Privacy Policy

1. Who we are

Mantle is a workflow and AI-assisted document platform (Mantle, we, us, our).

Mantle is a business-to-business software product supplied to Australian Financial Services Licence (AFSL) holders and their authorised representatives. Mantle itself does not hold an AFSL and does not provide financial product advice.

This policy explains how we handle personal information under the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). We voluntarily comply with the Privacy Act and APPs in full, regardless of whether the small-business exemption might otherwise apply.

2. What personal information we collect

We collect the kinds of personal information listed below. "Client" means an end-client of a Mantle customer firm. Client information reaches Mantle because the customer firm's adviser uploads it or emails it into the platform.

From advisers and firm staff (our direct users)

• Name, work email, work phone number, role and firm.
• Login credentials (hashed passwords, optional 2FA secret).
• OAuth tokens for Gmail, Google Calendar, Outlook, Dropbox (encrypted at rest).
• Session, device and network telemetry, including IP address and audit logs of actions performed in the platform.

From website visitors

• Contact-form submissions (name, email, message).
• Basic server logs (IP, user agent, request path) used for security monitoring.

About clients of our customer firms

Advisers upload client information into Mantle so that Mantle can help draft Statements of Advice, follow-up emails, insurer alteration requests, and related work. This may include:

• Identifiers: full name, date of birth, contact details.
• Financial information: income, assets, liabilities, superannuation balance and history, existing insurance policies and premiums, tax returns.
• Family and dependant information: spouse, children, ages, living arrangements.
• Sensitive information (APP 3) where relevant to underwriting or existing cover: health conditions, smoker status, occupation-related risk factors, claims history. Sensitive information is only collected with the client's consent, obtained by the adviser at the point of collection.
• Meeting transcripts, notes and correspondence relating to the advice engagement.

3. How we collect and hold information

Personal information is collected:

• Directly from users (form submissions, uploads, in-product actions);
• From connected services the user authorises (Gmail, Google Calendar, Outlook, Dropbox);
• Indirectly, from customer firms and their advisers who upload client documents and meeting transcripts on the client's behalf.

All personal information is stored on servers located in Sydney, Australia (DigitalOcean App Platform + Supabase Postgres, ap-southeast-2). Data is encrypted in transit (TLS 1.2+) and at rest (AES-128 / Fernet for OAuth tokens and sensitive columns; Supabase-managed disk encryption for the database as a whole).

Access to production data is restricted to authorised Mantle personnel by role, requires multi-factor authentication, and is logged.

4. Why we collect it (purposes)

We collect and use personal information to:

• Provide the Mantle platform to customer firms and their advisers;
• Generate draft documents (SOAs, emails, alteration requests, financial plans) for adviser review;
• Run automated compliance checks on draft outputs before an adviser sends them;
• Track policy renewals, gaps, and follow-up actions;
• Provide customer support, resolve incidents, and improve the product;
• Meet the record-keeping obligations that customer firms owe under Chapter 7 of the Corporations Act 2001 (Cth) and related ASIC instruments (see Retention);
• Detect and prevent misuse, fraud, and security incidents;
• Comply with our legal obligations.

We will not use personal information for a purpose other than the purpose for which it was collected (or a related purpose the individual would reasonably expect) without consent, except where the Privacy Act permits.

5. Overseas disclosure (APP 8)

To provide document generation, analysis and error monitoring, we disclose personal information (which may include sensitive information contained in advice documents and meeting transcripts) to a small number of overseas processors. Under APP 8 and s16C of the Privacy Act, we remain accountable for these disclosures.

Depending on which model is invoked, LLM inference is routed either through Anthropic's direct API (United States) or through AWS Bedrock in the Sydney region (Australia). Either way, the contractual no-training commitment applies and the same set of personal information categories is disclosed.

DigitalOcean and Supabase host our application and database in Sydney, Australia. Google (Gmail, Calendar) and Microsoft (Outlook) are accessed via user-initiated OAuth — where a user authorises Mantle to read or send email on their behalf, information passes through the relevant provider under that user's own account.

We do not disclose personal information to any other overseas recipient without consent, other than as permitted by the Privacy Act.

6. Sensitive information

Where advice documents include sensitive information (for example, health conditions disclosed for underwriting), it is collected by the adviser from the client, not by Mantle directly. Our terms with customer firms require the firm to warrant that client consent has been obtained for the collection of sensitive information and for its handling by Mantle for the purposes described in this policy.

