Privacy Collection & Disclosure Statement

1. Collection of Personal Information

We may collect personal information directly from you when you:

• Register for an account as a tradesperson, small business owner, or independent contractor
• Subscribe to our bookkeeping services or make payments
• Upload receipts, invoices, bank statements, or other business financial documents
• Use our AI-powered expense categorisation and GST calculation features
• Share your financial data with your accountant or tax agent through our platform
• Contact us for customer support or general enquiries
• Interact with our digital platforms (via cookies, analytics, or third-party integrations)

The types of personal information we collect may include:

• Contact Information: Your name, email address, phone number, and business address
• Payment Information: Billing details processed securely through third-party providers (Stripe/RevenueCat) – we do not store your complete payment card details
• Business Information: ABN, business name, trading name, industry type, and business structure
• Financial Documents: Uploaded receipts, invoices, bank statements, tax invoices, and related documentation
• Tax Information: GST registration status, BAS, and tax-related business records
• Accountant Details: Contact information for your registered tax agent or accounting professional
• Technical Information: IP address, device identifiers, app usage logs, and website analytics data
• Account Data: Login credentials, account preferences, and usage patterns

2. Purpose of Collection

We collect this information to:

• Deliver our AI-powered bookkeeping services tailored for tradies and small businesses
• Automatically categorise business expenses and calculate GST components
• Generate BAS-ready reports and summaries for tax compliance
• Enable secure data sharing with your accountant or registered tax agent
• Authenticate your identity and maintain robust account security
• Process subscription payments and manage billing arrangements
• Provide technical support and respond to customer enquiries
• Improve our services through analytics and user feedback
• Send service updates and account notifications
• Comply with taxation and small business regulatory requirements
• Assist with end-of-financial-year reporting and tax preparation

3. Disclosure of Personal Information

We may disclose your personal information to:

• Your authorised representatives (accountants, tax agents)
• Technology partners (cloud hosting, AI services)
• Payment processors (Stripe, RevenueCat)
• Professional service providers (IT, legal, accounting)
• Analytics partners
• Regulatory authorities (ATO, ASIC) where legally required
• Law enforcement or courts when compelled
• Other parties where you provide explicit written consent

We do not sell or commercially exploit your personal information.

4. Overseas Data Processing

Some trusted service providers may process your information outside Australia (e.g., US, Singapore, EU). We ensure providers meet Australian Privacy Principles and apply safeguards.

5. Consequences of Not Providing Information

If you do not provide certain information, we may be unable to:

• Grant full access to the platform
• Accurately categorise expenses or calculate GST
• Generate BAS-ready reports
• Enable secure accountant data sharing
• Process payments or maintain service delivery
• Provide customer support
• Comply with legal record-keeping obligations

6. Access and Correction Rights

You may request access to or correction of your information by contacting us at:

7. Data Security and Retention

• Data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption
• Multi-factor authentication
• Regular security audits
• Secure backups and recovery procedures

We retain data for as long as necessary, typically 7 years under tax laws. Consumer Data Right (CDR) data is subject to separate, stricter retention and deletion rules — see section 8 below and our Data Retention and Deletion Policy.

8. Consumer Data Right (CDR) Data

If you connect a bank account for automated transaction feeds, that data is provided to us under the Consumer Data Right (CDR) through Fiskil Pty Ltd, an Accredited Data Recipient under the CDR framework administered by the ACCC. Instant Receipts Pty Ltd acts as a CDR Representative of Fiskil for this purpose and is not itself accredited under the CDR.

• CDR data is stored exclusively in Australia and is never transferred, stored, or processed overseas.
• CDR data is never used to train or improve any AI or machine learning model.
• CDR data is retained only for the duration of your consent (up to 6 months) and is permanently and irretrievably deleted — not de-identified or archived — when consent is withdrawn, expires, or your account is closed. You can withdraw consent at any time within the app.
• Fiskil's own CDR Policy, which explains how Fiskil (and Instant Receipts as its CDR Representative) collects, holds, uses and discloses CDR data, is available at fiskil.com/legal/cdr-policy.

9. Notifiable Data Breaches

We comply with the NDB scheme under the Privacy Act 1988: assessing breaches, notifying OAIC and affected users, and keeping records.

10. Your Privacy Rights

• Access, correction, erasure
• Data portability
• Restriction/objection rights
• Complaint rights (with us or OAIC)

11. Cookies and Tracking Technologies

We use cookies to enable functionality, remember preferences, analyse traffic, improve AI, and personalise services.

12. Automated Decision-Making and AI Processing

Our AI extracts receipts, categorises expenses, calculates GST, generates reports, and detects anomalies. You can request human review of significant automated decisions. Consumer Data Right (CDR) data obtained via bank feed connections is never used for this purpose — see section 8.

13. Third-Party Integration

• Accounting (Xero, MYOB, QuickBooks)
• Open banking / Consumer Data Right (CDR) data access via Fiskil, our accredited CDR data recipient partner
• Tax preparation tools
• Payment platforms (Stripe, RevenueCat)
• Professional networks (accountants, tax agents)

14. Marketing Communications

With consent, we may send product updates, compliance tips, EOFY reminders, and promotions. You may unsubscribe anytime.

15. Business Transfers

In a merger, acquisition, or sale, personal information may be transferred with notice provided.

16. Children’s Privacy

Services are not for users under 18. We do not knowingly collect children’s data.

17. Contact Information and Complaints

18. Further Information

Our Privacy Policy provides additional details. For questions, contact us using the details above.