CGTDesk
Log in

Privacy Policy

Version 2026-10-21

1. Who we are

CGTDesk is operated by CGTDesk, ABN 85 285 778 251 ("we", "us" or "our"). This policy explains how we collect, use, disclose, store and protect personal information, and how you can contact us about it. For what the service does and does not do, see the Terms of Use.

2. What we collect

  • Your account: your email address and an account id. Sign-in is managed by our sign-in provider (Supabase); we do not have access to your password in readable form. The provider also keeps sign-in records such as the time of sign-in, so the account stays secure.
  • Your statements and results: the broker statement files you upload, what we read from them, your answers to the questions we ask about gaps, and the reports we produce. These are personal financial records. Depending on the file, a statement can include your name, contact details, account numbers, holdings, transactions, fees and other financial information.
  • What you do on the site: a short record of actions, such as a case created, files uploaded, a data check or calculation run and how it ended (passed or blocked, and the kinds of problem found), a calculation requested or an account deleted. It holds ids, codes and counts, not statement contents. We also add these up, without names, to see how the service is used.
  • Technical records: limited logs to run, fix and protect the service. We set them up to avoid recording statement contents, file names, amounts and email addresses.
  • Payments: a record of each purchase (the years, the amount, the dates and Stripe's references). Stripe takes the payment and holds your card and billing details.
  • Messages to us: what you send to support@cgtdesk.com or hello@cgtdesk.com, including your email address, your message and any attachment.
  • What you accept: which version of the terms and policy you agreed to, and when.

Our staff do not read your statements or results. If you write to us for help, we can see the activity record above for your case. We can read what your data check said about your data only if you switch on “Let support view this case” for that case. It lasts 7 days, you can switch it off sooner, and each time we look is recorded.

We ask you to start from the file your broker exports, in its original layout, so a statement may contain more than we need, such as a Tax File Number (TFN). We do not use a TFN or any identifier on a statement for anything other than reading your trades, and we keep it secure like the rest of your statement.

3. Why we use it

We use your information to:

  • sign you in and keep your account secure;
  • read and check your statements, and calculate and show your results;
  • take payment, and keep a record of what you have unlocked;
  • send the email that tells you results are ready, and other notices about the service or these policies;
  • answer your questions, handle complaints and disputes, and prevent fraud and misuse;
  • meet our legal and record-keeping obligations.

We do not sell your information, and we do not use it for advertising. No artificial intelligence service reads your statements or results: they are read and calculated by our own software, and we do not use your data to train AI models.

4. Who handles it for us, and where

We use these types of service provider to run CGTDesk:

  • sign-in, a database and private file storage (Supabase);
  • cloud hosting for the website and the calculation service (Microsoft Azure);
  • email delivery for the results-ready message and sign-in emails (Resend). The results email holds a link and no amounts;
  • payments (Stripe): when you buy a year, Stripe takes the payment and holds your card and billing details. We receive limited payment information: the payment status, the amount and a payment reference. We do not receive or store your full card number or card security code.

Your account, statements and results are stored and processed in Australia (Sydney). Two providers may handle limited information outside Australia: Resend, which delivers email, may process your email address in the United States, and Stripe, which takes payments, may process payment and billing details overseas under its own privacy policy. We may also share information when the law requires it.

5. How long we keep it, and deleting it

  • A case, with its statements, results and records, is kept until you delete it, or for 24 months after it last changed, and is then deleted automatically.
  • You can delete a case from the site at any time, or ask us to delete your account. Deleted information is removed from our live systems.
  • Backup copies are kept for up to 2 years and then removed. If a backup is ever restored, we delete again anything you had already deleted.
  • A record of each purchase (your account id, the years, the amount, the dates and Stripe’s references) is kept for up to 2 years for tax and record keeping, even if you delete your account. It holds no file names or statement content.
  • A short record of actions, with internal ids and counts only, is kept as proof that a deletion happened. It can be linked back to an account through other records, so we treat it as personal information, restrict who can see it, and remove it after the same 2 years.
  • If you cannot sign in, contact us. We may need to confirm who you are before we show, correct or delete information.

6. How we protect it

Statements are kept in private storage. Other users cannot reach them: every request checks that the case belongs to the signed-in account. Our own staff and our service providers can reach your information only as far as needed to run, support and secure CGTDesk. Our cloud providers encrypt data in transit and at rest. Secrets are kept out of the code and the logs. No system is perfectly secure, so we also ask you to keep your own login details safe.

7. Cookies

We use the cookies and similar technologies needed to keep you signed in and to keep the service secure. We do not use advertising or analytics cookies or trackers.

8. Your choices, and complaints

You can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete it. Most of this you can do yourself in the app. For anything else, contact us at hello@cgtdesk.com. We may need to confirm who you are first, and if we cannot do what you ask, we will tell you why.

To make a complaint, write to hello@cgtdesk.com. We will reply within 30 days. If it is still unresolved, you may contact the Office of the Australian Information Commissioner at oaic.gov.au. Whether the OAIC can look into a matter depends on the laws that apply to it.

9. Changes to this policy

We may update this policy. The version at the top shows which one applies, and a change takes effect on the date we state. If a change matters to you, we will tell you. We will not use information you have already given us for a new purpose without telling you, and asking for your agreement where the law requires it.

10. Contact

Privacy questions and complaints: hello@cgtdesk.com. Product help: support@cgtdesk.com.