ApexLedger

This Privacy Policy explains how ApexLedger (“we”, “us”, “our”), operated by [YOUR LEGAL NAME], ABN [ABN], collects, uses, stores, discloses and protects your personal information. We are an Australian bookkeeping and management-accounting practice (not currently a registered tax or BAS agent) providing bookkeeping, budgeting and management-accounting services through our web portal and mobile app.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and by the Privacy (Tax File Number) Rule 2015 in relation to tax file numbers. By using the ApexLedger app or portal, you agree to the handling of your information as described here.

1. Information we collect

Depending on the services you use, we may collect:

• Identity & contact information — name, email, phone, business/entity name and ABN.
• Tax file numbers (TFNs) — where required to prepare or lodge your returns or activity statements. TFNs are sensitive information subject to the specific safeguards in section 5 below.
• Financial information — income and expense transactions, account balances, budgets, bank statement data you import, GST and BAS figures, and tax return details.
• Documents you or we upload — receipts, invoices, identity documents, contracts, tax and BAS forms, and related correspondence.
• Messages — communications you send us through the in-app/portal chat.
• Technical & usage information — log data such as access times, device/browser type, and an audit log of document access (who viewed or downloaded a document, and when) for security.

2. How we collect it

We collect information directly from you when you create an account, complete onboarding, enter transactions, upload documents or message us. We also generate information in the course of providing services (for example, reports, tax estimates and BAS calculations). Where lawful and practicable, we collect information about you only from you.

3. Why we use your information

• To provide the app and portal — tracking your finances, producing reports, and preparing and lodging tax returns and BAS.
• To communicate with you about your engagements, obligations and due dates.
• To meet our legal, regulatory and professional obligations (including as a registered agent with the Tax Practitioners Board and the ATO).
• To secure the platform, maintain audit records, and prevent misuse.

We do not sell your personal information, and we do not use it for third-party advertising.

4. Disclosure of your information

We may disclose your information to:

• The Australian Taxation Office and other government agencies, where required to lodge or as authorised by you.
• Service providers who host and run the platform — principally our database, authentication and file-storage provider (Supabase), whose data for this project is hosted in the Sydney (Australia) region. These providers process data on our instructions under confidentiality obligations.
• Others you authorise, or where we are required or permitted by law.

5. Tax file numbers

We handle TFNs strictly in accordance with the Privacy (Tax File Number) Rule 2015. Your TFN is validated, encrypted, and stored only in encrypted form using an encryption key held separately in a secured key vault — it is never stored in plain text. You are not required by law to provide your TFN; declining to do so may limit the tax services we can provide. We use your TFN only for authorised tax-related purposes and never as a general identifier.

6. Security

We take reasonable steps to protect your information, including:

• Hosting data in Australia (Sydney region) with encryption in transit and at rest.
• Row-level security so each client can access only their own records, and staff access is limited to their practice.
• Encrypted TFN storage with keys held in a separate vault.
• An access log recording document views and downloads.
• Access controls, authentication, and private file storage with time-limited signed links.

No method of transmission or storage is completely secure. If we become aware of a data breach likely to result in serious harm, we will respond in accordance with the Notifiable Data Breaches scheme.

7. Overseas disclosure

We store your data in Australia. Some of our service providers are incorporated overseas (for example, in the United States) even though the data for this project is hosted in the Sydney region. Where any provider may access data from overseas, we take reasonable steps to ensure it is handled consistently with the APPs.

8. Retention

We keep your information for as long as needed to provide our services and to meet our legal and professional record-keeping obligations (tax records are generally required to be kept for at least five years). When no longer required, we take reasonable steps to destroy or de-identify it. Documents and client records are soft-deleted and may be retained for these periods before permanent deletion.

9. Accessing and correcting your information

You can view and update much of your information directly in the app or portal. You may also request access to, or correction of, the personal information we hold about you by contacting us (details below). We will respond within a reasonable period and may need to verify your identity first. If we decline a request, we will explain why.

10. Cookies and analytics

The portal uses only the cookies/local storage necessary to keep you signed in. We do not use third-party advertising trackers.

11. Complaints

If you have a privacy concern or complaint, please contact us first (below) and we will aim to resolve it promptly. If you are not satisfied, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

12. Changes to this policy

We may update this policy from time to time. The current version is always available at this page, and we will note the “Last updated” date above. Material changes will be communicated where appropriate.

13. Contact us

Privacy Officer, ApexLedger
Email: [PRIVACY EMAIL]
[ADDRESS], Sydney, Australia