Privacy Policy

1. Information we collect

• Account information — your name and email address, via our authentication provider (Clerk).
• Xero data (read-only) — with your authorisation we access employer and employee payroll and accounting data, including pay runs, superannuation line items and funds, employee records, and bank transactions, to compute super deadlines and payment status.
• Billing information — handled by Stripe. We receive your subscription status and a customer identifier, but we do not store your full payment card details.
• Usage and device data — pages viewed and basic product analytics via PostHog, plus cookies and similar local storage.

2. How we use your information

We use it to provide and operate the Service, compute compliance status and exposure, send deadline alerts and client reminders, draft reminder messages for your review, process payments, support you, and improve the product.

3. AI processing

To draft client reminder (“nudge”) messages, we may send relevant client and compliance details to AI providers (Anthropic, accessed via OpenRouter). This is used solely to generate drafts that you review before anything is sent, and is not used to train their public models under their API terms.

4. Who we share it with

We use trusted third-party providers to run the Service and do not sell your information. These include:

• Clerk — authentication
• Xero — your connected data source
• Stripe — payment processing
• Resend — email delivery
• PostHog — product analytics
• Anthropic / OpenRouter — AI drafting of reminders
• Neon — database hosting
• Vercel — application hosting

5. Where your data is stored

Our primary database is hosted in Sydney, Australia (Neon). Some providers process data overseas, including in the United States (for example Stripe, PostHog, Vercel, and Anthropic). By using the Service you consent to these overseas disclosures (APP 8), and we take reasonable steps to ensure your information is handled appropriately.

6. Security

We use reasonable technical and organisational measures to protect your information; for example, Xero access tokens are stored encrypted. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Retention

We keep your information while your account is active and for as long as needed to meet legal, accounting, or reporting obligations. We delete or de-identify it on request where we are not required to retain it.

8. Your rights

You may request access to, or correction of, the personal information we hold about you. If you believe we have breached the APPs, contact us first; if your concern is unresolved, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. Cookies

We use cookies and similar storage for login/session management and analytics. You can control cookies through your browser settings, though some features may not work without them.

10. Children

The Service is intended for businesses and professionals and is not directed at anyone under 18.

11. Changes & governing law

We may update this policy from time to time and will take reasonable steps to notify you of material changes. This policy is governed by the laws of New South Wales, Australia.