How Infraxus handles personal and financial information.

1. Who we are.

Infraxus provides fractional CFO services (a free written review of the finance function, fixed-fee CFO projects and ongoing CFO support) and bookkeeping subscriptions to owner-run businesses.

Legal entity: Infraxus LLC, a Wyoming limited liability company. Business address: 167 Madison Avenue, Suite 205 #1088, New York, NY 10016.

General enquiries: hello@infraxus.com. Security and privacy: security@infraxus.com.

2. What we collect.

Information is collected only where it is needed to respond to an enquiry, deliver the work, or operate the Portal.

Marketing site enquiries

Information you submit via contact forms or email correspondence: name, email address, company name, and approximate revenue band. Browser and device information (device type, IP address, browser version) is logged automatically by the marketing site host for security and performance purposes.

Bookkeeping signups

When you start bookkeeping, our own signup form collects your work email, your business name and the revenue band you choose (and, in the United States, whether you use QuickBooks Online or Xero). We pass them to Stripe to set up the subscription with no card, and use them to run the onboarding. Your billing address is collected by Stripe only if you later add a card. Card details are collected by Stripe and never reach us: see section 12.

Advertising attribution

Where you arrive from an advertisement or a campaign link, the click identifier Google appends to the URL (gclid, gbraid or wbraid) and any campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term) are stored in your browser and attached to any enquiry or signup you later make, so we can tell which advertising works. These identify a click, not a person.

Portal accounts

When a client engages us, named users are created in the Portal. We collect email address, hashed password (we never see or store plaintext passwords), user name and role within the client's business, session tokens generated at login, and a log of authentication events (sign-in, sign-out, password reset).

Client financial data

During a free review, a CFO project or ongoing CFO work, we collect and process confidential financial data: monthly management accounts (profit and loss, balance sheet, cashflow); budgets, forecasts, and financial models; KPI data (operational and financial metrics specific to the client's industry); historical accounting data exported from platforms such as Xero, MYOB, NetSuite, or QuickBooks; and commentary drafts and published commentary.

AI interactions

Questions submitted via the Ask Your Numbers feature, the financial data context sent alongside those questions, and the AI-generated responses.

3. How we use information.

Collected information is used to:

• Respond to enquiries and provide information about our fractional CFO and bookkeeping services
• Deliver contracted client work, including CFO projects, ongoing CFO work, bookkeeping, and the Portal
• Generate AI-drafted commentary and financial analysis, reviewed by Infraxus before publication to the client
• Answer questions submitted via Ask Your Numbers using the client's own data as context
• Maintain, secure, and improve the Portal and the surrounding service delivery
• Comply with legal, tax, audit, and regulatory obligations

We do not sell, rent, or trade personal or financial information. Client data is not used to train AI models. See Section 6.

4. Processors and infrastructure.

The following third-party providers process data on our behalf in the course of delivering our services.

Each processor is bound by its own data processing terms, which are reviewed before engagement. Where a processor handles client financial data, we rely on industry-standard contractual protections and, where available, jurisdiction-specific data residency options.

5. Cross-border data transfers.

Our processors operate across several countries. Client financial data is stored in Sydney, Australia (Supabase, ap-southeast-2) as its primary location; other regions are available on request. This matches the residency commitment on our Security page.

AI queries and the financial context they require are transmitted to Anthropic (in the United States) for processing. Anthropic's API terms commit that data sent via the API is not retained for model training purposes.

Backend API processing transits Singapore (Render); requests are processed in-memory and responses return to the Sydney-hosted database. No client financial data is retained in Singapore.

Transactional emails (cash alerts, commentary publication notifications) are sent via Resend, located in the United States. These emails contain summary information only, not full financial records.

Review requests submitted from the marketing site are transmitted to our backend and stored in the Sydney-hosted database. We do not use a third-party form host for this data.

