Effective 28 August 2026. This Privacy Policy explains how BUFFLO PTY LTD, trading as Bufflo ("Bufflo", "we", "our" or "us"), handles personal information. It applies to bufflo.io, the Bufflo web app, the Bufflo iOS app and our related services (together, the "Services").
BUFFLO PTY LTD is an Australian company. Our ABN is 85 693 514 000. Our ACN is 693 514 000. Our address is Suite 329, 98-100 Elizabeth Street, Melbourne VIC 3000, Australia.
This policy covers information we control. A broker, app store, payment provider, identity provider or linked website may handle information under its own privacy policy.
The information we collect depends on the features you use. You must provide your name and email address to create an account. Other information is optional unless it is needed for a feature you choose.
We collect your name, email address, user ID and authentication information. If you sign in through another service, we receive the account information that service is authorised to share with us.
We collect content you create or save in Bufflo. This may include workspaces, layouts, watchlists, screeners, alerts, indicators, scripts, backtests, settings and notification preferences.
We collect prompts, AI responses and the context used to answer a request. Context may include market data, screeners, workspace content, layouts, settings and connected-account information.
If you connect a broker, we collect the connection token, broker account ID and account name. We also collect balances, buying power, positions, orders, fills, trading-journal information, order instructions, order status and connection history.
We collect IP address, browser type, operating system, app version, device type, timestamps, request details and security logs. We also collect information about feature use, errors and service performance.
We receive subscription status, product, transaction and entitlement information from payment providers. We do not receive complete card numbers. A support request may include its subject, message and your account email or user ID. Bufflo support does not accept file attachments.
We collect information from you, from your use of Bufflo and from services you choose to connect.
You provide information when you register, configure Bufflo, enter an AI prompt, contact support, subscribe or send a trading instruction.
Our systems create technical, security and usage records when you use the Services. The iOS app also creates a push-notification token if you enable notifications.
We receive information from services you connect. These may include identity providers, brokers, payment processors, app stores and notification services.
You cannot create an account without the required account information. You cannot use broker features without connecting a broker. You cannot subscribe without completing payment with the payment provider. AI answers may be limited if you do not provide the requested context.
We use information only for the purposes described below or as otherwise permitted by law.
We use information to create and secure accounts. We also use it to provide market tools, AI analysis, saved content, alerts, subscriptions, connected-broker features and manual order transmission.
We use information to maintain, troubleshoot, test and improve the Services. We also use it to measure performance and understand anonymous website usage.
We use information to answer support requests, prevent fraud and abuse, investigate incidents, enforce our Terms of Use, resolve disputes and meet legal obligations.
We may send account, billing, security, support and service messages. We do not send promotional or marketing emails.
Bufflo uses third-party AI services to answer prompts and analyse stocks. AI output is informational. You decide whether and how to use it.
We send the prompt and the Bufflo context reasonably needed to produce a response. Do not enter brokerage passwords, authentication codes, complete card details, material non-public information or personal information that is not needed.
We route AI requests through zero-data-retention endpoints. We also deny provider data collection. AI providers process request content to return an answer but do not retain that content. We do not use customer prompts or responses to train AI models. We do not authorise AI providers to use them for training.
Bufflo stores prompts and responses so you can use conversation history and related features. They remain in active systems until you delete them, delete your account or we no longer need them. We delete active AI conversations when your account is deleted. Copies may remain in restricted logs or encrypted backups until those systems are rotated.
Bufflo AI does not make decisions that produce legal or similarly significant effects about you. It provides analysis and user-directed tools. You make your own trading and financial decisions.
You may connect a supported brokerage account and place trades manually through Bufflo. Bufflo uses your broker information to show account data and transmit your instructions.
Bufflo stores the token needed to maintain the connection. We protect connection credentials and do not expose them in the user interface. We delete the active connection token immediately when you disconnect.
We store account identifiers, balances, buying power, positions, orders, fills, journal records, order instructions, status and connection history. Broker records may differ from information displayed by Bufflo. Your broker remains responsible for its own records and privacy practices.
When you submit an order, we send the instruction and required account information to your broker or brokerage-connectivity provider. Bufflo does not receive or hold your money or securities.
Payments are handled by third-party billing services. Website subscriptions use RevenueCat Billing and Stripe. iOS subscriptions use Apple in-app purchases.
The payment provider collects payment details under its own privacy policy. Bufflo receives information such as the product, subscription status, transaction identifier, renewal status and entitlement. Bufflo does not receive complete card numbers.
Deleting a Bufflo account does not necessarily cancel an App Store subscription. You must manage App Store billing through Apple. Website subscriptions must be managed through the cancellation method made available for that subscription.
