Privacy Policy

Last updated: 19 August 2026

Cassandra Research Pty Ltd (“Cassandra”, “we”, “us”) operates the Cassandra Tax practice-management platform and public website. This policy explains how we handle personal information when providing the platform, client portal, support, security, billing, and configured tax-lodgement services.

We handle personal information in accordance with applicable Australian law, including the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the Privacy (Tax File Number) Rule 2015. Registered tax agents and accounting practices using Cassandra Tax remain responsible for their own privacy, professional, client-authority, and record-keeping obligations.

1. Scope and the information we collect

• Account and practice information, including names, email addresses, phone numbers, organisation details, roles, permissions, and subscription records.
• Client and tax information supplied by an authorised practice or client, including Tax File Numbers (TFNs), Australian Business Numbers (ABNs), identity and contact details, bank account details, source documents, workpapers, tax-return data, declarations, and signatures.
• Connected-service information retrieved at an authorised user's request, such as accounting data, ATO responses, lodgement receipts, and e-signature status.
• Authentication and security information, including password verifiers, multi-factor authentication records, session records, access events, and fraud-prevention signals.
• Technical and support information, including IP address, device and browser details, diagnostic events, audit logs, support correspondence, and uploaded-file security scan results.

We collect this information directly from account holders, authorised practice users and client-portal users; from configured accounting, identity, signing, billing, and ATO services when an authorised user initiates a workflow; and automatically through essential security, session, and diagnostic technologies. Please do not provide personal information that is not reasonably necessary for the relevant workflow.

2. How we use your information

• To provide, administer, support, and secure Cassandra Tax.
• To prepare, validate, review, sign, and manage authorised tax workflows.
• To transmit information to the ATO or another connected service only when an authorised workflow requires it.
• To process subscriptions, communicate service messages, and respond to support.
• To investigate abuse, prevent fraud, respond to incidents, and maintain audit evidence.
• To comply with legal obligations and exercise or defend legal rights.

The platform may produce deterministic, rules-based review flags to assist an authorised professional. Those flags are not final tax advice and do not make decisions that determine a person's rights. A qualified human remains responsible for reviewing the return and authorising any lodgement.

3. Tax File Number handling

We collect a TFN only where it is reasonably necessary for an authorised taxation, superannuation, or personal-assistance purpose permitted by law. The application encrypts TFNs at the application boundary, limits access by tenant and permission, and uses encrypted transport when an authorised workflow transmits them. We do not use or disclose TFNs as general-purpose identifiers. We securely destroy or de-identify TFN information when it is no longer required by law or for a permitted purpose.

4. Storage and security

• Designated sensitive database fields, including TFNs and tax-return payloads, are encrypted at the application layer; configured providers also protect data in transit and at rest.
• Access is governed by organisation boundaries, role-based permissions, and MFA.
• Authenticated staff sessions expire after a bounded period of inactivity. The production default is no more than 30 minutes and may be configured shorter.
• Uploads are private and must pass configured content and malware checks before use.
• Security-relevant actions are recorded in tenant-scoped audit trails.

No internet service is risk-free. If you believe your account or information has been compromised, contact security@cassandratax.com promptly.

5. Disclosure and overseas recipients

We disclose personal information only as reasonably necessary to provide an authorised service, with consent, or where required or permitted by law. Recipient categories may include:

• the ATO and other Australian government services used in an authorised tax workflow;
• hosting, managed database, private object-storage, security scanning, caching, and error monitoring providers;
• transactional email and SMS providers used for account and security messages;
• billing and e-signature providers selected for the practice; and
• accounting platforms such as Xero, MYOB, or QuickBooks when a practice connects them.

The provider used, data disclosed, and processing location depend on the services and region configured for the practice. Likely overseas recipient locations for supported providers include the United States and New Zealand; globally distributed network, security, and support services may also process limited account or technical information in other countries. Contact us for the current configured subprocessor and country schedule before enabling a service if data location is material to you. We do not sell or rent personal information.

6. Retention and deletion

We retain personal information only while it is needed to provide the service, meet legal, professional, security, dispute, and backup obligations, or maintain an authorised record. The application is designed to retain ATO-relevant lodgement and audit evidence for seven years. Other retention periods depend on the record type, the practice's instructions, and applicable law. Deletion from active systems may not immediately remove encrypted backup copies, which expire under the applicable backup schedule.

7. Data breaches

We investigate suspected breaches promptly. Where there are reasonable grounds to suspect an eligible data breach, we will complete a reasonable and expeditious assessment within 30 calendar days. If we reasonably believe an eligible data breach has occurred, we will notify the Office of the Australian Information Commissioner and affected or at-risk individuals as soon as practicable, as required by Part IIIC of the Privacy Act.

8. Access, correction, deletion, and complaints

To request access to or correction of personal information, ask about retention or deletion, or make a privacy complaint, email privacy@cassandratax.com. Please describe the information or concern and your relationship to the relevant practice. We may verify your identity and authority before disclosing or changing information. Where a practice controls the client record, we may refer the request to that practice.

We will acknowledge a complaint, investigate it fairly, and respond within a reasonable period. If you are dissatisfied with our response, you may complain to the Office of the Australian Information Commissioner.

9. Cookies and similar technologies

Cassandra Tax uses essential cookies and local browser storage for authentication, security, navigation, and user preferences. Optional analytics or monitoring operates only when enabled for the deployment. Blocking essential cookies may prevent secure areas of the platform from working.

10. Contact, accessibility, and changes

Contact privacy@cassandratax.com for privacy questions, the current configured subprocessor schedule, or this policy in an alternative accessible format. We will post updates here and notify account holders of material changes where appropriate.