Vestry Technology Pty Ltd (ACN 699 575 034, ABN 15 699 575 034) operates the Vestry virtual family office platform at getvestry.ai. We are incorporated in Australia and our registered office is in Canberra, Australian Capital Territory.
This Privacy Policy explains how we collect, use, store, and protect personal information in connection with the Vestry platform and website. It applies to all principals, advisers, and website visitors.
By using the Vestry platform or website, you agree to the collection and use of your information as described in this Policy. This Policy forms part of and should be read together with the Vestry Terms of Service.
We use the information we collect for the following purposes:
We will not use your personal information for purposes other than those listed above without your explicit consent, except where required by law.
Vestry holds principal wealth data — one of the most sensitive categories of personal information. We apply security standards that match the sensitivity of the data we hold, not the minimum required by law.
Vestry's platform infrastructure is hosted in Australia. Data is stored in accordance with Australian data sovereignty standards. Where third-party service providers process data outside Australia (such as Stripe for payment processing and Twilio for SMS delivery), we ensure those providers meet adequate data protection standards.
We use a limited number of trusted third-party services to operate the platform:
Each provider is engaged under a data processing agreement and is permitted to use your data only for the specific purpose for which they are engaged.
In the event of a suspected data breach, Vestry will follow the two-step Notifiable Data Breaches (NDB) process under the Privacy Act 1988 (Cth): (1) complete an assessment within 30 days of becoming aware of a suspected eligible data breach to determine whether notification is required; and (2) if the breach is assessed as an eligible data breach, notify the OAIC and affected individuals as soon as practicable after the assessment is complete. For breaches affecting Singapore residents: Vestry will notify the PDPC within 3 days of assessing that a notifiable data breach has occurred, and will also notify affected Singapore residents as soon as practicable after notifying the PDPC. Vestry will comply with equivalent notification requirements in Hong Kong and the United States as applicable.
Vestry does not sell, rent, or trade your personal information. We do not share your personal information with third parties except in the following limited circumstances:
We share information with the third-party service providers listed in Section 4 (Stripe, Resend, Twilio, Web3Forms, Anthropic) solely for the purpose of operating the platform. These providers are contractually bound to protect your information and may not use it for any other purpose.
Cross-border disclosure — APP 8 compliance: Stripe, Resend, Twilio, Web3Forms, and Anthropic are based in the United States. Before disclosing personal information to these overseas recipients, Vestry has taken reasonable steps to ensure each recipient does not breach the Australian Privacy Principles, including entering into data processing agreements that require APP-equivalent standards of protection, and selecting providers certified under internationally recognised privacy frameworks.
You may grant specific, scoped access to listed Advisers through the platform's Adviser Coordination module. Adviser access is limited to the categories you explicitly grant, is revocable at any time, and does not extend beyond the specific data categories you have authorised. Vestry does not independently grant Advisers access to your data.
We may disclose your information if required to do so by law, court order, or lawful request from a government or regulatory authority. Where permitted, we will notify you before making such a disclosure.
If Vestry Technology Pty Ltd is acquired, merged, or its assets are transferred, your information may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and will have the opportunity to delete your account before the transfer takes effect.
The Vestry website (getvestry.ai) uses a minimal set of cookies necessary to operate the site. We do not use third-party advertising cookies or cross-site tracking cookies.
We do not currently use Google Analytics or other third-party analytics services on the platform. If we introduce analytics in future, this Policy will be updated and you will be notified in accordance with Section 11.
You have the following rights in relation to your personal information held by Vestry. To exercise any of these rights, contact us at office@getvestry.ai.
You may request a copy of the personal information we hold about you at any time. We will respond within 30 days.
If any personal information we hold about you is inaccurate or incomplete, you may request that we correct it. Most account information can be updated directly in your account settings.
You may request deletion of your personal information at any time by cancelling your subscription and submitting a deletion request to office@getvestry.ai. Upon a valid deletion request, we will delete your personal information within 30 days, except where retention is required by applicable law (such as financial records required for tax purposes).
