SME Baseline — Privacy Policy

Last updated 3 September 2026

1. About this Policy

This Privacy Policy explains how SME Baseline collects, holds, uses and discloses personal information — including when we use artificial intelligence to help prepare your business valuation and benchmarking Reports. Please read it alongside our Terms and Conditions.

This Policy applies to everyone who interacts with us: visitors to our website, people who join our mailing list or waitlist, Referrers (third parties such as accountants, bookkeepers, landlords, business brokers, or coaches) who nominate a Client, and Clients (business owners) who use the Report Service directly or via a Referrer.

We are a small business. Many small businesses are exempt from parts of the Privacy Act 1988 (Cth). We have chosen to comply with the Australian Privacy Principles (APPs) voluntarily, in full, regardless of whether any exemption applies to us, because we handle sensitive financial information and believe you’re entitled to that standard of care.

2. Who we are

SME Baseline is operated by Dennis Price, ABN 35 109 205 014, trading as “SME Baseline” (“SME Baseline”, “we”, “us”, “our”).

• Contact: [email protected]
• Marketing website: smebaseline.com.au
• App (where the Report Service is delivered): app.smebaseline.com, hosted on infrastructure provided by MindStudio (see their Trust Center at trust.mindstudio.ai for information about their security practices and sub-processors)

3. Scope of this Policy

This Policy covers:

• general browsing of our marketing website (smebaseline.com.au) and any newsletter, waitlist, or lead-magnet sign-up;
• the nomination process — a Client signing up directly, or being nominated by a Referrer (a third party such as an accountant, bookkeeper, landlord, business broker, or coach) — for a Report; and
• our paid Business Valuation & Benchmarking Report service (“Report Service”), delivered through our App at app.smebaseline.com, including the intake forms, questionnaire, financial document uploads, AI-assisted analysis, and payment.

It does not cover the practices of third-party websites we link to, or of any Referrer who refers you to us (their own privacy obligations to you are separate from ours).

4. The kinds of personal information we collect

Depending on how you interact with us, we may collect:

From website visitors and subscribers: name, email address, phone number, business name, and any information you volunteer through a contact, waitlist, or newsletter form; and technical/usage data (see section 12, Cookies and analytics).

From Referrers (if a third party nominates you): name, organisation or business name (if applicable), email address, phone number, and details of the Client being nominated.

From Clients (whether you sign up directly or are nominated by a Referrer): name, business name, contact details, role in the business; financial information including profit & loss statements, balance sheets, and other financial documents you or your Referrer upload; answers to our business questionnaire (which may cover matters such as revenue drivers, staffing, premises, customer concentration, and other operational details); and, if you speak with us by phone or video call, notes from that conversation.

Payment information: we use Stripe to process payment for the Report Service. We do not receive or store your full card details — Stripe handles this in accordance with its own privacy policy and PCI-DSS obligations. We retain only confirmation that payment was made.

We do not intentionally collect any more sensitive categories of information (such as health information) than is incidentally and unavoidably present in ordinary business financial records, and we do not seek this information out. If a document you provide happens to contain that kind of information, we will only use it for the limited purpose of preparing your Report and will not draw it out or comment on it separately.

5. How we collect personal information

We collect personal information:

• directly from you, through our website forms, the accountant nomination form, the client questionnaire, uploaded documents, email, and phone/video calls;
• from a Referrer, where a third party nominates you for the Report Service (a Referrer is responsible for having your consent to share your information with us — see also our Terms and Conditions);
• automatically, through cookies and analytics tools when you browse our website (see section 12); and
• from our service providers (for example, a payment confirmation from Stripe).

6. Why we collect, hold, use and disclose your personal information

We collect and use personal information to:

1. respond to enquiries and provide information you’ve requested;
2. manage the nomination process, whether you sign up directly or are nominated by a Referrer;
3. prepare and deliver your Business Valuation & Benchmarking Report, including the AI-assisted analysis described in section 7;
4. process payment for the Report Service via Stripe;
5. communicate with you about your Report, your account, or (with your consent) send marketing updates;
6. build, maintain and improve our de-identified SME benchmarking database, as described in section 10; and
7. comply with our legal, accounting, and tax obligations, and resolve disputes or enforce our Terms and Conditions.

We only use your information for the purpose we collected it for, or a purpose you’d reasonably expect, unless you consent to something else or the law requires or permits it.

7. Our use of Artificial Intelligence and automated processing — please read this section carefully

This is central to how our Report Service works, and we want to be completely upfront about it.

7.1 We use artificial intelligence and large language model (“AI”) tools as part of preparing your Report. This processing happens within our App (app.smebaseline.com), hosted on infrastructure provided by MindStudio. The AI is given the financial documents and questionnaire answers you and/or your Referrer provide, together with third-party benchmark data (see section 8), and it generates a substantial part of the analysis, commentary, and indicative figures that appear in your Report.

7.2 AI-assisted analysis is not the same as a fully automated decision made without human involvement, but AI materially shapes the content of your Report. We do not warrant that every AI-generated statement or figure has been individually checked by a person before your Report is issued. AI systems can misinterpret data, draw incorrect inferences, or produce plausible-sounding but inaccurate content (“hallucinations”). See our Terms and Conditions (in particular the “Nature of Reports and Figures” and “AI Use and Limitations” clauses) for the full disclaimer about how you should — and should not — use figures produced this way.

7.3 The kinds of information used in this AI-assisted process are the financial and business information described in section 4, and the kinds of outputs it informs are the indicative valuation figures, ratios, and benchmark comparisons contained in your Report — outputs that can meaningfully affect decisions you might make about your business (for example, whether and at what price to pursue a sale). We are telling you this now, ahead of the transparency requirements for automated decision-making that become mandatory under the Privacy Act from 10 December 2026, because we think you should know it before, not after, you submit your financial information.

