SMSF Core.

Privacy Policy

SMSF Core Australia Pty Ltd (ACN 697 503 352) ("SMSF Core", "we", "us", "our")
Last updated: 9 July 2026

1. Who we are

SMSF Core Australia Pty Ltd is an Australian company that provides an online information tool for self-managed superannuation fund (SMSF) trustees. We are based in Sydney, Australia. You can contact us about privacy at hello@smsfcore.com.

This policy explains how we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. What this tool is (and is not)

SMSF Core is an information and calculation tool. It is not a licensed financial service and does not provide financial product advice. Information about how we handle your data does not change that — see our Terms of Service.

3. What information we collect

We collect only what we need to provide the service:

  • Account information: your email address (used for passwordless "magic link" sign-in via Supabase Auth).
  • Fund and holdings data you provide: the SMSF entity name you enter, and the share transaction, parcel, and dividend data you upload (e.g. broker CSV exports) or enter, which we use to perform franking and holding-period calculations for you.
  • Billing information: handled by our payment processor, Stripe. We do not store your full card details on our servers; Stripe processes and stores payment information under its own terms.
  • Technical and usage information: limited, privacy-preserving analytics via Plausible, which does not use cookies and does not track you across other websites or build a personal profile. We may also keep server logs (e.g. IP address for rate-limiting and security) for a limited period.

We do not deliberately collect sensitive information beyond the financial data you choose to upload for the tool's calculations.

4. How we use your information

We use your information to:

  • authenticate you and operate your account;
  • perform the franking-credit, 45-day holding-period, and related calculations you request on the data you provide;
  • process your subscription and payments (via Stripe);
  • send you service-related emails (e.g. sign-in links, account and billing notices) via Resend;
  • maintain the security, integrity, and performance of the service; and
  • comply with our legal obligations.

We do not sell your personal information. We do not use your fund data for advertising.

5. Where your data is stored — data residency

Your account and fund data are stored in Supabase's Sydney (Australia) region. We have chosen Australian-region hosting deliberately so that your data stays in Australia. Some service providers we rely on (for example, email delivery, payment processing, and analytics) may process limited information outside Australia in the course of providing their services; where this occurs we take reasonable steps to ensure your information is handled consistently with the APPs.

6. Service providers we share data with

We share information only with providers that help us run the service, under their own privacy obligations:

  • Supabase — database, authentication, and hosting (Sydney region).
  • Stripe — payment processing and subscription billing.
  • Resend — transactional email delivery.
  • Plausible — privacy-preserving, cookieless analytics.
  • Upstash — rate-limiting infrastructure (Sydney region).
  • Vercel / Cloudflare — application hosting and network/DNS.

We may also disclose information where required by law (for example, to a regulator or court).

7. Cookies and tracking

We do not use advertising or cross-site tracking cookies. Our analytics provider (Plausible) is cookieless by design. We may use strictly necessary mechanisms required for sign-in and security.

8. Data retention

We keep your personal information for as long as your account is active and as needed to provide the service, then for any period required to meet legal, accounting, or audit-record obligations. You can ask us to delete your account data (see below); some records may be retained where the law requires.

9. Service providers (subprocessors)

We use a small set of infrastructure providers to run SMSF Core. Each
receives only what its function requires:

| Provider | Function | Data location |
|---|---|---|
| Supabase | Database and authentication | Sydney, Australia |
| Vercel | Application hosting | Global edge; functions in Sydney where configured |
| Stripe | Payments and subscriptions | Global (PCI-DSS); we never see card numbers |
| Resend | Transactional email (sign-in links, receipts) | United States |
| Anthropic | Document-suggestion processing (statement text you upload for suggestions) | United States; API data is not used for model training |
| Upstash | Rate limiting (request metadata only) | Sydney, Australia |
| Sentry | Error monitoring (events pass a PII scrubber before leaving) | United States |
| Plausible | Analytics (cookieless, aggregate only) | European Union |

We do not sell personal information, and no provider receives it for its
own purposes.

10. Security

We take reasonable technical and organisational measures to protect your information, including Australian-region hosting, access controls, and encrypted connections. No system is perfectly secure, but we work to protect your data and to limit who can access it.

11. Your rights

Under the APPs you can:

  • request access to the personal information we hold about you;
  • ask us to correct information that is inaccurate or out of date;
  • ask us to delete your account and associated data, subject to any legal retention requirements;
  • ask how your information is handled.

To make any of these requests, email hello@smsfcore.com. We will respond within a reasonable time.

12. Complaints

If you are concerned about how we have handled your personal information, contact us first at hello@smsfcore.com. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the "Last updated" date. Material changes will be notified where appropriate.

14. Contact

SMSF Core Australia Pty Ltd (ACN 697 503 352)
Sydney, Australia
hello@smsfcore.com