Terms of Service

Corvana Pty Ltd (ABN pending) ("Corvana", "we", "us", "our") operates the Corvana business intelligence platform accessible at corvana.com.au and related services (the "Platform").

By accessing or using the Platform, you ("User", "you", "your") agree to be bound by these Terms of Service ("Terms"). If you are using the Platform on behalf of a business entity, you represent that you have the authority to bind that entity to these Terms.

If you do not agree to these Terms, you must not access or use the Platform.

Corvana provides an AI-powered business intelligence platform for Australian small and medium enterprises (SMEs). Our services include:

• Customer Relationship Management (CRM) with contacts, deals, and pipeline management
• AI-powered analytics assistant ("Cory") providing business insights and recommendations
• Industry benchmarking against Australian Taxation Office (ATO) data across 22+ ANZSIC divisions
• Predictive analytics including revenue forecasting, churn detection, and CLV modelling
• Third-party integrations with accounting, POS, workforce, and marketing platforms
• Campaign management, email marketing, and client onboarding tools
• Website SEO monitoring via Google Search Console integration

3.1. You must provide accurate, complete information when creating an account. You are responsible for maintaining the confidentiality of your credentials and for all activities under your account.

3.2. Role-Based Access: Corvana implements role-based access control (RBAC). Account owners may invite staff with restricted permissions. Owners are responsible for managing their team's access levels.

3.3. Two-Factor Authentication: We offer TOTP-based two-factor authentication for enhanced account security. We recommend enabling 2FA for all admin accounts.

3.4. You must notify us immediately at security@corvana.com.au of any unauthorised use of your account.

Corvana connects with third-party services to provide a unified business intelligence experience. When you connect an integration, you authorise Corvana to access data from that service on your behalf, subject to the permissions you grant.

4.1. Accounting & Financial Integrations

• MYOB — OAuth-connected accounting data (invoices, expenses, contacts). Subject to MYOB Terms of Use.
• Xero — OAuth-connected accounting data. Subject to Xero Terms.
• QuickBooks — OAuth-connected accounting data. Subject to Intuit's Terms of Service.

4.2. Google Services

• Google Search Console — Read-only access (webmasters.readonly scope) to website search performance data. We access: search queries, click/impression data, page performance, crawl stats. This data is used solely to display SEO analytics within your Corvana dashboard. Subject to Google API Services User Data Policy.
• Google Analytics — Optional OAuth connection for traffic analytics. Read-only access to audience and behaviour data.

4.3. Payment Processing

• Stripe — Payment processing for subscriptions and billing. Corvana does not store credit card numbers. Subject to Stripe's Terms of Service.

4.4. AI & Machine Learning

• OpenAI — Powers the Cory AI assistant. Business data is processed through PII masking before being sent to the AI model. Subject to OpenAI Terms of Use. See Section 6 for data masking details.

4.5. Additional Integrations

Corvana also supports integrations with: Square, Shopify, Deputy, Tanda, Cliniko, HubSpot, Salesforce, Pipedrive, Zoho, Calendly, Uber Eats, DoorDash, Mindbody, Cin7, Lightspeed, and Basiq (open banking). Each integration operates under the respective provider's terms of service and data policies. You can manage and revoke integration connections at any time from your dashboard.

5.1. The Cory AI assistant uses large language models (LLMs) to provide business insights, analysis, and recommendations based on your business data.

5.2. PII Data Masking: Before any business data is sent to AI models, Corvana applies automatic PII (Personally Identifiable Information) masking to protect sensitive data. The following data types are detected and masked:

• Email addresses
• Phone numbers
• Australian Business Numbers (ABN)
• Tax File Numbers (TFN)
• Credit card numbers
• Bank account numbers (BSB + account)
• Medicare numbers

5.3. AI-generated content, predictions, and recommendations are provided for informational purposes only and should not be relied upon as the sole basis for business decisions.

5.4. No AI Model Training: Your business data is NOT used to train, fine-tune, or improve AI models. Data is processed for response generation only and is not retained by the AI provider after response completion.

Corvana implements layered, defence-in-depth security controls to protect your data:

• Encryption at Rest: Sensitive database fields are encrypted using AES-256-GCM
• Encryption in Transit: All data is transmitted over HTTPS with HSTS enforcement
• Password Security: Passwords are hashed using Bcrypt (12 rounds) and never stored in plaintext
• Brute-Force Protection: Exponential backoff with account lockout after repeated failed attempts
• Token Security: JWT tokens with 8-hour expiry and SHA-256 blacklisting on logout
• Input Sanitisation: All inputs are sanitised against XSS and NoSQL injection attacks
• Security Headers: HSTS, X-Frame-Options DENY, Content-Security-Policy, X-Content-Type-Options, X-XSS-Protection
• Audit Logging: All API requests are logged with IP address, user, method, path, status code, and duration
• Rate Limiting: Authentication and registration endpoints are rate-limited to prevent abuse
• PII Data Masking: Automatic detection and masking of 7+ PII types before AI processing

7.1. While we source data from trusted government and industry sources (including the Australian Taxation Office), Corvana does not guarantee the absolute accuracy, completeness, or timeliness of any data.

7.2. Industry benchmarks are derived from publicly available ATO data and may not reflect your specific business circumstances.

7.3. To the maximum extent permitted by Australian law, Corvana shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of the Platform, reliance on data or analytics, or business decisions made based on Platform information.

You agree not to:

• Use the Platform for any unlawful purpose
• Attempt to gain unauthorised access to the Platform or its systems
• Reverse engineer, decompile, or disassemble the Platform
• Use automated tools to scrape or extract data from the Platform
• Transmit malware, viruses, or other harmful code
• Impersonate another user or entity
• Use the Platform to send spam or unsolicited communications
• Circumvent security measures, rate limits, or access controls

9.1. The Platform, including all software, content, design, and documentation, is owned by Corvana and protected by Australian and international intellectual property laws.

9.2. Your business data remains your property. You grant Corvana a limited licence to process and display your data solely for the purpose of providing the Platform's services.

9.3. Data sourced from third parties (ATO benchmarks, integration data) remains the property of those respective sources.

10.1. Corvana offers subscription plans billed monthly or annually. Pricing is displayed on our website and may change with 30 days' notice.

10.2. Payments are processed securely via Stripe. Corvana does not store your full credit card information.

10.3. You may cancel your subscription at any time. Access continues until the end of the current billing period. No refunds are provided for partial billing periods.

10.4. We reserve the right to suspend accounts with outstanding balances after 30 days.

11.1. You may terminate your account at any time by contacting us or using the account settings.

11.2. Corvana may suspend or terminate your access if you breach these Terms, engage in fraudulent activity, or for legal or security reasons.

11.3. Upon termination, you may request export of your data within 30 days. After this period, data may be deleted in accordance with our retention policy.

We may update these Terms periodically. Material changes will be communicated via email or in-app notification at least 14 days before taking effect. Continued use of the Platform after changes constitutes acceptance.

13.1. These Terms are governed by the laws of New South Wales, Australia.

13.2. Any disputes shall first be resolved through good-faith negotiation. If unresolved, disputes shall be subject to the exclusive jurisdiction of the courts of New South Wales.

13.3. Nothing in these Terms excludes or limits consumer guarantees under the Australian Consumer Law.

For questions about these Terms:

• Email: legal@corvana.com.au
• Support: support@corvana.com.au
• Security: security@corvana.com.au
• Website: corvana.com.au