Sensitive information is only used for the advice work it was provided for. It is not used for marketing, analytics, or any unrelated purpose.

7. Use of automated systems and AI

Mantle uses automated systems, including large language models supplied by Anthropic, to assist advisers with:

• Drafting Statements of Advice, follow-up emails, financial plans, alteration requests and other client communications;
• Extracting structured data from uploaded documents (certificates of currency, superannuation statements, tax returns, client profiles);
• Running compliance detectors against drafts for banned phrases, hallucinated figures, past-date framing, and similar risks;
• Flagging policy renewals, premium changes, and follow-up actions.

Human-in-the-loop. All AI-generated content is a draft. It is never sent to a client without adviser review and approval. The adviser (and their licensee) remains solely responsible for the content of any advice provided to a client.

No training on your data. Under our contractual arrangements with Anthropic, personal information disclosed to Anthropic for inference is not used to train Anthropic's models. A short abuse-monitoring retention window applies, after which inference data is deleted from Anthropic's systems.

APP 1.7 automated decision-making (from 10 December 2026). From that date, APP 1.7 will require this policy to describe the kinds of personal information used by any automated system that makes, or does something substantially and directly related to making, a decision that significantly affects an individual. Mantle's compliance detectors, renewal flags, and pre-send gates operate on the personal information described in Section 2. These systems do not make final advice decisions — every draft, flag, or gate is reviewed by a human adviser before any client-facing action is taken. We will update this section as our systems evolve and ahead of the 10 December 2026 commencement.

8. Direct marketing (APP 7)

We may occasionally contact advisers with product updates and operational notices. You can opt out at any time by emailing [email protected] or using the unsubscribe link in a marketing email.

Emails that Mantle helps advisers send to their own clients are the responsibility of the sending adviser and their firm, and are subject to the Spam Act 2003 (Cth). Mantle enforces unsubscribe suppression at the platform layer to help firms comply.

9. Access, correction and complaints (APPs 12, 13)

You have the right to ask for a copy of the personal information we hold about you and to ask us to correct it if it is inaccurate, out of date, incomplete, or misleading.

If the information relates to a client of an advice firm, we may need to route the request through the firm as the primary relationship holder, so that the firm can meet its own professional and record-keeping obligations.

Requests, questions and complaints should be sent to our Privacy Officer at [email protected]. We aim to acknowledge within 5 business days and to respond substantively within 30 days.

If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.

10. Retention and destruction

Advice records held on behalf of customer firms are retained for at least seven years, consistent with ASIC record-keeping obligations for AFS licensees when giving personal advice (ASIC Corporations (Record-Keeping Requirements for AFS Licensees when Giving Personal Advice) Instrument 2024/508). Retention overrides deletion where the licensee requires access for its compliance obligations.

Other information is kept for the following default periods, subject to any longer period we are required to keep it by law:

11. Security (APP 11)

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These include:

• Encryption in transit (TLS 1.2+) and at rest;
• Row-level tenant isolation enforced at the database layer;
• Role-based access controls, multi-factor authentication for production access, and audit logging of reads and writes;
• Circuit breakers, rate limits and per-user AI-usage caps to constrain abuse;
• Regular backups with periodic restoration testing;
• Third-party subprocessor review before onboarding.

No system is perfectly secure. If you believe your information has been compromised, please contact us immediately (see Section 12).

12. Data breach notification

We comply with the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Privacy Act. If we become aware of an incident that is likely to result in serious harm to any affected individual, we will assess it promptly (target: within 30 days as required by law, typically within 72 hours internally) and, where the incident is an eligible data breach, notify the OAIC and affected individuals as soon as practicable.

Where an incident involves personal information held on behalf of a customer firm, we will notify the firm without undue delay so that the firm can meet its own notification obligations. The allocation of notification responsibilities between Mantle and the customer firm is set out in the Data Processing Addendum with each customer firm.

13. Cookies and analytics

Mantle uses strictly-necessary cookies to keep users logged in and to protect against cross-site request forgery. We do not use third-party advertising or cross-site tracking cookies.

14. Changes to this policy

We may update this policy from time to time. Material changes will be signposted on the site and, where practicable, notified to advisers by email. The version and date at the top of this policy is the authoritative record. Prior versions are available on request.

15. Contact us

Privacy Officer, Mantle
Square Peg Financial Pty Ltd
Suite 201, 429 Bay Street, Brighton VIC 3186
Email: [email protected]