Flusso R&D Tax Platform — Privacy Policy

Last updated: [DATE — e.g. 9 July 2026] Version: 1.0 Effective from: [DATE]

Flusso R&D Tax Platform ("Flusso", "we", "us", "our") operates a software platform that helps Australian companies and their advisers prepare, lodge, and substantiate Research & Development Tax Incentive ("RDTI") claims. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our website or use our services.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy is our APP 1 privacy policy. Where we collect information from you directly, we also provide a shorter collection notice at the point of collection (as required by APP 5); this policy sits behind those notices and explains our practices in full.

By using our website or services, you agree to the handling of your personal information as described in this policy.

On this page

  1. About this policy
  2. Information we collect
  3. How we collect your information
  4. How we use your information
  5. AI-assisted features and automated decisions
  6. Sharing and disclosure
  7. Overseas disclosure
  8. Data security
  9. Data retention
  10. Your privacy rights
  11. Cookies and tracking
  12. Data breaches
  13. Tax File Numbers
  14. Children's privacy
  15. International users
  16. Changes to this policy
  17. Contact us and complaints

1. About this policy

Flusso R&D Tax Platform is a service of Flusso Pty Ltd (ABN [ABN]). We provide a software platform used by Australian companies ("claimants") and their authorised advisers (tax agents, accountants, and R&D consultants) to prepare, lodge, and substantiate RDTI claims.

This policy applies to personal information we collect through our website, our platform, and our communications with you. "Personal information" has the meaning given in the Privacy Act — information or an opinion about an identified individual, or an individual who is reasonably identifiable.

Our services are provided to businesses and their advisers. Much of the information handled on the platform is company information (for example, a company's financial and R&D activity records), which is not "personal information". This policy covers the personal information we handle in the course of providing those services.

2. Information we collect

We collect personal information that you provide directly, information generated as you use our services, and information from third parties where relevant to an RDTI claim. Depending on how you use our services, this may include:

  • Identity and contact details — name, business role or job title, email address, phone number, and postal address.
  • Organisation information — company name, ABN/ACN, industry classification, and income year. (A company's ABN/ACN and business details are generally not personal information; however, for a sole trader these details can identify an individual and are treated as personal information.)
  • Claim and financial data — R&D activity descriptions, expenditure records, and supporting evidence you or your adviser upload to prepare and substantiate a claim.
  • Account and usage data — login and authentication data, IP address, device and browser information, and interaction and audit logs.
  • Communications — records of your enquiries, support requests, and correspondence with us.

We only collect personal information that is reasonably necessary for our functions and activities. You are not required to provide all information, but some features cannot be delivered without it.

We do not seek to collect sensitive information (such as health information) as part of the RDTI process. If material you upload happens to contain sensitive information, we handle it in accordance with the APPs and do not use it except as needed to provide the service you have asked for.

3. How we collect your information

We collect personal information:

  • Directly from you — when you create an account, enter or upload claim information, contact us, or otherwise use our services.
  • From your authorised advisers or organisation — where they invite you to, or share information with, an account you are connected to.
  • Automatically — through your use of our website and platform (for example, log, device, and usage data, and cookies — see Cookies and tracking).

Where it is lawful and practicable, you may deal with us anonymously or using a pseudonym — for example, when making a general website enquiry. However, because our services involve preparing and lodging tax claims tied to identified companies and individuals, we generally cannot provide the platform's core functions without identifying you.

4. How we use your information

We use personal information to provide, maintain, and improve our services, and to meet our legal and regulatory obligations. Specifically, we use it to:

  • Prepare, review, lodge, and substantiate RDTI applications and supporting schedules.
  • Authenticate users and secure accounts against unauthorised access.
  • Provide customer support and respond to your enquiries.
  • Send service communications, including deadline reminders and important notices about your account or the service.
  • Analyse usage to improve the reliability, security, and features of our products.
  • Comply with our legal, accounting, and record-keeping obligations.

We do not sell your personal information, and we do not disclose it to third parties for their own marketing purposes.

We may send you product and marketing communications where permitted. You can opt out of marketing at any time using the unsubscribe link in those messages or by contacting our Privacy Officer, and we will honour your request.

