Draft — not yet reviewed by a lawyer. Do not rely on this as a final privacy policy. This is a first-pass template written from the project blueprint. Before publishing — and especially before collecting KYC or financial data from real investors — have this reviewed, confirm which privacy laws actually apply given where xcetra is incorporated and where its users/investors are located, and register with a regulator if required.
Privacy Policy
xcetra.co
Last updated: 20 August 2026
1. Introduction
This Privacy Policy explains how xcetra (“xcetra,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you visit xcetra.co, use the Investor Program pages or portal, or otherwise interact with us (together, the “Services”). It applies to xcetra.co itself; each Venture in the portfolio (currently HSEQ Manager, HIO Challenge, Agathon, and Journey Tracker) has its own separate privacy policy governing use of that product directly, which you should also read if you use one of those products.
2. Information we collect
Information you give us directly — for example, your name and email address when you contact us or subscribe to updates; your details when you apply to the Investor Program (which may include identity, contact, financial, and tax information collected for know-your-customer/anti-money-laundering purposes once that process is live); and any content you submit through a form, comment, or application.
Information collected automatically — when you browse the Site, we and our service providers may automatically collect technical information such as your IP address, browser and device type, pages viewed, referring pages, and timestamps, generally through server logs and cookies or similar technologies (see Section 6).
Referral and attribution data — if you arrive at the Site via a tracked referral or partner link (for example, an investor's personal marketing link), we record the click and any resulting sign-up against that referral code so we can attribute activity correctly. This is a technical record tied to the link, not to your identity, unless you separately create an account or submit information that identifies you.
Information from third parties — where relevant, we may receive information from payment processors, identity-verification providers, or social media platforms we use to publish or manage content (for example, engagement metrics on a published post), consistent with those providers' own terms.
3. How we use information
We use the information we collect to:
- operate, maintain, and improve the Site and Services;
- respond to enquiries sent to admin@xcetra.co or through a contact form;
- process and administer Investor Program applications, including identity verification and, for active agreements, generating statements and processing payouts;
- measure marketing-attribution activity (referral clicks, sign-ups) tied to tracked links, including for the purposes described in the Investor Program;
- send you communications you've asked for, such as portfolio or Venture updates, and administrative notices about your account or application;
- understand aggregate Site usage and traffic patterns, to improve content and navigation;
- detect, investigate, and prevent fraud, abuse, or security incidents;
- comply with our legal obligations, including any KYC/AML obligations that apply once the Investor Program is handling real capital.
We don't sell your personal information.
4. How we share information
We share personal information only in these circumstances:
- Service providers who process data on our behalf under contract, for example hosting providers, email-delivery services, social-media publishing tools (such as Ayrshare or Buffer), payment processors, and identity-verification providers — each limited to what they need to perform their function for us;
- Within the xcetra portfolio, where a Venture-specific enquiry or account needs to be routed to the relevant Venture Manager;
- Legal and safety reasons, where we believe disclosure is required by law, regulation, legal process, or governmental request, or is necessary to protect the rights, property, or safety of xcetra, our users, or others;
- Business transfers, if xcetra or a Venture is involved in a merger, acquisition, financing, or sale of assets, in which case personal information may be transferred as part of that transaction, subject to the same protections described here;
- With your consent, for any other purpose we've disclosed to you and you've agreed to.
We do not share Investor Program applicant financial or KYC data with any party outside of the above except as required to process the specific application or as required by law.
5. Data storage and security
Site data is stored on our hosting provider's infrastructure (currently a MySQL database behind a PHP application, using prepared statements to help protect against common injection attacks) with access restricted by role — for example, financial and investor data is limited to Owner and Finance-role staff, per the access model described internally for the admin system. Passwords are stored using industry-standard one-way hashing, never in plain text, and investor accounts are intended to require multi-factor authentication given the sensitivity of the data they hold.
No method of transmission or storage is 100% secure, and we can't guarantee absolute security. If we become aware of a data breach affecting your personal information, we'll notify you and any relevant regulator as required by applicable law.
6. Cookies and similar technologies
We use cookies and similar technologies to keep you signed in, remember preferences, measure site traffic, and attribute referral activity to the correct tracked link. You can control cookies through your browser settings, including blocking or deleting them, though doing so may affect parts of the Site that depend on them (for example, staying signed in to the investor portal, or referral-link attribution). Where required by law, we'll present a cookie notice or consent mechanism before non-essential cookies are set.
7. Data retention
We keep personal information for as long as needed for the purposes described in this Policy — for example, account and application data for as long as your account or agreement is active and for a reasonable period afterward to meet legal, accounting, or dispute-resolution obligations (financial and KYC records in particular may need to be retained for a statutory minimum period once the Investor Program is operational). Server logs and aggregate analytics data may be retained for a shorter, rolling period. When information is no longer needed, we take reasonable steps to delete or de-identify it.
8. Your rights and choices
Depending on where you're located, you may have rights to access, correct, or request deletion of your personal information, to object to or restrict certain processing, or to receive a copy of your data in a portable format. You can exercise these rights, or ask a question about how your information is handled, by contacting us at admin@xcetra.co. We'll respond within a reasonable time and may need to verify your identity before actioning a request.
If you've subscribed to updates or marketing communications, every such email includes an unsubscribe option, or you can ask us directly to stop.
9. International visitors and data transfers
xcetra.co can be accessed from outside Australia, and some of our service providers may process or store data outside the country you're in (for example, on servers or through platforms operated internationally). Where we transfer personal information across borders, we take reasonable steps to ensure it continues to be protected consistently with this Policy.
10. Children's privacy
The Services aren't directed at children, and we don't knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us at admin@xcetra.co and we'll take steps to delete it.
11. Changes to this Policy
We may update this Privacy Policy from time to time, for example as the Investor Program moves from an informational to an operational phase and starts collecting KYC/financial data. We'll update the “Last updated” date above when we do, and for material changes we'll provide additional notice on the Site. Your continued use of the Services after a change takes effect means you accept the updated Policy.
12. Contact us
Questions, requests, or concerns about this Privacy Policy or how your personal information is handled can be sent to:
admin@xcetra.co