Privacy Policy

1. About this policy

Version 2026.1. Effective 28 October 2026. This Privacy Policy replaces all earlier versions.

This Privacy Policy explains how Cloudfloat Pty Ltd ACN 632 465 082 and its related bodies corporate, including Cloudfloat Holdings Pty Ltd (Cloudfloat, we, us, our), collect, hold, use and disclose personal information. Our address is Tower 1, Level 27, 100 Barangaroo Avenue, Sydney NSW 2000.

It applies to personal information we handle through cloudfloat.com, cloudfloat.com.au, app.cloudfloat.com, app.cloudfloat.com.au, platform.cloudfloat.com and caud.io, the Cloudfloat App for iOS and Android, our payment widget, payment links and APIs, services we provide through partner platforms, and in otherwise running our business.

We are bound by the Privacy Act 1988 (Cth), including the Australian Privacy Principles, Part IIIA (credit reporting) and the Privacy (Credit Reporting) Code. Section 10 is our credit reporting policy.

Businesses and individuals. Information about a company or trust is not personal information. Information about individuals connected with a business is, including sole traders, partners, directors, shareholders, beneficial owners, trustees, guarantors, authorised users, employees and contacts.

How this policy works with our terms. This policy should be read with whichever of these applies to you:

• our Terms of Use, if you use our websites or make a guest payment;
• the Cloudfloat Terms, if you hold a Cloudfloat account; and
• the Payee Terms, if you receive payments through Cloudfloat on a partner platform.

The Terms of Use and the Cloudfloat Terms incorporate this policy, and each says how it applies with this policy. When you apply for an account or give a guarantee, you also give us a privacy consent, including consent to obtain credit reports (section 10).

Funding trusts. Some Cloudfloat facilities and receivables are funded, held or acquired by a funding trust or other financier. Where we act as servicer or manager for that trust or financier, we handle your personal information on its behalf in accordance with this policy.

2. Key points

This summary is for convenience only. The rest of this policy explains each point in full.

• We provide business payments, credit and funding through our websites, the Cloudfloat App and partner platforms. We collect personal information to verify identity, assess credit, process payments, prevent fraud and comply with anti-money laundering and other laws.
• With consent, we obtain credit reports about sole traders, directors and guarantors. We may report late payments, missed payments and defaults to credit reporting bodies (section 10).
• We use computer programs, including our Trust Score Engine and AI tools, to make or help make decisions about identity checks, limits, payments and overdue accounts (section 7).
• Identity checks may use a photo of your face, which is biometric and sensitive information. We only collect it with your consent (section 5).
• For guest payments, Cloudfloat provides the payment service and collects your payment details, not the business you are paying (section 12).
• We share information with service providers, payment networks, partner platforms, funders of our facilities, insurers, credit reporting bodies and regulators. Some are in the USA and the Philippines (sections 8 and 9).
• CAUD transactions are recorded on a public blockchain and cannot be changed or deleted (section 13).
• The Cloudfloat App asks before using your camera, photos or notifications. Face ID and fingerprint sign-in happen on your device, and we never receive that data (section 14).
• We do not sell personal information to third parties for their own marketing.
• You can ask us to close your account and delete your information. We keep some records for as long as the law requires (section 17).
• You can ask to access or correct your information, or make a complaint, at success@cloudfloat.com. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (section 18).

3. Whose information we handle and what we collect

We collect personal information about the people we deal with in providing our services and running our business. They include:

• applicants and account holders, and their sole traders, partners, directors, shareholders, beneficial owners, trustees and authorised users;
• guarantors and people who provide security;
• people who make guest payments for a business, and businesses and their contacts who receive payments through us;
• suppliers paid through our platform, and customers of our customers where an invoice is paid, funded or acquired through us;
• insured customers, insurers and insurance brokers, where we fund insurance premiums;
• staff of our partners, referrers, suppliers and service providers;
• investors in and lenders to Cloudfloat;
• people who visit our websites, use the Cloudfloat App, contact us or receive our marketing; and
• job applicants.

The kinds of personal information we collect depend on how you deal with us:

Card details. Full card numbers are collected and stored by our PCI DSS compliant payment processor. We generally receive only a token and limited card details, such as the card brand, last four digits and expiry date. We do not give your full card details to payees or partner platforms.

If you do not provide information. If you do not give us the information we ask for, or we cannot verify it, we may not be able to provide a service, process a payment or deal with you.

