LABX Capital Pty Ltd (trading as Kapio) · ABN 50 691 135 752 · Version 1.4 · Effective 1 July 2025 · Last updated 9 October 2026
LABX Capital Pty Ltd ("Kapio", "we", "us", "our") is committed to protecting the privacy of the businesses we work with. We manage your business information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
This Privacy Policy outlines how we collect, use, disclose, and store business-related and credit-related information. It applies wherever you use Kapio: on our website, in the client portal, and in the Kapio mobile app (the "App").
We collect business-related and commercial credit information about your organisation and its directors or authorised representatives. This information may include:
Where you use the App on a phone or tablet, we also collect a small amount of device information:
When you give a consent, such as your consent to a credit check, in the App or in the client portal, we record it with the time, your IP address, and the identifier your browser or the App sends with the request, so we can show when and how the consent was given.
The App carries no advertising or analytics trackers, and it does not collect your fingerprint, face, or any other biometric data, your location, contacts, or health data. It receives a photo or a file from your phone only when you choose to send it. Section 6 explains how the App handles your device in more detail.
Our website is different. It uses cookies and similar technologies, including Google Analytics and the Meta Pixel, and section 7 explains what they collect and how to opt out.
We collect information directly from authorised representatives of your business through our online platform, the Kapio app, application forms, emails, calls, and meetings. We may also obtain information from:
When you visit our website, some information about your visit is also collected automatically through cookies and similar technologies, as section 7 explains.
We collect, use and disclose business information to:
With your authorisation, we collect your business's bank account and transaction data to assess finance applications, understand your cash flow, and monitor the financial health of your business. We may collect this data in the following ways:
Your bank data is used only for the purposes you have consented to. You may withdraw your consent at any time by contacting us, after which we will stop collecting new data and will delete or de-identify the data we hold, unless we are required to retain it by law. Where data is collected under the CDR, we handle, store, retain and delete it in line with your CDR consent and the CDR Rules.
The App gives you the same client portal from your phone. A few things work differently on a device, and this section explains them.
The App can lock behind Face ID or Touch ID on an iPhone, fingerprint or face unlock on an Android phone, or your device passcode. It is off until you switch it on in the App's Settings, and once on, the App locks whenever it moves to the background.
The check is performed entirely by your device. Kapio never sees, receives, or stores your face or fingerprint data. Your device simply tells the App whether the unlock succeeded. Your biometric data never leaves your device, and it is never sent to us or to anyone else. Because your device performs the check, anyone whose face or fingerprint is enrolled on that device, and anyone who knows the device passcode, can unlock the App. You can switch the feature off again at any time in Settings.
If you allow notifications, your device issues a push token that we store against your account, along with the platform and your device model, so we know where to send them. The token identifies a device, not you personally. We use it only to deliver Kapio notifications about your applications and account, never for advertising, and we do not sell or share it with advertisers or data brokers.
Notifications are delivered through our notification service provider (currently Expo) and then Apple Push Notification service on an iPhone, or Google's Firebase Cloud Messaging on an Android phone, so the title and text of a notification pass through those services on the way to your phone. We keep that content brief for the same reason. Notifications may also appear on your lock screen; if you would rather they did not, turn off lock-screen previews for the App in your device settings.
You can withdraw notification permission at any time in your device settings. If you delete the App, your token stops working and we remove it the next time we try to use it. You can also ask us to remove any registered device by contacting our Privacy Officer.
When your broker asks for a document, such as your driver licence or a bank statement, you can send it from the App by taking a photo with your camera, choosing photos from your photo library, or choosing a file such as a PDF, Word, Excel, CSV, or text file. The App uses the camera, the photo picker, and the file picker only when you choose to send a document this way, and nothing is uploaded unless you send it.
Choosing a photo or a file opens your device's own picker, and the App receives only the photos or files you pick, never the rest of your library. What you send goes to your broker with your reply and is kept in your documents with us, and we handle it as we handle any other document you give us under this policy.
The App stores your sign-in session on your device in encrypted form, with the encryption key held in your device's own secure storage: the keychain on an iPhone, or the Android Keystore on an Android phone. It also stores small preferences, such as whether biometric unlock is on, and which insights you have dismissed. Your account information itself is fetched from us each time you open a screen and is not written to your device.
When you send a photo or a document, the App keeps a temporary copy while it gets the file ready and sends it, and deletes that copy once it has been sent, or once you take it out or leave the screen without sending it.
What is held on the device is protected by your device's own security. Your sign-in session is removed when you sign out, and everything the App holds is removed when you delete the App. On an Android phone, the phone's own backup to your Google account may include the App's small preferences, but never the key that unlocks your sign-in session. Deleting the App does not delete the information we hold; see section 13.