7.4 If you would like more information about how AI was used in preparing your specific Report, or you’d like a plain-language explanation of a particular figure, contact us at [email protected] and we will do our best to explain it.

7.5 We do not enter your personal or financial information into public, free-to-use generative AI tools (the kind anyone can sign up for and where inputs may be used to train the underlying model). We use commercial AI services subject to contractual terms that restrict the provider from using your data to train their models or from retaining it beyond what’s needed to deliver the service to us.

8. Who we disclose personal information to

We may disclose your personal information to:

• any Referrer who nominated you (where applicable), including the finished Report and any information reasonably needed to explain it;
• our service providers, who help us run the Website, App, and Report Service, including: MindStudio, which hosts and runs our Report Service App at app.smebaseline.com (see their Trust Center at trust.mindstudio.ai for information about their security practices and sub-processors, including any AI/LLM providers used within the App); GoHighLevel, our marketing website and CRM platform; Stripe, our payment processor; and other cloud hosting and data storage providers. These providers only receive the information needed to do their job for us, and are contractually restricted from using it for their own purposes;
• government or regulatory bodies, where required or authorised by law; and
• a professional adviser (such as our accountant, lawyer, or insurer), where reasonably necessary, and always on a confidential basis.

We do not sell your personal information, and we do not disclose it to third parties for their own direct marketing purposes.

The benchmark figures we publish or use for comparison (for example, the ATO’s Small Business Benchmarks) are sourced from publicly available, aggregated government and industry data about industries, not about identifiable individuals or specific businesses, and are not personal information in their own right.

9. Sending information overseas

Some of our service providers — including MindStudio (and the AI/LLM provider(s) it relies on to run our App), Stripe, and GoHighLevel — store or process data on servers located outside Australia, most likely in the United States, and potentially other countries where those providers or their sub-processors operate. MindStudio publishes details of its sub-processors at trust.mindstudio.ai.

Before we disclose personal information overseas, we take reasonable steps to satisfy ourselves that the recipient is bound by contractual terms at least as protective as the Australian Privacy Principles, or that another exception under APP 8 applies. However, overseas recipients are not always subject to Australian privacy laws, and you may have fewer options to seek redress directly against them if something goes wrong. By providing your information to us, you acknowledge that it may be handled in this way.

10. How we hold and protect your information; retention and deletion

10.1 We store personal and financial information using reputable cloud-based platforms with access controls, and we limit access to people who need it to deliver the Report Service.

10.2 Once your Report has been delivered and accepted, here’s specifically what happens to your data:

• we delete the personally identifying information and the original financial documents and questionnaire answers you or your Referrer provided;
• we retain a de-identified, keyless extract of aggregate financial figures (stripped of anything that could reasonably be used to re-identify you or your business) to build and improve our SME benchmarking database — this is the long-term data asset our business is built on, and it cannot be traced back to you; and
• we may keep limited records we’re legally required to retain (for example, for tax or accounting purposes, or evidence of the transaction for dispute-resolution purposes).

We will email you a confirmation once the deletion described above has taken place.

10.3 If you’re nominated for the Report Service but the engagement doesn’t proceed (for example, the questionnaire is never completed), we will delete your personal information within a reasonable period, and in any event no later than 24 months after the last contact with you, unless you ask us to delete it sooner or the law requires us to keep it.

10.4 If you’ve only ever given us your details through the website (for example, a newsletter or waitlist sign-up) and never engaged the Report Service, we keep that information until you unsubscribe or ask us to delete it.

10.5 No method of storage or transmission is completely secure. We take reasonable steps to protect your information, but we can’t guarantee absolute security.

11. Direct marketing and electronic messages

We will only send you marketing emails if you’ve subscribed, enquired, or otherwise given us your consent (including inferred consent from an existing relevant relationship), consistent with the Spam Act 2003 (Cth). Every marketing message we send will identify us and include a working unsubscribe option, and we will action unsubscribe requests promptly. We may still need to send you non-marketing, service-related communications (for example, about a Report you’ve commissioned) even after you unsubscribe from marketing.

12. Cookies and website analytics

Our website uses cookies and similar technologies (for example, through our GoHighLevel platform and website analytics tools) to help the site function, to understand how visitors use it, and to measure the performance of our own marketing. These may include tools that recognise repeat visits or track a form submission back to a particular marketing campaign. You can control or delete cookies through your browser settings; disabling them may affect how parts of the site function.

13. Accessing and correcting your personal information

You can ask us for access to the personal information we hold about you, and ask us to correct it if it’s wrong. Email [email protected] with your request. We’ll respond within a reasonable time (generally 30 days), and there’s no charge for making a request, though we may need to verify your identity first. If we refuse a request, we’ll tell you why.

14. How to make a complaint

If you think we’ve mishandled your personal information, please contact us first at [email protected] so we can try to resolve it directly — please include enough detail for us to understand and investigate the issue. We’ll acknowledge your complaint promptly and aim to resolve it within 30 days.

If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992

15. Children

Our website and Report Service are directed at business owners, accountants, and other adults in a business context. We don’t knowingly collect personal information from children.

16. Changes to this Policy

We may update this Policy from time to time — for example, as our services, our AI use, or the law changes. We’ll post the updated version on this page with a new “last updated” date. If a change is significant, we’ll take reasonable steps to bring it to your attention (for example, by email, for anyone with an active Report Service engagement).

17. How to contact us

SME Baseline

• Email: [email protected]
• Website: smebaseline.com.au
• App: app.smebaseline.com