1. Who we are
App-Li is operated by Tana Digital (ABN 60 666 266 815) ("we", "us", "our"). App-Li is an AI-powered form intelligence platform that pre-fills compliance forms from a saved profile, built for compliance-heavy Australian industries.
We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what personal information we collect, why we collect it, how we protect it, and your rights in relation to it.
Privacy contact: alexo@tanadigital.au
2. What we collect
Account information
- Email address and authentication credentials (managed by our hosting provider, Supabase).
Profile information you choose to provide
- Personal details: name, date of birth, address, phone number, email.
- Organisation details: business name, ABN, addresses, contact details.
- Sensitive identifiers: Tax File Number (TFN), Medicare number, NDIS participant number, bank account details (BSB, account number, account name).
Forms and documents
- PDF forms you upload, web form URLs you submit, and form attachments you forward by email.
- Filled output documents generated on your instruction.
Usage and audit information
- An append-only audit log of every form fill action: field names, AI confidence scores, timestamps, and cryptographic hashes of filled values. The audit log never stores sensitive values in plain text.
- Waitlist email addresses (via our email provider, Brevo), if you join the waitlist.
3. How we handle sensitive identifiers
- Stored with column-level encryption at rest; never stored or logged in plain text.
- Always displayed masked (••••••) in the interface unless you explicitly choose to reveal a value, which is itself recorded in your audit log.
- Never auto-filled into a form without your explicit confirmation, regardless of AI confidence score.
- Never sent to our AI provider — only field names and descriptions are shared for mapping (see section 5).
- TFNs are additionally handled consistently with the Privacy (Tax File Number) Rule 2015: collected only for the purpose of filling forms you direct us to fill, never used to link records, and never disclosed except at your direction.
4. Why we collect it
- To provide the service — reading your forms, mapping fields to your profile, pre-filling values for your review, and submitting forms at your direction.
- To keep a compliance record — maintaining the 7-year audit log described in section 7.
- To improve mapping accuracy — we learn from confirmed fills at the level of field names and form types only (for example, that a field labelled "Participant Full Name" on an NDIS form maps to a profile's full name). No personal values are used for this.
- To operate your account — authentication, billing, and transactional email.
We do not sell personal information, use it for advertising, or use your data to train third-party AI models.
5. Who we share it with (service providers)
We use a small number of service providers to operate App-Li. Each receives only the minimum data required for its function:
| Provider | Purpose | What it receives |
|---|---|---|
| Supabase | Database, authentication, file storage | All stored data (encrypted at rest; sensitive fields column-encrypted) |
| Anthropic (Claude) | AI field mapping | Form field names and descriptions and profile field keys only — never your stored values |
| Amazon Web Services (Textract) | PDF field extraction | Uploaded form documents, processed in the Sydney (ap-southeast-2) region |
| Brevo | Waitlist, transactional and inbound email | Email address; emails and attachments you forward to your App-Li inbound address |
| Stripe | Payments | Email and payment details (we never see or store full card numbers) |
When you direct App-Li to submit a form, the filled values are delivered to the destination you chose (for example, a government portal or a PDF you download). That disclosure happens only at your instruction, after your review.
6. Overseas disclosure (APP 8)
Our primary data storage is hosted in Australia where available. Some service providers listed above (Anthropic, Stripe, Brevo, and some Supabase infrastructure) may process data in the United States or the European Union. Where personal information is processed overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs, including contractual data-protection commitments.
7. Retention and deletion
- Audit logs are retained for 7 years from the date of each form fill, to meet Australian compliance record-keeping expectations in regulated industries. Audit entries contain field names, confidence scores, and value hashes — not plain-text sensitive values.
- Profile data is retained until you delete it or close your account.
- When you delete your profile or account, profile data and stored documents are deleted. Audit log entries are retained for the remainder of their 7-year retention period, as they are an append-only compliance record.
8. How we protect it
- Encryption in transit (TLS) and at rest, with additional column-level encryption for sensitive identifiers.
- Row-level security: each user can access only their own records.
- Authenticated API access on every endpoint; webhook endpoints verify cryptographic signatures.
- Sensitive values are masked throughout the interface and excluded from application logs.
9. Access and correction (APPs 12 and 13)
You can view and correct your profile information at any time from within App-Li. You may also request access to, or correction of, any personal information we hold by emailing alexo@tanadigital.au. We will respond within 30 days.
10. Data breaches
We participate in the Notifiable Data Breaches (NDB) scheme under the Privacy Act. If a data breach occurs that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) as required by law.
11. Complaints
If you believe we have mishandled your personal information, contact us first at alexo@tanadigital.au — we will investigate and respond within 30 days. If you are not satisfied with our response, you may complain to the OAIC at oaic.gov.au or on 1300 363 992.
12. Changes to this policy
We may update this policy from time to time. Material changes will be notified by email or in-app notice before they take effect. The "Last updated" date at the top of this page reflects the current version.
13. Contact
Tana Digital (ABN 60 666 266 815)
Email: alexo@tanadigital.au