's data will be stored and processed in the region named in that client's agreement and will not be copied outside it. We will list those countries here before any client data is hosted.

Before we disclose personal information to anyone outside Australia, we take reasonable steps to make sure the recipient handles it in line with the APPs, as APP 8 requires, unless an exception in APP 8 applies.

12. How we protect personal information

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, change or disclosure.

Our platform's software already enforces these steps:

• read-only: our connectors send only read requests. The platform never writes to a client system, and never tests access by writing without the client's written consent. We never ask for write access;
• decisions by the client's people: our people and integrations cannot approve, hold, release or close anything for a client; and
• separation of duties: for example, the person who sends a payment file cannot release a line held from it.

Before we receive any client data, we will also have these steps in place:

• separation: each client's data kept apart, encrypted with a key used for that client alone, and never pooled;
• encryption: data encrypted when it moves and when it is stored;
• no standing access: our people will have no standing access to client data. The software runs the checks. Where a task needs a person, access will be limited to that task, approved by the client, time-limited and recorded;
• sign-in: multi-factor sign-in for every user of our platform;
• minimum data: we will ask for only the fields each check needs, and refuse full card numbers; and
• logs that carry no client data.

We do not hold an independent security certification or assurance report at the date of this policy. We will say so here when we do.

No method of storing or sending information is completely secure. If you think your information held by us has been put at risk, contact us straight away.

13. How long we keep it, and deletion

We keep personal information only for as long as we need it for the purposes in section 5, or as the law requires. Then we destroy it or de-identify it.

• Enquiries and demo requests that do not lead to a client relationship: kept for 2 years after our last contact, then deleted.
• Client user records and the record of decisions: kept for the life of the client's agreement, because they form part of the client's evidence, and given to the client when the agreement ends.
• Client data: kept for the life of the client's agreement. When the agreement ends, we will give the client its evidence and records at no charge, will delete the rest within the period the agreement sets, and will give the client a signed certificate of deletion.
• Invoices and fee records: kept for as long as tax law requires, usually five years.
• Job applications: kept for 12 months, unless you ask us to delete them sooner.

14. Accessing and correcting your personal information

You can ask to see the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

To make a request, email contact@eagleeye.io. We may need to confirm who you are before we act on it. We respond within 30 days. We do not charge you for making a request, and we do not charge for giving you access unless the request is unusually large, in which case we tell you the cost first.

If we refuse to give access or to make a correction, we tell you why in writing and how you can complain. If we do not agree to correct information, you can ask us to attach a statement that you believe it is wrong, and we will.

If the information is in a client's data, we pass your request to the client and help it respond (section 2.1).

15. Marketing

We do not use client data for marketing.

We may send business contacts information about our services where you have agreed to it or would reasonably expect it from your dealings with us. Every message tells you how to stop receiving them, and we act on that within five business days. We comply with the Spam Act 2003 (Cth). We do not buy contact lists.

16. Data breaches

We follow the notifiable data breaches scheme in Part IIIC of the Privacy Act, and commit to doing so whether or not it applies to us.

If we suspect a data breach involving personal information we hold, we act at once to contain it and assess it. We complete the assessment as quickly as we can, and within 30 days. If it is an eligible data breach, meaning it is likely to result in serious harm to anyone, we notify the Office of the Australian Information Commissioner and the people affected as soon as practicable, and tell them what has happened and what they can do.

If the breach involves a client's data, we notify the client without undue delay and within the time set in our agreement with it, and work with the client so that the right notifications are made.

17. Complaints

If you have a concern about how we have handled your personal information, please email contact@eagleeye.io with the details. We acknowledge your complaint within 5 business days, look into it, and give you our response in writing within 30 days. If we need more time, we tell you why.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

18. People outside Australia

We work with organisations in Australia, the United States, the United Kingdom and the European Union. If the law where you live gives you further rights over your personal information, such as rights under the GDPR or the UK GDPR, we will honour them when they apply. For client data, we act for the client (in GDPR terms, as its processor) under data processing terms in our agreement with it.

19. Children

Our website and services are for businesses. They are not directed at children, and we do not knowingly collect personal information from anyone under 18 except where it appears in a client's records (for example, a junior employee in payroll), in which case it is handled as client data.

20. Changes to this policy

We may update this policy, for example when our services, our providers or the law change. We post the new version on this page with its date, and we keep earlier versions available on request. If a change materially affects how we handle personal information we already hold, we tell the people affected where we can.

• Version 1.0, 28 October 2026: the full policy replaces the short website notice.

21. How to contact us

Privacy officer: EagleEye's founder, by email

Email: contact@eagleeye.io

Accessibility

This site is built with one typeface, visible focus on every control, every animation with a pause, and layouts that work from a phone to a wide screen. If something does not work for you, email contact@eagleeye.io.