Age. Our services are for businesses and for people aged 18 or over. We do not knowingly collect personal information from children.

4. How we collect it

We collect most personal information directly from you, for example when you apply, sign up, upload documents, make a payment, use our websites or the Cloudfloat App, or talk to us.

We also collect it from others where that is reasonable or required, including:

• the business you are connected with, for example when a company gives us details of its directors or guarantors;
• our customers, for example when a supplier gives us an invoice addressed to you, or a business pays you through us;
• partner platforms, referrers and brokers that pass your details to us to start an application, onboarding or payment;
• credit reporting bodies and other credit providers (section 10);
• identity verification and document verification providers;
• public registers and records, such as ASIC, the Australian Business Register, the Personal Property Securities Register, land title registries, court and tribunal records and the National Personal Insolvency Index;
• accounting software and bank data you choose to connect or share with us;
• payment processors, acquirers, card schemes and card issuers;
• insurers and insurance brokers;
• publicly available online sources, such as business websites, online reviews, professional networking profiles and news, including through search and AI research tools;
• commercial providers of business contact information; and
• our related companies.

When we collect information about you from someone else, we take reasonable steps to make sure you know about it, usually through this policy or the business that gave it to us. If you give us information about another person, you must have their authority to do so and tell them about this policy.

If we receive personal information we did not ask for and could not have collected, we destroy or de-identify it where lawful and reasonable.

Anonymity. You can browse our public websites without identifying yourself. Because of anti-money laundering and credit laws, we cannot provide payment, credit or funding services to you anonymously or under a pseudonym.

5. Sensitive information, including biometric identity checks

We only collect sensitive information with your consent, or where the law requires or allows it.

Biometric identity checks. To verify your identity, we may ask you to photograph your identity document and take a photo or short video of your face. Our identity verification provider compares your face with your document photo and checks that you are a live person. Facial images and templates used this way are biometric information, which is sensitive information.

We ask for your consent at the verification step. We use the results only to verify your identity, prevent fraud and impersonation, and meet our legal obligations. Our identity verification provider may process this information in the USA.

We keep verification records, including images, as part of our customer identification records for as long as anti-money laundering law requires, generally 7 years after our relationship with you ends. We then destroy or de-identify them.

If you do not want to use biometric verification, contact us before you start and we will offer another way to verify your identity. It may take longer.

Other sensitive information. We do not ask for health, religious, racial or similar information. If you choose to give it to us, for example when explaining a payment difficulty, we use it only for the purpose you gave it. Screening results and public records may show criminal or court proceedings. We collect and use that information only where the law requires or allows it, for example to manage fraud, financial crime and credit risk.

6. Why we use personal information

We collect, hold, use and disclose personal information to:

• verify identity and authority, and meet our anti-money laundering, counter-terrorism financing and sanctions obligations;
• assess applications, payment requests, funding requests, limits, guarantors, security, pricing and membership eligibility, including by obtaining credit reports, carrying out card pre-authorisations and other repayment capability checks, and review them over time;
• provide our products, including Pay with Instalments, converting past payments into repayment plans, Working Capital Advances, insurance premium funding, the Cloudfloat Wallet, card payments, invoicing, receivables funding, memberships and CAUD;
• process payments, pay suppliers, settle payees and issue receipts and tax invoices;
• manage accounts, collect amounts owing and enforce our rights, including under security, guarantees and assignments of insurance premium refunds;
• detect, prevent and investigate fraud, scams, chargebacks, disputes and other misconduct;
• fund our business, including through funding trusts, the sale or assignment of receivables and facilities, investor reporting, audits and due diligence;
• comply with the law and respond to courts, regulators and law enforcement;
• provide customer support and send service and transaction messages;
• monitor and record calls and electronic communications for quality control, training and our protection;
• develop, test and improve our products, systems and risk models, using de-identified information where practicable;
• market our products and our partners’ products (section 15);
• manage relationships with partners, suppliers and investors, and consider job applications; and
• for other purposes we tell you about, that you would reasonably expect, or that you consent to.

AI tools. We use AI tools from third party providers to help our team analyse applications and documents, prepare assessments and handle support requests. We use them under business terms that restrict how the provider may use the information we give it. A person in our team remains responsible for the decisions these tools assist with, except where section 7 says a decision is made by a computer program.

