Privacy & compliance

Cameron Legacy Group Pty Ltd trades as CreditPath (ABN 45 659 949 649). CreditPath arranges commercial (business-purpose) finance only. It does not provide credit for personal, domestic, or household purposes. Credit Path helps businesses arrange finance. Credit Path is not a lender. Lenders decide whether to offer finance.

Navifi is the software that business uses. A Navifi login is a broker workspace. Each other firm that uses Navifi is responsible for its own compliance.

[Postal address — not recorded in this repository. Add the registered office address before app review.]

Email support@creditpath.com.au. Phone 0413 031 866.

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy is our APP 1 statement. You can ask for access (APP 12) and correction (APP 13). You can complain to us, and if you are not satisfied you can contact the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

Depending on how you deal with us, we collect:

• Name, email, phone, and the business or role you give us
• Commercial finance details you choose to send: entity, ABN, purpose, amount, and documents
• Navifi account data for a broker user: name, email, hashed password, firm settings, and session cookies
• Notes, messages, and files a broker stores about a commercial client
• Technical data such as browser type, pages viewed, and approximate log timestamps

If you sign in with Facebook, or if Meta sends a data-deletion callback, we receive the Facebook app-scoped user id and the profile fields you grant, typically your name and email. We use them only to identify the account and to action deletion. We do not post to Facebook for you.

If you sign in with Google, we receive the Google account id and the name and email you grant, and we use them only to identify the account.

A broker can connect a Google (Gmail) or Microsoft mailbox so Navifi can send email that broker writes. We then store OAuth tokens and the mailbox address, and we use them only to send and manage that mail. We do not use Google user data for advertising, and we do not sell it. A firm may also turn on a Google Sheets sync of lead records it already holds, using a service account that firm configures.

On creditpath.com.au we use a Meta (Facebook) Pixel and the Meta Conversions API to measure our own ads. The pixel can receive page views, browser and device data, and cookie identifiers. The Conversions API can receive a hashed email and a hashed phone number for lead-outcome events. It does not receive your name, loan amount, ABN, or documents. A firm that publishes a Navifi landing page may add its own Meta Pixel. We do not currently place a Google advertising tag on these sites.

We use personal information to answer a commercial finance enquiry, to operate Navifi for the broker who holds the file, to secure the service, and to meet legal record-keeping duties. We do not sell personal information.

We share it only as needed with:

• Lenders and other commercial finance businesses, when you ask us to present an enquiry
• Meta Platforms, for ad measurement on creditpath.com.au and for a Facebook data-deletion callback
• Google, when a broker connects Gmail or a spreadsheet sync, and Microsoft, when a broker connects Outlook
• Resend, which delivers email, and Twilio, which delivers SMS
• The cloud host for Navifi (servers in the United States) and the AI provider used by Addy, Navifi’s assistant, to draft and classify material the broker asks it to handle
• A regulator, court, or law-enforcement agency when the law requires it

Overseas processing, including in the United States, is limited to running the software. We take reasonable steps so those providers handle the information consistently with the Australian Privacy Principles.

You can ask us to delete personal information by emailing support@creditpath.com.au or by using the form at /data-deletion (the same page is at /delete-account). The form creates a task in our CreditPath workspace and emails support. Facebook app removal can also reach us through our data-deletion callback. The status of a request is at /data-deletion/status.

We confirm a request within 2 business days. Within 30 days we delete personal information we are not required to keep, including contact details, Facebook and Google sign-in identifiers, marketing notes, and a Navifi profile you ask us to close.

We keep records Australian law requires for commercial credit assistance and tax, including consents, identity checks tied to that assistance, complaint files, and invoices, for the statutory period. We do not use those retained records for marketing. Backup copies remain until the backup cycle expires.

Navifi uses a cookie to keep a broker signed in. creditpath.com.au also uses the Meta Pixel described above, which can set a cookie to measure ads. You can block cookies in your browser. Blocking the session cookie will sign you out of Navifi.

Pages are served over HTTPS. Broker passwords are hashed. Navifi keeps each firm’s records separate from other firms. No method of storage is perfect; if a breach is likely to cause serious harm we will tell you and the OAIC as the Privacy Act requires.