Comma, Advisory
One relationship, the whole journey.
Home About
Business Foundation Cashflow Management Smart Growth Business Sales
Bootcamps ↗ Insights Contact See where you stand

Privacy Policy

Last updated: 25 August 2026.

Comma Advisory is committed to protecting your privacy. This policy explains how we collect, use, store, and disclose personal information, in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

1. Who we are

This policy applies to personal information handled by Comma Advisory Pty Ltd (ABN 39699991109, ACN 699 991 109), trading as Comma Advisory ("we", "us", "our"), and by Comma Business Brokers (Hetas Pandya, ABN 15 983 155 364) in respect of brokerage services.

2. The personal information we collect

  • Contact details: name, email, phone, and business contact details.
  • Business details: business/trading name, entity type, ABN, GST registration, and context you provide.
  • Financial information: for the Cashflow Management (Cashflow Plumbing) service, the bank transaction data you upload as a CSV. Your account name, account number, and BSB are removed at the point of upload, before anything is stored - we only retain de-identified transactions (date, description, amount, balance).
  • Assessment information: for The Comma Score, the answers and business information you enter into the assessment.
  • Brokerage information: for business-sale services, information about the business being sold or considered.
  • Consent and usage records: which terms you accepted and when, and technical/website usage data.

3. How we collect it

Directly from you - through our website forms, bookings, consultations, file uploads, and assessment tools - and through your use of our website (see cookies, clause 9). For Cashflow Management, we do not connect to your bank, and we do not connect to accounting software such as Xero or MYOB; you provide a CSV only.

4. Why we collect and use it

  • To provide, deliver, and improve our services, reports, and tools.
  • To produce and deliver your report, score, or deliverable and run your session.
  • To invoice you and manage your engagement.
  • To communicate with you about your result and engagement, and - only if you opt in - marketing (you may opt out at any time).
  • To meet our legal and licensing obligations.

5. How your financial data is handled (Cashflow Management)

  • De-identified on upload: account name, number, and BSB are stripped immediately, in memory, before storage. The fully-identified original is never stored.
  • AI analysis: de-identified transactions (date, description, amount) are processed by a third-party AI provider (Anthropic, in the United States) to generate the analysis, and reviewed by an advisor before release. We do not send your name, account name, account number or BSB to the AI provider.
  • Retention: the raw file you upload is never stored. We keep your de-identified transactions only until your report is delivered and you have signed off, then permanently delete them, automatically within 30 days of upload if not sooner. We keep them for that short window so we can verify the accuracy of your report against the data our engine used. Your finished, de-identified report is kept as the record of work done.
  • Business Foundation and Comma Score records (engaged clients): where you engage us, engagement records, assessment responses and associated documents are retained for seven (7) years to satisfy record-keeping obligations under the Corporations Act 2001 (Cth) and Queensland limitation periods, or deleted earlier on verified request. A free assessment that never becomes an engagement is anonymised at 24 months instead (see clause 5A).
  • Audit and billing records: engagement contracts, consent logs and billing records are retained for seven (7) years in Australian cloud infrastructure.
  • Storage: stored in Supabase, Australian (Sydney) region, with access restricted to authorised personnel.

5A. How your assessment data is handled (The Comma Score)

We keep the answers and business information you enter into a Comma Score assessment so we can produce your result and, where relevant, revisit it with you. If an assessment has no advisor contact for 24 months, we automatically anonymise it - we retain the scored answers and your industry to calibrate and improve our tools, and we remove the identifying details (name, email, phone). You can ask us to delete your assessment data sooner at any time (see clause 11).

6. Automated processing and automated decision-making

Some of our tools use automated processing. The Comma Score produces an indicative score by automated means, and report content for The Comma Score and Cashflow Management is generated with the assistance of AI and reviewed by a person before release. These outputs are general and indicative only and do not by themselves make a decision that has a legal or similarly significant effect on you - you and your advisers make the decisions. Where we use automated processing in a way that significantly affects you, we will disclose this in line with our obligations under the Privacy Act.

7. Who we disclose it to

  • Our third-party AI provider, Anthropic (United States) - de-identified data only, as above.
  • Service providers who help us run and deliver our services - for example database hosting (Supabase, Sydney), application hosting and server logging (Railway), transactional email delivery (Resend), secure backups (GitHub), and payment/invoicing (Zoho). Some of these are located in, or store data in, the United States (see clause 8), and each handles only the limited information needed to perform its function.
  • Third-party platforms you ask us to use on your behalf (for example the ATO's online services, Business API, GoDaddy, Crazy Domains) - these have their own privacy practices.
  • Professional advisers and authorities where required by law.
  • We do not sell your personal information.

8. Overseas disclosure

Some of our service providers, including our AI provider Anthropic, PBC in the United States, may store or process data outside Australia. For Cashflow Management, only de-identified transaction data, never your name or account identifiers, may be processed overseas.

Statutory notice under Australian Privacy Principle 8.2(a). By providing your personal information or uploading business data to our platform, you expressly consent to the disclosure of your information to our overseas service providers. You acknowledge and agree that: (a) Australian Privacy Principle 8.1 will not apply to this disclosure; (b) Comma Advisory Pty Ltd will not be accountable under the Privacy Act 1988 (Cth) for any acts or omissions of the overseas recipient; and (c) you may not be able to seek redress against the overseas recipient under the Australian Privacy Act or under the laws of the foreign jurisdiction.

How AI processing is handled. Raw transaction records are never transmitted to any external AI provider. No personal identifier is sent at all: not your name, not your account name, not your account number or BSB. Only aggregated analytical output leaves our systems, and detected payee and merchant labels are replaced by placeholder tokens before transmission. All external AI processing is conducted under commercial API terms, not consumer terms, under which your data is encrypted in transit and at rest, is retained by the AI provider for no more than thirty (30) days and then automatically deleted (except where that provider's automated trust-and-safety systems flag content, in which case it may be retained for longer), and is never used to train, retrain, or improve artificial intelligence models.

8A. Government-related identifiers and identity verification

Comma Advisory does not collect, record, or adopt Commonwealth government identifiers (such as Tax File Numbers or Medicare Numbers) except as strictly authorised by law for company formation. Under no circumstances do we collect, view, or store your personal myGov, myGovID, or Australian Taxation Office login credentials. All Director ID applications must be completed by directors personally through the Australian Business Registry Services.

9. Cookies and website analytics

We use cookies and similar technologies to analyse website traffic and support advertising (for example, Google Analytics and Google Tag Manager). You can disable cookies in your browser, though this may affect website functionality.

10. Security and data breaches

We take reasonable steps to protect your information, including de-identification on upload, restricted access, and expiring file links. No system is completely secure and we cannot guarantee absolute security. If a data breach likely to cause serious harm occurs, we will respond in line with the Notifiable Data Breaches scheme.

11. Access, correction, and complaints

You may request access to, correction of, or deletion of the personal information we hold about you. We will action a deletion request within a reasonable time, except where we are required to keep certain records by law or to establish or defend a legal claim. To make a request or a privacy complaint, contact us at [email protected]. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

12. Changes

We may update this policy from time to time. The current version is the one published on our website.

13. Contact

Comma Advisory - U3 / 17 Gould Rd, Herston QLD 4006. Email: [email protected]. Phone: 0470 68 68 68.