7. Automated decision-making

We use computer programs to make, or to do things that are substantially and directly related to making, decisions that could significantly affect individuals. These include our Trust Score Engine, rules-based systems, our identity verification, screening and payment providers’ systems, and AI tools. A decision includes refusing or failing to make a decision.

We do not disclose the logic, weightings or scoring of our models, which are commercially sensitive.

If you think a decision made or assisted by a computer program is wrong, contact us at success@cloudfloat.com and a member of our team will review it.

8. Who we share it with

We disclose personal information for the purposes in section 6 to:

Protection by recipients. We require our service providers, including the analytics and software development kit (SDK) providers in our websites and the Cloudfloat App, and our related companies, to protect personal information to the same or an equivalent standard as this policy. Service providers may use it only to provide services to us.

Information from partner platforms. Where a partner platform gives us your information so we can provide a service through that platform, we use it to provide that service. We do not use it to send you direct marketing unless you have consented or the partner has agreed. Information we collect directly from you, including at our checkout and under our terms, is collected by Cloudfloat and handled under this policy.

Other businesses’ privacy practices. Partner platforms, payees, suppliers and other businesses you deal with have their own privacy policies. We are not responsible for how they handle information you give them directly.

9. Overseas disclosure

Some recipients of personal information are located outside Australia. We are likely to disclose personal information to recipients in:

• the USA, where our cloud hosting, software, payment processing, identity verification, communications and AI service providers are based or process data; and
• the Philippines, where members of our operations and customer support team are based.

Our service providers may also store information in data centres in other countries. Payment networks and card schemes may process payment information internationally.

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including through contracts.

10. Credit reporting policy

This section is our credit reporting policy under Part IIIA of the Privacy Act and the Privacy (Credit Reporting) Code. It applies to credit-related information about individuals, such as sole traders, partners, directors and guarantors. It does not apply to information about companies or trusts.

Our products are for business purposes only. We do not provide consumer credit.

Credit information we collect. We may collect identification information; the fact that you, or a business you are connected with, applied for credit or offered a guarantee, and the amount; information about credit we provide, including repayment history, late payments, missed payments, defaults and overdue amounts; court proceedings and personal insolvency information; publicly available information about your creditworthiness; and information about credit enquiries made about you.

How we collect it. We collect it from you, from the business you are connected with, from credit reporting bodies, from other credit providers with your consent, and from public records. We obtain a credit report about you only with your consent, which we ask for in the privacy consent you give when you apply or give a guarantee.

Credit eligibility information we derive. From credit reports and our own information we derive assessments, ratings and scores, including our Trust Score, about your creditworthiness and your ability to act as a guarantor.

How we hold it. We hold credit-related information electronically in secure systems with access limited to people who need it, as described in section 16.

Why we use and disclose it. We collect, hold, use and disclose credit-related information to:

• assess an application, payment request or funding request made by you or a business you are connected with, and your capability to make payments;
• assess whether to accept you as a guarantor;
• manage the credit, including reviewing limits and collecting overdue amounts;
• deal with funders, purchasers and assignees of our facilities and receivables, and trade credit insurers;
• tell a guarantor or prospective guarantor about the credit they guarantee;
• manage complaints and meet our legal obligations; and
• for any other purpose permitted by Part IIIA.

Credit reporting bodies. We obtain credit reports from, and may report negative activity on your account, including late payments, missed payments and defaults, to the credit reporting body below. It may include that information in reports it gives to other credit providers. Its privacy policy explains how it handles credit-related information.

You can ask a credit reporting body not to use your credit reporting information for pre-screening of direct marketing by credit providers. If you believe you have been, or are likely to be, a victim of fraud, including identity fraud, you can ask a credit reporting body not to use or disclose your credit reporting information for a period.

Access. You can ask for access to the credit eligibility information we hold about you. We do not charge for making a request. We respond within 30 days and, if we refuse access, we tell you why in writing.

Correction. You can ask us to correct credit-related information that is inaccurate, out of date, incomplete, irrelevant or misleading. We respond within 30 days, unless you agree to a longer period, and may consult a credit reporting body or another credit provider. We tell you in writing whether we have made the correction and, if not, why.

Complaints. You can complain about a breach of Part IIIA or the Credit Reporting Code using the details in section 18. We aim to acknowledge complaints within 5 business days and resolve them within 21 days. For credit reporting complaints, we will in any case acknowledge your complaint within 7 days and give you our decision in writing within 30 days, unless you agree to a longer period. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner.

Overseas. We are likely to disclose credit-related information to team members and service providers that do not have an Australian link, in the countries listed in section 9. Before we do, we take reasonable steps to ensure they handle it in accordance with the Privacy Act.

11. Identity verification and anti-money laundering

We are a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). We must identify and verify our customers and their beneficial owners and authorised people, screen them against sanctions and politically exposed person lists, monitor transactions and keep records. This applies to account holders and, where needed, to people making guest payments.

Verification using a credit reporting body. When you give us your name, residential address and date of birth to verify your identity, you consent to us disclosing them to a credit reporting body and asking whether they match personal information the body holds. The body may give us that assessment and may use your personal information, and the names, residential addresses and dates of birth of other individuals, to prepare it. If we cannot verify your identity this way, we will tell you in our platform or by email. If you do not want us to verify your identity this way, contact us and we will offer another method.

Reports to AUSTRAC. We may be required to report suspicious matters and certain transactions to AUSTRAC. The law may prevent us from telling you that we have made a report.

Records. We keep identification and transaction records for as long as the law requires, generally 7 years after our relationship with you ends or the transaction occurs.

12. Payments, chargebacks and payees

Guest payments. When you pay an invoice for a business through our payment widget or a payment link, including on a partner platform, Cloudfloat provides the payment service and collects your information. We collect your name, email address, the business you are paying for and its ABN, payment and card details, the invoice and payee details shown to you, and technical information.

For each payment we record evidence of the payment, including acceptance of our Terms of Use, the date and time, IP address and device information, 3-D Secure authentication results, and the payee and invoice details displayed. We use and disclose that evidence, and information about any chargeback, to card schemes, the card issuer, the payee, the partner platform and our payment processors to respond to and resolve chargebacks and recover amounts owing.

We send the receipt to the email address given in the widget. The payee receives the payment details it needs to reconcile and account for the payment.

Account holders. If a charge we make to your card is disputed or charged back, we share information relevant to the dispute with the card issuer, our payment processor, the card scheme and the supplier.

Payees. If you receive payments through Cloudfloat, we handle information about you and your payers under this policy. We may share information about you, your payments, chargebacks and recoveries with the partner platform you use, our acquirer, card schemes, regulators, law enforcement agencies and fraud prevention services. We may confirm to the partner platform that you have accepted our Payee Terms, including who accepted them, which version and when. We do not give the partner platform your bank account or direct debit details.

13. CAUD and public blockchain records

CAUD is a digital token recorded on the Polygon public blockchain. When you hold or transfer CAUD, the wallet addresses, amounts and times of each transaction are recorded on that blockchain. Anyone can see this information, and it is copied across computers around the world.

We do not put your name or other identity details on the blockchain. We do keep records that link your wallet address to your Cloudfloat account and identity, as anti-money laundering law requires.

Blockchain records are permanent. We cannot correct or delete them, including if you ask us to. We can correct and delete the records we hold off the blockchain, subject to our legal obligations.

14. Mobile apps

The Cloudfloat App for iPhone and Android collects the same kinds of information as our websites, plus the device information below. This policy is linked from our App Store and Google Play listings and from within the app.

Software development kits. The app includes software from our service providers for identity verification, payments, analytics, crash reporting and notifications. These providers collect information through the app on our behalf, as described in section 8.

Tracking. The app does not track you across apps and websites owned by other companies for advertising. If this changes, we will ask your permission first, including through Apple’s App Tracking Transparency prompt on iPhone.

App stores. Apple and Google collect information when you download and use apps, under their own privacy policies. We receive limited information from them, such as download numbers, ratings and crash reports.

The App Privacy details on the App Store and the Data safety section on Google Play summarise how the app handles data. This policy gives the full detail.

15. Marketing, cookies and advertising

Marketing. We may send you information about our products and services, and those of our partners, by email, SMS, phone, in our platform or the Cloudfloat App, or by post, unless you have told us you do not want it. We send electronic marketing in accordance with the Spam Act 2003 (Cth). You can opt out at any time by using the unsubscribe link in a message, updating your preferences in your account, or contacting us. We process electronic opt-outs within 5 business days. We will still send you service, transaction and account messages after you opt out.

We may obtain business contact details of people at businesses that could benefit from our services from public sources and commercial data providers, and contact them about our services. You can ask us to stop at any time.