We take reasonable steps to ensure each processor that handles personal or financial information provides protections consistent with this Policy and with the privacy laws applicable to our clients. If a client requires specific data residency commitments (for example, Australian-only processing), alternative arrangements can be discussed before work begins.

6. AI processing.

We use Anthropic's Claude models, accessed via OpenRouter, to generate financial commentary and to answer questions submitted via Ask Your Numbers. When these features are used:

• The client's financial data for the period under analysis is included in the API request as context
• The request is transmitted to Anthropic's API over encrypted channels (TLS 1.2 or higher)
• Anthropic's API terms commit that data sent via the API is not used for model training
• The AI response is returned to our systems, reviewed by Infraxus (for published commentary), and stored in the client's Portal
• Ask Your Numbers query logs (the question asked, response length, timestamp, hashed IP) are retained in application logs for operational monitoring and abuse prevention. Raw questions are not associated with individual users in these logs.

7. Data security.

Layered controls protect client information.

Encryption in transit

TLS 1.2 or higher on all endpoints.

Encryption at rest

AES-256 on the Portal database.

Database isolation

Row-level security policies in Supabase Postgres restrict every query to the requesting user's mapped client.

Authentication

Supabase Auth with JWT session tokens.

Access control

Per-client isolation via user_client_map; administrative access is scoped separately.

API security

Service-role keys used only on server-side infrastructure, never exposed to the client browser.

Audit logging

Authentication events and commentary publishing events captured.

Backups

Daily automated database snapshots with seven-day point-in-time recovery.

8. Data retention.

• Free review data: files and exports shared for a free review are deleted within 14 days of the review if no work follows.
• Marketing enquiries: retained as long as needed to respond and maintain business records, typically no longer than two years.
• Client Portal data during ongoing work: retained for the duration of that work.
• Client Portal data after ongoing work ends: Portal access ends within 30 days of the work ending. A full CSV export of the client's historical data is provided. Portal-stored data is deleted within 30 days of a verified deletion request.
• Client Excel financial model: remains the property of the client at all times. We do not retain copies after the work ends unless specifically agreed in writing.
• Session replays: retained for 30 days, then deleted. Form inputs are masked at capture, so they are never in a replay to begin with.
• Advertising click identifiers and campaign parameters: stored in your browser for up to 90 days so that a booking or signup made days after an advertisement click can still be attributed to it, and retained against the resulting enquiry or subscription record as part of our normal business records.
• Bookkeeping subscription and billing records: held by Stripe as our payment processor, including any card you add to continue after the free first close, and retained by us for the period required by law in the client's country: seven years for Australian clients, and the period required by United States federal and state law for United States clients, then deleted.
• Ask Your Numbers logs (hashed IP, question text, response metadata): retained for 30 days for operational and abuse-monitoring purposes, then rotated out of the log system.

8a. QuickBooks Online and Xero access.

Infraxus connects to a client's QuickBooks Online or Xero file only after the client grants access from inside their own file. The connection is used solely to deliver the bookkeeping service the client has engaged. Data accessed through it is not sold, is not shared with third parties for their own purposes, and is not used for advertising.

The client can revoke the connection at any time inside QuickBooks Online or Xero, and Infraxus removes its own access within 30 days of the engagement ending. Data obtained from Intuit is handled in accordance with Intuit's developer terms.

9. Data breach notification.

Where a data breach involving personal information is likely to cause harm, we will notify affected individuals and the relevant data protection authority in their jurisdiction, in line with the breach-notification laws that apply to them.

For client financial data specifically, we will notify affected clients within 24 hours of confirming a breach, with a detailed post-incident report to follow. security@infraxus.com is monitored continuously for security-related correspondence.

10. Access, correction, and deletion.

You have the right to:

• Request access to personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your information, subject to legal and contractual retention obligations
• Withdraw consent for optional processing (for example, marketing communications)

Contact security@infraxus.com to exercise these rights. We will respond within a reasonable timeframe in accordance with applicable privacy laws.

