Privacy Policy

Klyvon is an AUSTRAC compliance platform for Australian businesses, operated from Melbourne, Victoria. We collect information to provide our services, deliver your documents, and keep your account running. We do not sell your data. We do not share it with advertisers.

This policy applies to klyvon.com.au and all Klyvon services. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Client CDD records you enter into the platform — names, dates of birth, addresses, ID document details, risk ratings, PEP status — are records about your clients, not about you. Klyvon holds these records on your firm’s behalf as your firm’s record-keeping system, and uses them only to provide the platform’s features to your firm. Your firm remains responsible for the lawful collection of your clients’ personal information and for its own privacy obligations as an AUSTRAC reporting entity. Because Klyvon holds these records, the individuals they describe also have rights against Klyvon directly — see Section 10.

Before entering a client’s details into Klyvon, your firm should ensure the client is aware their identification records will be collected and held in a third-party compliance platform. This policy explains how Klyvon handles that information; those individuals’ access and correction rights are set out in Section 10.

Note: reporting entities under the AML/CTF Act have obligations under the Privacy Act regardless of size — the small business exemption does not apply to activities connected with AML/CTF obligations.

We share your information only where necessary to provide our services, with the following categories of providers:

• Payment processors — to manage billing and subscriptions. Klyvon does not directly store raw payment card numbers. All card data is handled by our payment processor via their hosted checkout.
• Email delivery providers — to send transactional emails, trial reminders, newsletter issues, and compliance checklist delivery.
• AI service providers — to generate your compliance documents and SMR drafts from the information you provide (see Section 5).
• Cloud hosting and database providers — to store your account data, client records, and generated documents. All structured data is stored on Australian-hosted infrastructure.
• Web hosting and analytics providers — standard server logs and the privacy-limited analytics described in Section 6.

We also use the information we hold for security monitoring, fraud and abuse prevention (for example, rate limiting), to comply with our legal obligations, and to improve our services.

We use reputable third-party providers with industry-standard security controls. We do not sell, rent, or trade your personal information to any third party for marketing purposes.

Some third-party providers we use store or process data outside Australia. The countries in which these recipients are likely to be located are: the United States (payment processing, email delivery, AI processing, web hosting and server logs, and session replay on marketing pages) and the European Union (product analytics). Where this occurs, we take reasonable steps as required by Australian Privacy Principle 8 to ensure overseas recipients handle personal information consistently with the APPs, including by using providers with established privacy and security programs and by relying on contractual protections. Klyvon remains accountable under the Privacy Act for the handling of personal information by these overseas recipients.

All structured data and client CDD records are stored on Australian-hosted infrastructure.

All data is transmitted over TLS (HTTPS). Database access requires authenticated credentials — no public access. Client data is stored on Australian-hosted infrastructure with encryption at rest and in transit.

Dashboard authentication uses a cryptographically random token stored in a secure httpOnly cookie. Every action on client records is captured in an audit log.

Please note: no method of electronic storage or transmission is completely secure. While we implement industry-standard security measures, we cannot guarantee absolute security.

If you identify a security vulnerability, contact us immediately at support@klyvon.com.au.

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to:

• Access the personal information Klyvon holds about you (APP 12)
• Request correction of inaccurate or incomplete information (APP 13)
• Request deletion of your account and associated data (subject to our retention obligations under the AML/CTF Act for client CDD records)
• Opt out of marketing emails at any time via the unsubscribe link in any email (APP 7) — honoured immediately

These rights are not limited to account holders. If your personal information is held in Klyvon because a firm you deal with uses our platform, you can contact us to request access to or correction of that information. We will verify your identity, and may coordinate with the relevant firm to do so and to process the request. Corrections to compliance records are appended to the record rather than overwriting it, so the record’s history and audit trail are preserved as the law requires.

You may make privacy enquiries or complaints anonymously or under a pseudonym where practicable. Anonymity is not practicable for account holders — we cannot operate your account, process payments, or maintain AML/CTF compliance records without identifying information — and we may require certain information to confirm your identity before actioning a request about your personal information.

To exercise any of these rights, contact us at privacy@klyvon.com.au. We aim to respond within 30 days. We may decline a request only where the Privacy Act permits, and we will give you written reasons if we do.

If you make a privacy complaint, we will acknowledge it promptly, investigate it internally — including reviewing the relevant records and audit logs — and respond with our findings and any corrective action within 30 days. If a complaint requires longer, we will tell you and keep you updated.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992

Klyvon is subject to the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth). If we become aware of reasonable grounds to suspect an eligible data breach, we will carry out a reasonable and expeditious assessment and take all reasonable steps to complete that assessment within 30 days, as required by s.26WH of the Privacy Act.

If we determine that an eligible data breach has occurred and it is likely to result in serious harm to any individual, we will:

• Notify affected individuals as soon as practicable
• Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable
• Take immediate steps to contain the breach and prevent further harm
• Include in each notification the information the Privacy Act requires — a description of the breach, the kinds of information involved, and the steps we recommend you take

Where a suspected breach involves client CDD records, that information is held for your firm as well as by Klyvon. We will notify the affected firm promptly and coordinate the assessment with it, including which entity notifies the OAIC and affected individuals (as the Privacy Act permits, s.26WM), so that individuals receive one clear notification rather than conflicting ones.

We may update this policy from time to time. We will notify you of material changes by email to your registered address at least 30 days before they take effect. The date at the top of this page reflects the most recent update.

We aim to respond to all privacy requests within 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992