The App asks for a permission only when a feature needs it: notifications; Face ID, Touch ID, or fingerprint or face unlock, if you turn biometric unlock on; and the camera, if you choose to photograph a document. Where your device asks for your permission, you are free to decline, and you can change your mind later in your device settings. If you decline the camera, you can still choose a photo or a file instead.
The App does not ask for your microphone, location, contacts, or health data, and it does not track you across other apps or websites. If we add a feature that needs another permission, your device will ask your permission first, you will be free to decline, and we will update this policy before the feature ships.
Our website uses cookies and similar technologies from Google and Meta, and on some pages from Contentsquare and Intercom. A cookie is a small file that a website stores in your browser so it can recognise that browser when you come back. These tools run across our website, including our home page, our app download page, our sign-up pages, and the client portal when you use it in a web browser.
None of these tools are part of the App. If you open one of our web pages from the App, such as this policy, it opens in a browser window and works like any other page on our website.
When you visit a page that uses Google Analytics or the Meta Pixel, they collect:
We do not send Google or Meta your name, email address, or financial information. If you are signed in to Facebook or Instagram in the same browser, Meta may be able to connect what the Pixel collects to your Meta account.
If you follow a link with campaign details to our app download page and then tap the Google Play button, we pass those campaign details to Google Play, so that Google Play can tell us which campaigns lead to downloads. We pass on only the campaign details, nothing about you.
We use Google Analytics to understand how people find and use our website, so we can improve it. We use the Meta Pixel to measure and improve our advertising on Facebook and Instagram: to see which ads lead people to visit our website, download the App, or sign up, and to help Meta show our ads to people likely to be interested, which can include people who have already visited our website.
Meta may also use this information for its own purposes under its own privacy policy, for example to personalise the ads you see on Facebook and Instagram, to measure ads, and to improve its own products. Google handles Google Analytics information under its own privacy policy.
On the client portal, our sign-up pages, and a few other pages, we also use:
Google, Meta, Contentsquare, and Intercom may store or process this information outside Australia, including in the United States and Europe. Section 8 explains how we handle disclosure overseas.
Opting out of interest-based advertising does not stop you seeing ads, including ours. It means the ads you see are less likely to be based on your visits to our website.
We may disclose your business information to:
Some of our third-party service providers may store or process data overseas, including in the United States, Singapore, or other jurisdictions. Where we disclose information to overseas recipients, we take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles (including Australian Privacy Principle 8). Bank data collected under the Consumer Data Right is not disclosed overseas except as permitted by the CDR Rules.
When acting on your business's behalf or as an agent for a credit provider, we may request credit reports or disclose information to a Commercial Credit Reporting Service.
With your consent, we also get your personal credit report and score from Experian on your behalf, through a soft check that does not affect your credit score. We keep the score with your account and use it to work out which finance options suit your business.
Your business and its directors have rights to:
Refer to the websites of CRBs such as www.mycreditfile.com.au or www.experian.com.au for more details.
By engaging with Kapio and providing your business information, you expressly:
You may withdraw your consent at any time by contacting our Privacy Officer.
We store business information in physical and digital formats. We implement industry-standard measures to secure your data, including:
We retain your business information only as long as legally necessary or until no longer required for its intended purpose.
Your authorised representatives may:
Email: hello@kapio.com.au
Phone: 0485 982 478
Address: Level 8, 88 Langridge Street, Collingwood VIC 3066
We will respond to your request or complaint within a reasonable timeframe, typically within 30 days.
Deleting the App from your device removes the information held on that device and stops notifications reaching it, but it does not close your account or delete the information we hold. To do that, contact our Privacy Officer as set out below.
You may close your Kapio account, or request that we delete the business information we hold about you, at any time by contacting our Privacy Officer using the details above. We will action your request within a reasonable timeframe.
Step-by-step instructions, including how to request deletion from inside the App, are on our Delete your account page.
Some information may need to be retained after your account is closed, for example to comply with tax, corporations, or credit reporting law, or where we reasonably need it to resolve a dispute or enforce our agreements. Where this applies, we will restrict that information to only what is legally required and will not use it for any other purpose.
You may opt out of receiving marketing communications at any time by contacting us or using the "unsubscribe" link provided in our emails.
Push notifications can be turned off at any time in your device settings, and the App's Settings screen has its own switch for email and SMS notifications. Messages about your applications and account are part of the service rather than marketing, but turning notifications off stops them reaching your phone. The same information is still available when you sign in.
To limit how information from our website is used to show you ads, see the choices in section 7.
We may amend this Privacy Policy from time to time to reflect changes in law or our business practices. The most up-to-date version will always be available at kapio.com.au/privacy.
If you require further clarification or wish to discuss our privacy practices, please contact us at hello@kapio.com.au.
Connect your business in a couple of minutes and see where you actually stand. Free to get started, and nothing touches your credit file.