10a. United States residents.

Infraxus does not sell personal information, and has not sold it in the preceding twelve months. If you are a United States resident you have the right to know what personal information we hold about you and to access it, the right to correct inaccurate information, and the right to request deletion, subject to the retention obligations in section 8. To exercise any of these rights, email security@infraxus.com from the address we hold for you; we confirm your identity, respond within the time the applicable law allows, and never treat you differently for making a request.

Text messages. If you call one of the Infraxus United States numbers and press 1 in the voicemail menu, we send one text message to the number you called from, with a link to book a time with Liam. Your keypress is your consent, and it is recorded against that call. We send nothing else by text. Message and data rates may apply. Reply STOP at any time to opt out and HELP for help. Mobile numbers and text message consent are not shared with third parties or affiliates for marketing or promotional purposes.

This Policy applies to our clients and to the business records they place in our care. For a client's business data, including the records in their QuickBooks Online or Xero file, Infraxus acts as a service provider to that client: we process the data only on the client's instructions and only to deliver the engaged service, and the client remains responsible for the personal information of their own customers, staff and suppliers that those records contain.

11. Cookies and analytics.

• Marketing site (infraxus.com): we use PostHog (PostHog Inc., United States) as a product-analytics processor. The analytics layer sets no cookies. It keeps a short random session identifier in your browser's session storage, which your browser discards when you close the tab, so a visit that moves between pages reads as one visit rather than several. We enable PostHog's autocapture on our marketing pages. It records interactions with links, buttons and form controls: the text the element itself shows, its tag and where it sits in the page, so we can tell which parts of a page people actually use and which they click at without result. It does not record what you type. The value of every input is stripped before the event leaves your browser, and a password field is never touched at all. Alongside it we capture a set of explicit events relevant to whether our marketing is producing meaningful engagement: page views, call-to-action clicks, form starts and submissions, scroll depth, video progress, booking clicks, resource downloads, and the steps of the bookkeeping signup. Each event records the page path, referrer, any UTM parameters present in the URL, and an opaque per-recipient token (r_token) when one is present in an outbound link. The r_token is resolved to a contact record only on our backend; the mapping table is not exposed to the browser. IP addresses are discarded at ingestion and are not stored against events.
• Outbound campaign attribution: emails and LinkedIn messages we send may include UTM parameters and an opaque r_token in the link to the website. These let us measure which campaign produced which engagement at an aggregate and (where applicable) recipient level, in a manner consistent with normal business-to-business marketing practice.
• Google Ads conversion tracking (marketing site only): where we run search advertising we load the Google Ads global site tag (gtag.js, Google LLC, United States) on our public marketing pages. Unlike the PostHog layer described above, this tag does set advertising cookies and reads the click identifier that Google appends to an ad click (gclid, and its gbraid and wbraid equivalents), so that we can tell which advertisements lead to a booked call. That identifier and any campaign parameters in the URL are stored in your browser for up to 90 days so a booking made days after the click can still be attributed to it. Four conversion events are recorded: the submission of the review request form, the confirmation of a booked call, a bookkeeping signup on our own form and a booked bookkeeping call. Where you submit that form we also pass a hashed version of your email address to Google as an enhanced conversion, so the conversion can be matched without sharing the address itself in the clear. You can opt out using the controls in the next bullet, through Google’s own advertising settings at adssettings.google.com, or with a tracker-blocking extension.
• Microsoft Advertising conversion tracking (marketing site only): where we advertise on Microsoft's search network we load the Microsoft UET tag (Microsoft Corporation, United States) on the same public marketing pages, for the same purpose and recording the same conversion events. It also sets advertising cookies. Microsoft's own controls are at account.microsoft.com/privacy/ad-settings, and the opt-out controls in the next bullet apply equally.
• Session replay (marketing pages only): on the public pages of infraxus.com, PostHog records an anonymous replay of the page session so we can see where a form or a price table confuses people. Replay does not run on the Client Portal or on any payment page. Every form input is masked at capture: what you type into the name, email, business name and free-text fields is never recorded and never leaves your browser as part of the replay. Replays are anonymous and are not linked to you unless you submit a form. They are retained for 30 days and then deleted. No replay is recorded on the Client Portal, and no replay captures a payment page: card details are entered on Stripe's own domain, which we do not record.
• Scheduling (Calendly): calls are booked through Calendly (Calendly LLC, United States) embedded on our booking, review and bookkeeping welcome pages. When you book, Calendly collects the name, email address and any answers you give in its own form, and sets its own cookies in your browser to run the booking. We receive the booking details and the calendar invitation. Calendly's handling of that data is governed by its own privacy policy at calendly.com/privacy. Where you reach the calendar from a page of ours, we pass through the plan you chose so the call can be prepared; we do not pass payment details, because we do not hold them.
• Opting out: to opt out of analytics, set the global "Do Not Track" signal in your browser, use a tracker-blocking extension, or contact us at hello@infraxus.com and we will exclude your activity from analytics processing.
• Client Portal (app.infraxus.com): essential session cookies from Supabase Auth for authentication and session management. No tracking or analytics cookies.

