Home/ Privacy Policy
Trust & Legal
Your privacy, in plain English.
We built InvestHAQ on one promise: factual data. That promise extends to how we treat your information: we collect as little as possible, we never sell it, and nothing about you reaches a fund manager without your say-so. This page explains exactly what we hold, why, and the choices you always have.
1.Who we are
This Privacy Policy is issued by InvestHAQ Pty Ltd (ABN 24 698 040 907), referred to here as InvestHAQ, we and us. We run investhaq.com.au, Australia's independent comparison and education platform for Shariah compliant investments. We publish factual information only: we do not give financial advice, and we do not hold an Australian Financial Services Licence.
We hold ourselves to strong Privacy Principles, not because our size obliges us to, but because you would rightly expect nothing less from a platform built on trust. Our starting point is simple: the best-protected data is the data we never collected.
2.What we collect, and why
Every piece of information we ask for exists to make a specific feature work. Here is the complete picture:
| What | When | Why |
|---|---|---|
| Account details: email, name, address, age bracket, gender, and whether you are a retail investor, wholesale investor, adviser or accountant | When you register | To run your account, show you the right content for your investor type, and understand our audience as a whole |
| Wholesale certification evidence: your accountant's certificate and declarations | Only if you certify as a wholesale or sophisticated investor | The law requires this before wholesale content can be shown. We treat it as our most sensitive data and guard it accordingly |
| Your saved work: comparisons, calculator scenarios, watchlists | When you save them | So they are waiting for you when you come back |
| Communication preferences: newsletter, alert and reminder subscriptions | When you subscribe | So we send you only what you asked for, and can prove it |
| Finance enquiry answers: the Looking for Finance form | If you submit an enquiry | Covered by the collection statement on that form. Section 5 explains the strict rules on who can ever see those answers |
| Usage data: pages visited, features used, technical logs | Automatically, as you browse | To keep the site fast, secure and improving, measured with privacy-friendly analytics rather than advertising trackers |
Before any new question is added to any form, it has to survive one test: do we genuinely need this? 'Nice to have someday' does not make the cut.
3.How we collect it
- Directly from you: when you register, save a comparison, subscribe, submit an enquiry or get in touch.
- Automatically: standard technical logs, plus site analytics from a privacy-friendly service. No advertising trackers, or other trackers, no exceptions.
That is the full list. We do not buy data about you, and we do not fill in the blanks from outside sources. What you choose to tell us is all we know.
4.Cookies
Cookies on InvestHAQ come in three flavours, and you decide which ones run. One click rejects everything non-essential, and we remember your choice for next time.
| Category | What it does | Your control |
|---|---|---|
| Necessary | Keeps you signed in, keeps the site secure, and remembers your cookie choice itself | Always on; the site cannot work without them |
| Analytics | Tells us, in aggregate, which pages help and which confuse | Runs only if you say yes |
| Marketing | Tells us whether our own campaigns actually work | Runs only if you say yes |
The full list of cookies in each category is kept up to date on this page, and you can revisit your choice any time via cookie preferences. We keep a record of what you agreed to and when, so if you ever ask, we can show you.
5.Who ever sees your information
Our default answer is: nobody. The exceptions are few, explicit, and every one of them happens only because you chose it:
- Fund managers and financial professionals: never without your explicit consent. If a feature connects you with a fund manager, adviser or accountant, we tell you exactly what would be sent and to whom, and nothing moves until you agree, on that occasion.
- Finance referral partners. If you submit a Looking for Finance enquiry and tick the referral consent, only the fields marked for referral on that form go to a licensed partner. Answers marked research-only never leave InvestHAQ, consent or no consent.
- Service providers. The companies that host our infrastructure and deliver our email act on our instructions, under contract. Any of them that touches personal information is listed in section 6.
- The law. If an Australian law or court order requires disclosure, we comply, and only to the extent required.
And one line we will never need to rewrite: we do not sell personal information. Ever.
6.Overseas disclosure
Your data lives in Australia. Our database, backups, file storage and search indexes all sit in Australian regions. Data may pass through a global content delivery network in transit, but it is not stored overseas.
If we ever engage a provider that processes personal information outside Australia, we will name it on this page before it handles a single record: who it is, what it does for us, which country it processes in, and what information it touches. A vague 'we may use overseas providers' is not how we do things.
7.Where your data lives, and how it is protected
- Stored in Australian cloud regions, encrypted at rest and in transit.
- Wholesale certification documents sit in separately encrypted storage with tightly restricted access.
- Administrative access is limited to the few who need it, protected by multi-factor authentication, and every admin action on user data is written to a tamper-proof audit log.
Australian data residency is a commitment of this platform, not a hosting default. That is why section 6 works the way it does: any exception has to be named there before it can exist.
8.How long we keep it
Nothing is kept 'just in case'. Every class of data has a defined lifespan, and deletion is carried out automatically by the system. The table below is a schedule we execute, not an aspiration.
| Data | Kept for | Why |
|---|---|---|
| Your account | As long as you keep it, plus a 30-day recovery window after deletion | Deletion is soft for 30 days in case you change your mind, then it is permanent |
| Saved comparisons and calculator scenarios | Until you delete them, or your account | They exist for you; they leave when you do |
| Wholesale declarations and related records | 7 years | The law treats these as compliance evidence, so they outlive account deletion |
| Admin audit log | 7 years, append-only | Our accountability record: for regulators, and for you |
| Marketing analytics | 14 to 25 months | Trends need recent data, not your history |
9.Your rights and controls
- Access and correction. Ask us what we hold about you and have anything inaccurate corrected. Just contact us (section 13); we respond within 30 days.
- Deletion: self-serve, today. Delete your account yourself from account settings, no questions asked. It stays recoverable for 30 days, then it is gone for good. The one exception: wholesale declaration records, which the law requires us to keep (section 8).
- Export. A one-click download of your data is on its way. Until it ships, email us and we will send you everything we hold within 30 days.
Exercising any of these rights costs nothing, and you never need to give a reason.
10.Emails from us
- We email you commercially only if you asked us to. Consent is captured when you subscribe, never assumed.
- Every commercial email carries a one-click unsubscribe, honoured within 5 business days, and our postal address, as the Spam Act 2003 requires.
- We keep a per-person record of every consent: what you agreed to, the exact wording you saw, and when. If you ever wonder 'did I sign up for this?', we can answer precisely.
11.If something goes wrong
We maintain a rehearsed response plan under Australia's Notifiable Data Breaches scheme. If a breach ever occurs that could seriously harm you, we will tell you and the Office of the Australian Information Commissioner (OAIC): promptly, in plain language, and with clear steps you can take. No burying it in fine print.
12.Complaints
If you think we have mishandled your information, tell us first (section 13). We acknowledge complaints within 7 days and respond in full within 30. If our answer does not satisfy you, you can take it to the OAIC at oaic.gov.au or on 1300 363 992. We would rather fix it ourselves, but the escalation path is yours to use.
13.Contact us
Privacy questions, access or correction requests, complaints: all welcome.
- Email: [email protected]
14.Changes to this policy
When this policy changes, the version and date at the top change with it, and every published version is archived. We can always show you the exact wording that was in force when you accepted it. If we make a material change, we will announce it on the site, and registered users may be asked to review and accept the updated policy at their next sign in.
Earlier versions are available on request, just ask via section 13.