habo: Help A Brother Out

About this Policy

habo.help is operated by Prime Calibre Pty Ltd (ABN 76 678 167 407), an Australian company trading as habo.help. This Privacy Policy explains how we collect, use, store, share and protect personal information about people who use the platform , donors who send gifts, and recipients who claim them.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

We are also a registered remittance service provider under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (the AML/CTF Act). Some of what we collect and what we do with it is required by that law and is described below.

Why we collect personal information

We collect personal information to:

provide the gifting service, deliver gifts to the right recipient, send receipts and notifications, and process refunds;
identify customers and meet our customer due diligence obligations under the AML/CTF Act;
screen against sanctions and politically-exposed-persons lists, as required of registered remittance service providers;
monitor transactions for unusual or suspicious activity, and report to AUSTRAC where required;
keep records for the minimum seven-year retention period required by the AML/CTF Act;
respond to enquiries, complaints, and lawful requests from regulators or law enforcement.

What we collect

From donors

Your full name: mandatory; entered on the donor page. Used for identification and sanctions screening. Whether your name is shown to the recipient is controlled by the “stay anonymous” toggle on the donor page; it is recorded by us either way.
Your answer about senior public positions: mandatory; one question on the donor page, answered once and asked again about every six months. The AML/CTF Act requires us to establish, before we take a payment, whether you or someone close to you holds a prominent public office. Where the answer identifies a political party, that is sensitive information under the Privacy Act, and we collect it because the AML/CTF Act requires us to, which is what APP 3.4(a) permits. We record your answer and nothing else about it: no names, no detail, no follow-up questions. Answering yes does not stop a gift. If the position is overseas we have to make some further checks first, and we will email you.
Your email address: mandatory; entered on the donor page. The first time you use it, we send a verification link to confirm you control the email. Your email indexes a persistent donor record (see below) so that subsequent gifts from you reuse the same record.
Recipient’s mobile number: required to notify them via SMS that a gift has been sent.
Payment information returned by the upstream processor: cardholder name and billing address, the card’s billing country, and a card fingerprint, which is an identifier Stripe derives from the card and not the card number (Stripe); the originating account-holder name and bank identifiers (Zepto PayTo), or the payer name, email address and country PayPal returns (PayPal). We never see or store card numbers, and we do not hold a donor’s bank account number, with one exception: if a refund to your card is refused by your card’s bank, we ask for a bank account to return the money to, and use it only for that.
Gift details: amount, currency, reason (chosen from a list), optional message, payment method selected, and timestamps.
Technical information: your IP address, used for rate limiting and for the bot-protection check, and sent to Zepto when you pay by bank transfer (PayTo) so it can make the PayID lookup; the language you choose; and, if you use the habo phone app, an identifier for your device and a push notification token.
Persistent donor record: we keep a record linked to the email address you give us, containing your name, your gift history, sanctions/PEP screening events, and any compliance review decisions. This record is what allows us to enforce the per-donor limits and meet ongoing customer due diligence obligations.

From recipients

Your mobile number: verified via one-time SMS code (OTP). Used to identify you and match you to gifts sent to your number.
Email address: a donor may give us your email address with a gift. We store it with the gift. We do not currently send email to recipients.
Where you are paid from our own bank account: your PayID, or your BSB and account number, and the name you tell us is on the account. Before we pay you, our bank, Westpac, checks that name with your bank. We keep the name your bank confirms, the result of that check and a screenshot of it, and we screen that name against sanctions and PEP lists before your first payout, as described below. We store your payout details so we can pay you, and keep them with the record of the payment.
Where you are paid through another provider: PayID via Zepto returns the bank-confirmed name on the PayID alias; Stripe Connect performs full identity verification (legal name, date of birth, residential address, bank account verification) on its own hosted onboarding pages. We capture the name and screen it in the same way. On these routes we do not see or store your bank account number, your government ID, or your date of birth, except where Stripe Connect forwards limited verification confirmations to us.
Senior public positions: we ask you the same question donors are asked, once, when you set up how you get paid.
Acceptance / decline / payout history , for your dashboard and our records.

Sanctions and PEP screening

As required of remittance service providers under the AML/CTF Act and Australian sanctions law, we screen the names of donors and recipients against consolidated sanctions and politically-exposed-persons (PEP) datasets.

The screening service we use is OpenSanctions, which aggregates published data from DFAT (Australia), the United Nations Security Council, OFAC (United States), the EU, the UK, and PEP datasets compiled from open and government-published sources.

Screening happens when a transfer is actually being made, and only then. For a donor, at payment, before the payment is taken: we screen the name you gave us and the cardholder or account-holder name your bank or card issuer returns. For a recipient, before the first payout to a nominated account, and again on a later payout if that name was last screened more than six months ago.

We do not run a periodic re-screen over people who are not sending or receiving anything. Screening someone who is not transacting cannot prevent a prohibited transfer, because there is no transfer.

Where a screening match is confirmed, we may decline the transaction, refund the donor, hold the gift pending compliance review, or report the matter to AUSTRAC.

Reporting to AUSTRAC

The AML/CTF Act requires us to make certain reports to AUSTRAC, including:

Suspicious Matter Reports where we form a relevant suspicion;
International Funds Transfer Instruction reports for cross-border transfers;
compliance reports as required by AUSTRAC.

These reports may include personal information about you. Section 16A item 1 of the Privacy Act 1988 and equivalent exceptions permit this disclosure without your consent where it is required or authorised by law.

We are also required by law not to inform you, or any third party, that we have made or will make a Suspicious Matter Report (the “tipping-off” prohibition under section 123 of the AML/CTF Act). If your transaction is held, blocked, or refunded for a compliance reason, we may not be able to explain the specific reason.

How we share information

We share personal information with the following third parties for the purposes set out below. We do not sell personal information, and we do not share for advertising.

Stripe (Stripe Inc.; Stripe Australia Pty Ltd for AU acquiring), card and digital-wallet payment processing. Where we pay recipients from our own bank account, a donor’s payment stays in our Stripe account until the gift is approved, and Stripe then pays that gift’s amount into our Westpac account. Where a recipient is paid through Stripe Connect instead, Stripe makes that payout. Stripe is a payment processor with operations in Australia and the United States; its handling of personal information is governed by the Stripe Privacy Policy.
Zepto Payments Pty Ltd: PayTo / NPP bank-rail payment processing and PayID payouts in Australia.
PayPal Australia Pty Ltd (and PayPal, Inc.), processing of donor payments funded through PayPal. PayPal is not used to pay recipients. PayPal handles your PayPal account information directly under its own agreement with you, and returns to us the payer name, email address and country on the account. PayPal’s parent operates in the United States.
Twilio Inc.: SMS delivery for one-time-password verification, gift notifications, the reminder before an unclaimed gift is returned, confirmation that a gift has been paid out, and notice if a payout comes back. Twilio operates in the United States.
OpenSanctions (OpenSanctions Datenbanken GmbH, Germany), sanctions and PEP screening. We send the name being screened, and, only where we have had to ask you for them, your date of birth and nationality. We do not send your email address, your phone number, your address, or anything about the payment. OpenSanctions returns match data.
Resend: transactional email delivery (receipts, verification links, notifications).
Cloudflare: DNS, traffic protection, and the bot-protection challenge on the donor page.
Railway: hosting for the habo.help application and its database. Railway operates in the United States.
Telegram: internal alerts to our own staff. Screening alerts carry the amount, the screening result and the matched list entry, but not your name, email, phone number or gift reason. Email sent to our general and team addresses, including hello@ and support@, is relayed to our staff through Telegram, including its content. For privacy@, compliance@ and admin@ only the sender and subject line are relayed, and for complaints@ only a reference number. Telegram operates outside Australia.
Anthropic PBC: email sent to our general and team addresses, including hello@ and support@, is sorted, and replies may be drafted, with the help of Claude, an AI model provided by Anthropic. A person reads and approves every reply before it is sent. Email to privacy@, compliance@, admin@ and complaints@ is not sent to Anthropic. Anthropic operates in the United States.
Google and Apple: if you use the habo phone app, push notifications are delivered through Google Firebase Cloud Messaging and the Apple Push Notification service. A notification never includes an amount or a name.
PostHog: website analytics, loaded only if you agree to analytics in the cookie notice. PostHog operates in the United States.
Westpac Banking Corporation: where Prime Calibre holds its business accounts, including the account recipients are paid from. To pay you, we give Westpac your PayID or your BSB and account number, the name you gave us, the amount and a payment reference that says nothing about the donor. Westpac checks the name with your bank before the payment is made. Westpac operates in Australia.
Anthropic PBC and OpenAI: where we pay recipients from our own bank account, an automated assistant built on Claude (Anthropic) or ChatGPT (OpenAI) may prepare the payment in Westpac’s online banking. To do that it sees your payout details (your PayID, or BSB and account number), the name you gave, the name your bank confirms, the amount and the payment reference. It does not see the donor’s details or the reason for the gift. It cannot approve or send a payment: a person approves every payment. Anthropic and OpenAI operate in the United States.
AUSTRAC: the Australian regulator for AML/CTF; reports as described above.
Other regulators or law enforcement , where disclosure is required or authorised by Australian law (for example, lawful production notices).

Disclosures outside Australia

Some of the third parties above are based outside Australia (Stripe, PayPal Inc., Twilio, Resend, Railway, Anthropic, OpenAI, Google, Apple and PostHog, United States; OpenSanctions, Germany; Cloudflare, United States with global infrastructure; Telegram, outside Australia). When we share personal information with them for the purposes described above, that information may be processed and stored overseas. We use established providers with their own privacy and security commitments, and we limit what we share to what is necessary for the relevant purpose.

Anonymity, what it means and what it doesn’t

Donors can choose to be anonymous to the recipient: when the “stay anonymous” toggle is on, the recipient’s gift card and notifications do not show the donor’s name, email, phone number, or any other contact information.

However, you are not anonymous to habo.help or to the upstream processors. We collect your name and email address; the processor collects your cardholder or account-holder details. This is necessary to meet our legal obligations as a registered remittance service provider. The anonymity feature controls visibility to the recipient only.

How long we keep information

The AML/CTF Act requires us to keep customer identification records, transaction records, sanctions screening records, and reporting records for a minimum of seven years. We retain records for at least that period, measured from the end of the customer relationship or the date of the record, whichever is later. For a recipient paid from our own bank account, that includes the payout details used, the name your bank confirmed and the screenshot of that check, which form part of the record of the payment.

Where information is no longer required for any of our lawful purposes and we are not required by law to retain it, we delete or de-identify it.

How we secure information

All data transmitted over HTTPS / TLS.
Personal data is stored in a managed database hosted by Railway.
OTP-based recipient authentication; no recipient passwords stored.
Security headers enforced (X-Content-Type-Options, X-Frame-Options, Referrer-Policy).
Rate limiting on sensitive endpoints.
Cloudflare Turnstile bot-protection on the donor page.
Access to personal information limited to the AML/CTF Compliance Officer and authorised platform engineers.
We never handle or store card numbers: card details go directly to the processor’s secure infrastructure.
Recipients’ payout details, where we pay from our own bank account, are shown only on the staff payout screen, and screenshots of bank name checks can be opened only by staff signed in to it.

Your rights

You can ask us to:

Access the personal information we hold about you.
Correct personal information that is inaccurate.
Export your personal information in a portable format.
Delete personal information that we are not required by law to retain. Information held under the seven-year AML/CTF Act retention requirement cannot be deleted on request before that period expires.

If you are not satisfied with our response, you may make a complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

SMS & communications

SMS is our primary recipient notification channel. We send texts for gift notifications, OTP verification codes, one reminder a few days before an unclaimed gift is returned, and confirmation that a gift has been paid out to your bank account.
SMS messages never contain payment links. We direct you to go to habo.help/claim yourself, which is a deliberate security choice.
We will never sell your phone number or use it for marketing. It is used solely for gift-related notifications, account verification, and any legally required communication.
To stop gift notifications and reminders, text STOP to 0485 044 226. Text START to the same number to receive them again. Codes you ask for, and the text telling you your own payout was sent, still arrive, because you asked for those.
Standard SMS rates from your carrier may apply.

Cookies & local storage

habo.help uses minimal local storage. We store a JSON Web Token in your browser’s localStorage for session management when you are signed in to your dashboard, and small settings such as your language and your answer to the cookie notice. If you agree to analytics, PostHog stores an identifier in your browser so we can see how the site is used; if you do not, it is not loaded. We do not use advertising cookies, or any third-party cookies for marketing purposes.

Changes to this Policy

We may update this policy from time to time. We will publish the updated version at this page with a new “Last updated” date. Significant changes will be notified to users by email or SMS where we hold a contact for them.

Contact

Privacy enquiries: privacy@habo.help

AML/CTF Compliance Officer: compliance@habo.help

General: hello@habo.help