12. Payment processing.

Bookkeeping subscriptions are processed by Stripe (Stripe, Inc., United States), a PCI DSS Level 1 certified payment processor. Card details, if you add a card, are entered on Stripe's own pages, not on infraxus.com. No card number, expiry date or security code is ever transmitted to, processed by, or stored on our website, our servers, or our Client Portal, and we have no technical means of retrieving one.

Every subscription begins with a free first month-end close, and no card is needed to start. If you choose to continue, you add a card on a secure Stripe page we link you to before the free period ends: Stripe stores the card against your customer record and charges it on day 31, then monthly on the same date, or yearly if you chose annual billing. Stripe holds the card, we never see it, and cancelling the subscription ends Stripe's authority to charge it. If you do not add a card, no charge is ever made.

When you add a card we receive from Stripe the billing details you gave, and we hold with Stripe the email address, business name and revenue band from our signup form, the plan you chose, the amount that will be billed, the date your free period ends, and identifiers for the customer and subscription. We use these to set up and run your subscription and to keep the records our tax obligations require. Stripe processes that data as a payment processor in its own right, and its handling of it is governed by its privacy policy at stripe.com/privacy. Stripe may use its own fraud-prevention signals, including device and network information, as part of accepting a payment.

Where an advertising click identifier or campaign parameters are present when you sign up, they are passed to Stripe as metadata on the subscription so that the signup can be attributed. Fees for CFO projects and ongoing CFO work are invoiced directly and are not processed through the website.

13. Marketing communications.

We contact you directly in response to an enquiry or during the course of an engagement. No marketing newsletters or automated sequences are currently sent. If marketing emails are introduced, they will be sent only with your consent and will include unsubscribe options.

14. Children.

Our services are directed at businesses, not individuals under 18. We do not knowingly collect personal information from children.

15. Complaints.

If you believe we have handled your information in a way that breaches this Policy or the privacy laws that apply to you, contact security@infraxus.com to lodge a complaint. We will acknowledge your complaint within five business days and respond substantively within 30 days.

If you are not satisfied with our response, you may escalate to the data protection authority responsible for privacy in your jurisdiction.

• Website: oaic.gov.au
• Phone: 1300 363 992

16. Updates to this policy.

This Policy may be updated periodically. The "last updated" date at the top reflects the most recent version. Material changes will be communicated to active clients by email. Continued use of the website or services after an update constitutes acceptance of the revised policy.

17. Contact.

For privacy-related questions, requests, or concerns, contact:

Firm

Infraxus

Entity

Infraxus LLC

A Wyoming limited liability company

Address

167 Madison Avenue, Suite 205 #1088, New York, NY 10016

Email

security@infraxus.com