Privacy Policy
In short. Stow is software that financial advisory firms use to share information with their clients. Your adviser’s firm decides what goes into Stow about you; we host and protect it. We don’t sell personal information, we don’t use it for advertising, and we keep it in Australia.
If you are a client of a firm using Stow, that firm is the primary holder of your information and has its own privacy policy. This policy explains what Stow itself does.
1. Who we are
The Stow app, adviser portal and stow-app.com are operated by Stow (ABN 18 427 996 259) (“Stow”, “we”, “us”). We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Our contact details are in section 11.
2. Who this policy covers
- Clients — people invited by their financial adviser to use the Stow app.
- Advisers and firm staff — people who use the Stow adviser portal on behalf of a licensed firm.
- Visitors — people who browse stow-app.com or join the early-access list.
3. What we collect
Clients
- Identity and contact details — name, email address, mobile number, date of birth.
- Identity documents you upload during onboarding (for example a driver licence or passport), and the details extracted from them, where your firm requires this.
- Financial information your firm loads or you provide — the entities you hold (individual, SMSF, trust, company), portfolio holdings, valuations, performance and goals.
- Documents and messages shared between you and your firm through Stow.
- Account and security data — password (stored only as a one-way hash), two-factor and biometric settings, sign-in times, device type and IP address.
- Consent records — which version of this policy and the Terms you accepted, when, and from which device.
Advisers and firm staff
- Name, work email, phone, role, profile photo, and where used, your Google Workspace or Microsoft account identifier for single sign-on.
- An audit trail of actions taken in the portal (sign-ins, client records viewed or changed, documents accessed), kept for the firm’s compliance obligations.
Visitors
- Name, email and firm name if you join the early-access list.
- Name, email, and optionally your firm, phone number and message, if you contact us through the website’s contact form.
- Basic technical logs (IP address, browser, pages requested) needed to run and secure the website.
- Website usage statistics from Google Analytics on this marketing site only: pages viewed, device and browser type, approximate location and how you arrived. Analytics cookies are only set if you choose Accept in the cookie banner; if you decline, or your browser sends a Global Privacy Control signal, Google Analytics receives only anonymous, cookie-free measurements. You can change your choice at any time with Cookie settings at the bottom of every page. Analytics is not used in the Stow portal or app, and we do not use advertising or cross-site tracking cookies.
4. How we collect it
Mostly from you directly (onboarding, forms, uploads) and from your firm (the records they load about you). We may also receive information from identity-document processing that runs inside Stow, and from service providers listed in section 7.
5. Why we collect and use it
- To provide the service: showing you your portfolio, documents and messages, and letting your firm keep your records up to date.
- To verify identity where your firm requires it, and to keep a record that you did so.
- To secure accounts — sign-in, two-factor authentication, fraud and abuse detection, rate limiting.
- To send transactional messages — invitations, verification codes, password resets, and notifications your firm sends you through Stow.
- To support firms with their legal obligations, including record-keeping under financial services and anti-money-laundering laws.
- To improve and troubleshoot the service, using aggregated or de-identified data wherever possible.
We do not use your information for direct marketing, we do not sell it, and we do not use it to train artificial-intelligence models. Where a firm uses Stow’s AI-assisted import mapping, only column headings and masked sample shapes are sent to the model — never actual client values.
6. Who we share it with
- Your firm. Everything in your Stow account is visible to the firm that invited you; that is the point of the service.
- Service providers who help us run Stow (section 7), under contracts that limit them to acting on our instructions.
- Regulators, courts or law enforcement where the law requires or permits it.
- A successor if Stow is sold or merged, on the same terms as this policy.
We never share information with third parties for their own marketing.
7. Service providers and overseas disclosure
Stow’s application and database are hosted in Sydney, Australia. Some providers we use may process limited information outside Australia:
- Hosting and storage
- DigitalOcean (Sydney). Backups are stored encrypted and retained for 14 days.
- Transactional email
- Resend (United States) — receives your email address and the content of the message being sent to you.
- Error monitoring
- Sentry (data stored in the European Union, Germany; a United States company) — receives technical error details from Stow’s app, portal and this website with personal information removed. On this website it uses no cookies and stores nothing on your device.
- Adviser sign-in
- Google and Microsoft, only when a firm chooses to sign in with those accounts.
- Firm subscriptions
- Stripe (United States) — the firm’s billing contact and payment details, never client data.
- Website analytics
- Google Analytics (United States) — usage statistics from this marketing site only, never portal, app or client data.
Where information leaves Australia we take reasonable steps to ensure the recipient handles it consistently with the APPs.
8. How we protect it
- Encrypted in transit (TLS) and at rest; bank account details and authenticator secrets are additionally encrypted at the field level.
- Passwords are stored as salted bcrypt hashes and never logged.
- Two-factor authentication is mandatory for every adviser and staff account.
- Every firm’s data is isolated from every other firm’s at the database layer.
- Access by our own staff is limited to what is needed to operate and support the service, and is logged.
No system is perfectly secure. If a data breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
9. How long we keep it
We keep your information for as long as your firm maintains your account. When a firm removes a client, the record is held in a 60-day recoverable state and then permanently deleted, except for the minimal audit and consent records the firm needs to keep for its regulatory obligations (generally seven years under Australian financial services law). Backups roll off within 14 days of deletion.
10. Your rights
- Access and correction. You can see and update most of your details in the app. You can also request a copy of everything Stow holds about you, and ask us to correct anything inaccurate.
- Deletion. Ask your firm to remove your account, or contact us; we will honour the request subject to the retention obligations above.
- Consent. You can withdraw optional consents (for example biometric sign-in) at any time in the app’s settings.
- Complaints. Contact our privacy officer (section 11). We aim to respond within 30 days. If you are not satisfied you can complain to the OAIC at oaic.gov.au.
11. Contact
Privacy Officer, Stow (ABN 18 427 996 259)
privacy@stow-app.com
12. Changes
We may update this policy. The version date at the top changes when we do, and clients are asked to accept material changes the next time they sign in. Earlier versions are available on request.