You may export your platform data (wealth positions, governance documents, IPS) in CSV or JSON format at any time through your account settings, or within 30 days of account cancellation.
Where we process your information on the basis of consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.
If you believe we have not handled your personal information in accordance with this Policy or applicable law, you may lodge a complaint with us at office@getvestry.ai. If you are not satisfied with our response, you may escalate to the relevant regulatory authority for your jurisdiction — see Section 12.
Vestry serves principals across four jurisdictions. In addition to the rights set out in Section 7, the following jurisdiction-specific rights apply.
| Jurisdiction | Privacy Regime | Additional Rights & Obligations |
|---|---|---|
| Australia | Privacy Act 1988 (Australian Privacy Principles) | You may request access to and correction of your personal information. Vestry is subject to the Notifiable Data Breaches scheme — assessment within 30 days of becoming aware of a suspected breach; notification to OAIC and affected individuals as soon as practicable after assessment. |
| Singapore | Personal Data Protection Act 2012 (PDPA) | You have the right to access and correct personal data held about you. For breaches affecting 500 or more individuals, Vestry will notify the Personal Data Protection Commission (PDPC) within 3 days and affected individuals as soon as practicable. |
| Hong Kong | Personal Data (Privacy) Ordinance (Cap. 486) | You have the right to request access to and correction of your personal data. Retention of personal data is limited to the period necessary for the purpose for which it was collected. |
| United States | State-level (including CCPA for California residents) | California residents under the CCPA have the right to know what personal information is collected, the right to deletion, and the right to opt out of the sale of personal information. Vestry does not sell personal information. No equivalent federal privacy law currently applies. |
Vestry is operated in and designed for Australia, Singapore, Hong Kong, and the United States. Vestry has not assessed its compliance with the EU General Data Protection Regulation (GDPR) or the data protection laws of any jurisdiction outside the four supported markets. Vestry does not currently hold the legal basis required to process the personal data of EU residents under the GDPR framework.
If you reside in or operate from a jurisdiction outside the four supported markets — including any EU member state, the United Kingdom, Canada, the UAE, or any other jurisdiction — you acknowledge that:
Vestry reserves the right to restrict access from any jurisdiction where operating the Platform would require regulatory approvals or compliance measures not currently in place. Principals from unsupported jurisdictions who have concerns about data handling are encouraged to contact us at office@getvestry.ai before signing up.
We retain your personal information only for as long as necessary to provide the platform services and comply with our legal obligations.
Where retention is required by law beyond the periods above, we will retain the minimum information necessary to satisfy that obligation and will delete it as soon as the obligation is satisfied.
The Vestry platform is intended for use by adults aged 18 and over. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that we have collected personal information from a minor, we will delete it promptly. If you believe we have inadvertently collected information from a minor, please contact us at office@getvestry.ai.
We may update this Privacy Policy from time to time. Where a change is material — such as a change to the types of data we collect, how we use it, or who we share it with — we will provide at least thirty (30) days' written notice to your registered email address before the change takes effect.
For non-material changes (such as clarifications or corrections), we will update the effective date and post the revised Policy at getvestry.ai/privacy. Continued use of the platform after the effective date of any change constitutes your acceptance of the revised Policy.
This Policy was last reviewed and updated on 15 August 2026 (v1.2 — processor list updated: Web3Forms, Anthropic; adviser application and credential-verification data added). Prior versions are available on request.
For any questions about this Privacy Policy, to exercise your privacy rights, or to lodge a complaint about how we have handled your personal information:
Vestry Technology Pty Ltd
Email: office@getvestry.ai
ACN 699 575 034 · ABN 15 699 575 034
Canberra, Australian Capital Territory, Australia
If you are not satisfied with our response to a privacy complaint, you may contact the relevant regulatory authority for your jurisdiction: