Whetstone
Back home
Legal

Privacy Policy

Last updated 2026-10-19.1

This policy explains what information Whetstone collects, why, and the choices you have. We collect the minimum needed to match you well, run bookings, and keep the marketplace trustworthy. Whetstone is operated by Cartouchan Pty Ltd (ABN 36 152 332 502). We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

01Information we collect

Account details: your email and role, created when you sign up. Authentication is handled by our identity provider; we never store your password.

Profile and needs: for clients, the industry and business challenge details you describe; for advisors, your background, specialties, years of experience, and the credential documents you upload for verification.

Booking and payment records: sessions, messages exchanged on the platform, and payment status. Card details are handled by our payment processor, not stored by us.

Identity, credential and eligibility information (advisors): your identity and credential documents for verification, identity checks run by our payment processor before payouts, and any suspension, disciplinary matter or relevant conviction you tell us about. Some of this is sensitive information. We collect it only with your consent, to assess and monitor your eligibility to advise.

Session recordings: only if the recording feature is used with the client’s consent.

Technical information: basic device and log information needed to run and secure the platform.

We collect this information from you directly, from the referees you nominate, and from our identity and payment providers.

02How we use it

To match clients with relevant advisors, run the booking and session flow, process held payments and payouts, and verify advisors.

To keep the marketplace safe — investigating disputes and preventing abuse — and to send you transactional email about your account and bookings.

To meet our legal obligations, including tax, sanctions and anti-money-laundering requirements, and to handle insurance claims and complaints.

03Sharing

The two parties to a booking see what they need to work together (for example, a client sees a matched advisor’s profile; an advisor sees the client’s stated business challenge).

We share data with processors that run the platform — our hosting, database, authentication, payment, and video providers — under agreements that restrict their use of it. We do not sell your personal information.

We may also disclose information to our insurers and brokers (to handle a claim or complaint), to regulators and law enforcement where the law requires or permits it, and to our professional advisers.

04Storage and security

Credential documents are stored in a private bucket accessible only to you and our verification team. Access to personal data is governed by row-level security so users can only reach records they’re entitled to.

No system is perfectly secure, but we apply industry-standard measures and least-privilege access throughout. If a data breach is likely to result in serious harm, we will notify affected people and the Office of the Australian Information Commissioner as the Privacy Act requires.

05Retention

We keep account, booking, and payment records for as long as your account is active and as needed to meet legal, tax, and dispute-resolution obligations, then delete or anonymise them.

06Your choices

You can access and update your profile in-product, and request deletion of your account. You can also ask to access or correct the personal information we hold about you, and we will respond within a reasonable time, usually within 30 days. Some records (for example, payment history) may be retained where the law requires.

You can opt out of non-essential email; transactional messages about your bookings will still be sent.

07Overseas disclosure

Some of our service providers (for example hosting, database, authentication, payment and video providers) may store or access personal information outside Australia. Where we disclose personal information to an overseas provider, we take reasonable steps to make sure it handles that information consistently with the Australian Privacy Principles.

08Complaints

If you think we have breached the Australian Privacy Principles, contact us using the details in section 09. We will acknowledge your complaint promptly and respond within a reasonable time, usually within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

09Contact

For privacy questions or requests, contact Cartouchan Pty Ltd (ABN 36 152 332 502) at the privacy contact address published on our site.