We use limited analytics and device services to operate the web app and iOS app. We do not use advertising pixels, ad networks, retargeting or cross-site behavioural advertising.
We use Umami to measure website use. It may process page views, page paths, referrers, browser, operating system, device type and country. The analytics are anonymous. We do not send Umami your name, email address or Bufflo user ID. Umami does not use tracking cookies or track you across websites.
Bufflo may use cookies, local storage and similar browser storage for sign-in, security, preferences and core features. Blocking essential storage may prevent parts of Bufflo from working.
If you enable iOS notifications, we store a device push token and related app or device details. We use Expo and Apple to deliver notifications. You can disable notifications in your device settings.
Apple may collect crash and diagnostic information for App Store and TestFlight builds. Apple may provide reports to Bufflo. TestFlight crash reports are shared automatically. Reports may include app, device, operating-system and technical crash details. Apple handles this information under its own privacy terms.
We disclose information only when needed to provide the Services, protect Bufflo and its users, complete a corporate transaction or comply with law.
We may disclose information to cloud-hosting, security, identity, AI, analytics, support, billing, payment, app-store and notification providers. Providers acting for us may use information only to provide the contracted service. Some third parties, such as app stores and payment providers, handle information under their own privacy policies.
We disclose account and order information to the broker or connectivity provider you choose. This is required to connect the account, retrieve account data and transmit manual order instructions.
We may disclose information if required by law, court order or lawful government request. We may also disclose it to protect rights, safety and security, investigate fraud, enforce agreements or resolve a dispute.
Information may be disclosed as part of a merger, financing, restructuring, acquisition or sale of assets. We will take reasonable steps to protect it during the transaction.
We do not sell personal information. We do not rent it to advertisers. We do not disclose it for cross-site behavioural advertising.
Our primary AWS region is Sydney, Australia. Our main databases and backups are located in Australia. Some providers and supporting systems process information in other countries.
We use administrative, technical and physical safeguards. These include access controls and encryption in transit and at rest. No service is completely secure. We cannot guarantee that a breach will never occur.
We keep information while your account is active and for as long as needed for the purpose described in this policy. We may also retain information to meet legal, accounting, security, fraud-prevention and dispute-resolution needs.
Account deletion starts immediately. We delete or de-identify active account data that we no longer need. Some brokerage, transaction, security or dispute records may remain when reasonably required. Deleted information may remain in encrypted backups until routine backup rotation.
Disconnecting a broker does not delete historical account, order, fill, journal or connection records. Account deletion may not remove every brokerage record. We retain only records reasonably needed for legal, accounting, security, fraud-prevention or dispute purposes.
Bufflo is based in Australia and may be used globally. Information may be processed outside your country.
Our main databases and backups are in Australia. Some Bufflo systems operate in the United States. Some cloud, AI, analytics, payment, identity, brokerage, app-store and notification providers may process information in the United States or other countries where they operate. Bufflo support staff and contractors do not access customer information from other countries.
Privacy laws differ between countries. We take reasonable steps to use suitable providers, contracts, security controls and transfer safeguards where applicable.
You can manage many choices in Bufflo. You may also have privacy rights under the laws that apply to you.
You can update account information, disconnect a broker, disable notifications and delete your account. You may also contact us to request access, correction or deletion.
Depending on applicable law, you may have rights to access, correct, delete or obtain a copy of personal information. You may also have rights to restrict or object to some processing. These rights may be subject to legal exceptions.
Email privacy@bufflo.io to make a request. We may need to verify your identity. We will respond within the time required by applicable law.
You may complain to our Privacy Officer. We will investigate and respond within a reasonable time. If you are not satisfied, you may contact the privacy regulator in your location. In Australia, this is the Office of the Australian Information Commissioner.
Bufflo is only for people aged 18 or older. A person under 18 cannot create an account.
We do not knowingly allow people under 18 to register or use the Services.
If we learn that a person under 18 created an account, we will close the account and delete information that we are not legally required to keep.
Bufflo links to and works with third-party services. Their privacy policies govern how they handle information for their own purposes.
Review the privacy terms of any broker, identity provider, app store, payment provider or website you use. Bufflo does not control independent third-party privacy practices.
We may update this policy when our Services, providers or legal obligations change.
We will post the updated policy and change its effective date. If a change is material, we will provide reasonable notice through the Services or by email where appropriate.
Contact our Privacy Officer with questions, requests or complaints about privacy.
Privacy Officer, BUFFLO PTY LTD. Email: privacy@bufflo.io. Address: Suite 329, 98-100 Elizabeth Street, Melbourne VIC 3000, Australia.
This information is current as of the last updated date shown above.