Cookies and similar technologies. Our websites, the Cloudfloat App and our payment widget use cookies, pixels, local storage and similar technologies. We use them to:

• keep you signed in and keep our services secure;
• detect and prevent fraud, including through our payment processor;
• remember your preferences;
• measure and improve how our websites and services are used, including through Google Analytics; and
• measure and show advertising on our websites, through advertising providers such as Google.

You can set your browser to refuse or delete cookies. If you do, parts of our services, including sign-in and payments, may not work. We do not currently respond to browser Do Not Track signals.

Advertising and analytics opt-outs. You can control Google’s use of your information through Google’s ad settings and opt out of Google Analytics with the Google Analytics opt-out browser add-on. Advertising and analytics providers may process information outside Australia.

Third party websites. Our websites may link to other websites. We are not responsible for their privacy practices.

16. Security, retention and data breaches

Security. We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, modification and disclosure. These include measures such as encryption, access controls limited to people who need the information for their role, logging and monitoring, staff confidentiality obligations, and security terms in contracts with service providers. No system is completely secure, so we cannot guarantee the security of information.

Retention. We keep personal information only for as long as we need it for the purposes in this policy or the law requires. Anti-money laundering, tax, corporations and credit laws generally require us to keep records for 5 to 7 years after our relationship with you ends or a transaction occurs. When we no longer need information, we take reasonable steps to destroy or de-identify it.

Data breaches. If a data breach involving your personal information is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

Protect yourself. Keep your login details and devices secure. We will never ask for your password or one-time codes by email, SMS or phone. If you receive a message claiming to be from Cloudfloat that asks you to change bank details or pay a different account, contact us before acting on it.

17. Deleting your account and data

You can ask us to close your Cloudfloat account and delete your personal information at any time. You do not need to install the Cloudfloat App to do this. You can make a request:

• in the Cloudfloat App, from your account settings; or
• by email to success@cloudfloat.com with the subject “Delete my account”, sent from the email address on your account.

We verify your identity before acting on a request and confirm when it is done. Because we provide regulated financial services, a member of our team may contact you to complete the request.

When we can close your account. Under the Cloudfloat Terms, we close your account once all amounts you owe us, including any Late Fees, are paid and no disputes or refunds are in progress. Until then we keep your account open for those matters only. Closing your account does not cancel any amount you owe or any guarantee you have given.

What we delete and what we keep. We aim to delete or de-identify personal information we no longer need, such as your profile, preferences, device and app data and marketing records, within 30 days after your account closes. The law requires us to keep some information after that:

Funders and purchasers of our facilities or receivables may also keep records under their own legal obligations. When a retention period ends, we destroy or de-identify the information.

Deleting some information. You can also ask us to delete specific information without closing your account, such as a document you uploaded or your marketing preferences, where we do not need to keep it.

18. Access, correction, complaints and contact

Access and correction. You can ask for access to the personal information we hold about you, or ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. We respond within 30 days. We do not charge for making a request, but may charge a reasonable fee for giving access where the request is complex. If we refuse a request, we tell you why in writing and how to complain. If we do not agree to a correction, you can ask us to attach a statement to the information. Access and correction of credit-related information is covered in section 10.

Withdrawing consent. Where we rely on your consent, you can withdraw it at any time. You can unsubscribe from marketing, turn off app permissions, notifications and biometric sign-in in your device or app settings, and tell us if you no longer consent to credit checks for future reviews. Withdrawing consent does not affect what we did before, or information the law requires or allows us to keep and use. If you withdraw a consent we need to provide a service, such as identity verification or a credit check, we may not be able to continue that service.

Complaints. If you have a complaint about how we have handled your personal information, email us with the details. We aim to acknowledge complaints within 5 business days and resolve them within 21 days. If we need longer, we will tell you why and when we expect to resolve it. Complaints about credit reporting are handled as set out in section 10.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes to this policy. We may update this policy by publishing a new version on our website. The version and effective date appear at the top. We may also notify account holders of significant changes by email, in our platform or in the Cloudfloat App.

Contact us.

Attention: Privacy Officer, Cloudfloat Pty Ltd
Email: success@cloudfloat.com
Post: Tower 1, Level 27, 100 Barangaroo Avenue, Sydney NSW 2000

You can ask for a copy of this policy in another form, free of charge.