5. AI-assisted features and automated decisions

Some features of our platform use artificial intelligence, including large language models provided by third-party AI providers, to help you and your adviser draft, structure, and analyse R&D claim narratives, eligibility assessments, and supporting documentation.

These features assist you — they do not make decisions for you. AI-generated content is a suggestion. Eligibility, what to claim, and what to lodge are decided by you and your adviser, and are reviewed by a person before anything is submitted. We do not use solely automated decision-making that produces legal or similarly significant effects on you without meaningful human involvement.

We do not currently use your account content, claim data, or the inputs you provide to AI features to train our own or our providers' foundation models. Today, we contract with our AI service providers so that your inputs are used only to return your result and are not used to train their models.

In the future, we may introduce features — such as protocol benchmarking — that use materials you upload (for example, R&D protocols and methodology documents) to improve or train our own models by comparing them against our existing data set. Before we use your content to train our models, we will update this policy, notify you, and give you a genuine choice (such as the ability to opt out, or to provide consent where required) consistent with the Australian Privacy Principles. We will not repurpose your content for model training without first giving you that notice and choice.

If, in future, we introduce any feature that makes or substantially assists a decision that could significantly affect your rights or interests, we will describe in this policy the kinds of personal information used, the kinds of decisions involved, and how they are made, consistent with the automated-decision-making transparency requirements of the Privacy Act. You can ask us for information about how our automated features are used, and request human review, by contacting our Privacy Officer.

6. Sharing and disclosure

We disclose personal information only where necessary to deliver our services or comply with the law. Recipients may include:

  • Your authorised advisers. Where you connect your account with your tax agent, R&D consultant, accountant, or other adviser, we disclose your information to that adviser on your instruction and authority. Registered tax and BAS agents are independently bound by confidentiality obligations under the Tax Agent Services Act 2009 (Cth) and must not disclose your information to third parties without your permission, except where required by law. You may withdraw an adviser's access to your account at any time.

  • Government bodies, as part of lodging and substantiating an RDTI claim:

    • AusIndustry — a division of the Department of Industry, Science and Resources, which administers the registration of R&D activities on behalf of Industry Innovation and Science Australia and its Board, under the Industry Research and Development Act 1986 (Cth); and
    • the Australian Taxation Office (ATO) — which administers the R&D tax offset under the Income Tax Assessment Act 1997 (Cth) (Division 355) and the Taxation Administration Act 1953 (Cth).

    These agencies may share relevant claim information with each other in administering the RDTI program.

  • Service providers. We use trusted third-party providers to operate our services — including cloud hosting and infrastructure, authentication, analytics, communications, and AI providers. These providers may access personal information only to perform services for us and are bound by written agreements requiring confidentiality and protections consistent with this policy and the APPs. Current details of our sub-processors, including their names and locations, are available at our sub-processors page.

  • Others as required or authorised by law, including in response to a valid legal request, or to protect our rights, users, or the security of our services.

7. Overseas disclosure

The primary database in which we store your account and claim records is located in Australia (Sydney). However, some of the infrastructure and service providers we use to run Flusso R&D Tax Platform — and some of the processing of your personal information — are located outside Australia, principally in the United States. This includes our cloud compute and web-hosting providers, our authentication provider, our AI providers, and certain third-party connectors you may choose to link (for example, accounting and document-storage services).

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles it consistently with the APPs, and we remain accountable for how they handle it. You should be aware that overseas recipients may be subject to foreign laws that could compel disclosure of information, and that the enforcement mechanisms of the Australian Privacy Act may not be available in every country. Where the law requires your consent for a particular overseas disclosure, we will obtain it.

A current list of our sub-processors, and the countries in which they operate, is available at our sub-processors page.

8. Data security

We take reasonable steps to protect personal information from misuse, interference, and loss, and from unauthorised access, modification, or disclosure. These steps include technical measures (such as encryption in transit and at rest, role-based access controls, and network monitoring) and organisational measures (such as access management, staff training, vendor due diligence, and regular security reviews).

No method of transmission over the internet, or method of electronic storage, is completely secure. While we work to protect your personal information, we cannot guarantee its absolute security. If you believe your account has been compromised, please contact us immediately.

