Privacy Policy

1. About Us

Stash Me Ltd, trading as Brolly (ABN: 34 676 699 531), is an Australian fintech that facilitates peer-to-peer lending between borrowers and yield-seeking lenders. Our platform is built around transparency, data security, and responsible credit decisioning.

This Privacy Policy describes how we handle your personal information in accordance with:

• The Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs)

2. Scope

This policy applies to personal information we collect when you:

• Use the Brolly platform (website, app)
• Interact with us via email, social media, or other channels
• Participate in our referral programs
• Apply for or use our financial services
• Are a lender, borrower, partner, or prospective employee

3. What We Collect

• Identity & Contact Info: Name, date of birth, email, phone, address
• Government IDs (AU only): Driver's licence, Medicare, passport (for KYC)
• Financial Details: Income, bank account data, employment, credit behavior
• Behavioral & Interaction Data: Spending, repayment, referrals, communications
• Digital Data: IP address, device ID, location, cookies, analytics
• Sensitive Info: Health or hardship details (with consent)
• Referrals: Contacts you refer (with their consent)

4. How We Collect

We collect information:

• Directly from you when you create an account or apply for a loan
• Automatically via cookies, device usage, and analytics tools
• Through third-party tools (e.g., FrankieOne, Basiq, Monoova)
• From publicly available sources or marketing partners
• Via referral programs, promotions, or social interactions

5. Why We Collect

We collect and use your information to:

• Provide you with our lending and investment services
• Verify identity, conduct creditworthiness assessments
• Monitor and improve our platform’s functionality
• Ensure compliance with legal and regulatory obligations
• Detect and prevent fraud or misuse
• Contact you with service updates or offers (with your consent)
• Generate aggregated, anonymised insights for reporting and strategy

6. Direct Marketing

We may send you marketing communications about our products or services. You may opt out at any time by clicking unsubscribe or contacting us directly.

7. Cookies & Tracking

We use cookies, pixels (e.g., Google, Facebook, LinkedIn), and analytics to:

• Understand how users interact with our services
• Personalise your experience
• Improve performance and security

You can disable cookies through your browser, but the platform may not work as intended without them.

8. Who We Share Your Information With

We may share your data with:

• Our affiliates, employees, and professional advisers
• Service providers (e.g., cloud storage, KYC/AML, analytics, payments)
• Referral and marketing partners (aggregated/anonymised only)
• Legal, regulatory, or law enforcement agencies where required
• Prospective investors or acquirers (under NDA/confidentiality)
• Entities you authorise (e.g., if you are referred by a friend)

We do not sell your personal information.

9. Overseas Transfers

Your data may be stored or processed in countries including Australia, the US, UK or others where our partners operate. We ensure these jurisdictions maintain comparable privacy standards or that safeguards (e.g., standard contractual clauses) are in place.

10. How We Protect Your Data

We take reasonable steps to secure your personal information, including:

• Encryption and secure cloud services
• Access controls and audit trails
• Monitoring and incident response processes
• Secure data destruction or anonymisation when no longer needed

11. Access, Correction & Your Rights

You may request access to your personal data or correction if it’s inaccurate.

Depending on your jurisdiction, you may also have rights to:

• Withdraw consent
• Request deletion or restriction of your data
• Request a copy of your data (data portability)
• Lodge a complaint with a regulator (e.g., OAIC, ICO, or CPPA)

12. Referral Programs

If you refer someone to Brolly, you confirm you have their consent to share their details. We may send them a message on your behalf and store that info to track program success.

13. Children’s Privacy

Our services are not directed to children under 18. We do not knowingly collect information from anyone under this age.

14. Complaints

To make a complaint or request, contact us at:

Email: hello@thebrolly.app

If unresolved, you can escalate to:

Office of the Australian Information Commissioner (OAIC) – www.oaic.gov.au