9. Data retention

We retain the records you create or upload to prepare, lodge, and substantiate an RDTI claim for at least five (5) years after the relevant claim is lodged with the ATO. This reflects the record-keeping obligations for the RDTI administered by the ATO and AusIndustry, under which R&D records must generally be kept for five years after the R&D expenditure is claimed.

We may retain these records for longer where a longer period is required or prudent, including where:

  • the ATO's period of review (amendment period) for the relevant assessment has not yet ended;
  • the claim contributes to a carried-forward tax loss, or to depreciating or capital assets, which attract extended record-keeping obligations; or
  • the claim, or your account, is subject to an audit, review, objection, dispute, or legal proceeding — in which case we retain the relevant records until that matter is finally resolved and any further review period has ended.

Account and administrative data that is not required for claim substantiation is retained only as long as needed for the purposes described in this policy, and is then securely deleted or de-identified.

10. Your privacy rights

Subject to applicable law, you have the right to:

  • Access the personal information we hold about you.
  • Correct information that is inaccurate, incomplete, or out of date.
  • Withdraw consent or object to certain uses of your information (noting this may limit the services we can provide).
  • Opt out of marketing communications.
  • Complain about how we handle your personal information (see Contact us and complaints).

To exercise any of these rights, contact our Privacy Officer using the details below. We will respond within a reasonable period — generally within 30 days. We may need to verify your identity before acting on a request. If we decline a request for access or correction, we will tell you why and how you can seek a review.

11. Cookies and tracking

We use cookies and similar technologies to keep you signed in, remember your preferences, and measure how our website and platform perform. These include:

  • Essential cookies — required for sign-in, security, and core functionality.
  • Preference cookies — to remember your settings.
  • First-party analytics — to understand and improve how our services are used (for example, [Google Analytics — confirm]).

We do not use third-party advertising cookies, and we do not sell tracking data. You can control or disable cookies through your browser settings, though disabling some cookies may affect how the platform works. Where we use an analytics provider, you can find that provider's opt-out options in Contact us or via your browser.

Australian law does not require an opt-in cookie banner for the essential and first-party analytics cookies we use; we describe them here so you can make informed choices.

12. Data breaches

We maintain a data-breach response plan. If we suspect on reasonable grounds that an eligible data breach may have occurred, we will assess it promptly and decide within 30 days.

If we determine that a data breach is likely to result in serious harm to affected individuals, and we have not been able to prevent that risk, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in accordance with the Notifiable Data Breaches scheme under the Privacy Act.

13. Tax File Numbers

RDTI claims are lodged by companies, and the tax identifiers involved are generally the company's Tax File Number (TFN) and ABN/ACN. We do not require, and do not seek to collect, the TFNs of individuals to prepare or substantiate a claim.

If an individual's TFN is ever provided to us, we handle it in accordance with the Privacy (Tax File Number) Rule 2015 and APP 9: we use it only for the lawful taxation purpose for which it was provided, we do not use it as a general identifier for you, we restrict access to it, and we securely destroy or de-identify it when it is no longer required by law. It is not an offence to decline to provide a TFN, though this may affect the assistance we can provide.

14. Children's privacy

Our services are intended for businesses and their advisers, and for individuals aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

15. International users

Our services are designed for Australian companies and their advisers, and this policy is governed by Australian privacy law. If you access our services from outside Australia, or if data-protection laws of another jurisdiction (such as the EU or UK GDPR) apply to your use of our services, additional rights and protections may apply to you. Please contact our Privacy Officer for more information.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. The "Last updated" date and version number at the top of this page indicate when the policy was last revised. Where changes are material, we will notify you through the platform or by email before they take effect.

17. Contact us and complaints

If you have questions about this policy, wish to exercise your privacy rights, or want to make a complaint, please contact our Privacy Officer:

Privacy Officer, Flusso Pty Ltd Email: privacy@flusso.ai

Making a complaint. If you are concerned about how we have handled your personal information, please contact our Privacy Officer first. We will acknowledge your complaint and aim to respond within a reasonable period (generally 30 days).

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

  • Website: oaic.gov.au (online privacy complaint form)
  • Phone: 1300 363 992
  • Post: GPO Box 5288, Sydney NSW 2001

There is no fee to lodge a complaint with the OAIC.