Privacy Policy

1. Who we are

This Privacy Policy explains how XAIO Tech Pty Ltd (ABN 27 697 386 084) (“XAIO”, “we”, “us”) handles personal information. XAIO provides cloud-based business software for Australian businesses, including books (accounting), payroll, rostering and related insights.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy describes the kinds of personal information we collect, how we use and disclose it, how we keep it secure, and how you can access, correct or complain about our handling of it.

Postal address: Perth, Western Australia, Australia. Contact: [email protected].

2. The information we collect

The personal information we collect depends on how you interact with us:

• Interest registrations & enquiries: name, email, business name and any message you send when you register your interest or contact us.
• Account & profile data: for customers with access, your name, email, business details and authentication data.
• Business & financial data you enter: invoices, bills, transactions, bank-feed data, payroll and accounting records you create or import.
• Employee & payroll data processed on behalf of customers: where a customer uses XAIO to run payroll, we process information about their employees (name, contact details, pay, superannuation, tax details and Tax File Numbers). For this data the customer is responsible for the information and the lawful basis for providing it to us; we process it on the customer’s instructions.
• Usage & device data: log files, device and browser information, and IP address.

3. Tax File Numbers (TFNs)

TFN information is sensitive and is protected by the Privacy (Tax File Number) Rule 2015 in addition to the Privacy Act. Because XAIO is payroll software, we may handle employees’ TFNs on behalf of our customers. We commit that:

• TFNs are collected and used only for payroll and tax-reporting purposes (for example, Single Touch Payroll reporting), never for identification or marketing.
• TFNs are encrypted at the application layer (AES-256) and stored as ciphertext; they are masked in the interface and access is restricted.
• We do not use a TFN as a general identifier and we do not disclose it except as required or authorised by law (for example, to the ATO as part of payroll reporting the customer instructs).

4. How we use your information

• To provide, operate and improve the service;
• To respond to interest registrations, enquiries and support requests;
• To process payments and administer subscriptions (when launched);
• To perform tasks you instruct, such as preparing payroll or Single Touch Payroll reporting;
• To send you transactional and service messages; and
• To meet our legal and regulatory obligations.

5. When we disclose information

We do not sell your personal information. We disclose it only as needed to run the service or as required by law:

• To the ATOwhere a customer instructs us to lodge payroll information (such as Single Touch Payroll reporting). We act as the customer’s software provider on their instruction; XAIO is not a registered tax agent.
• To service providers (subprocessors) who help us run the service, under contractual data-protection obligations. These currently include: Supabase (database and authentication. AWS Sydney, ap-southeast-2), Vercel (web hosting and compute), Stripe (payments), Resend (transactional email), Anthropic, OpenAI and Google (AI processing, only when AI assistant features are used), and SISS Data Services / ACSISS (bank feeds via the Consumer Data Right, only when bank feeds are connected). Where enabled by the customer, Ozedi may be used as the ATO lodgement gateway for Single Touch Payroll. All subprocessors are engaged under contractual data-protection obligations.
• Where required by lawe.g. to comply with a court order, subpoena or regulator request.

6. Sending information overseas (APP 8)

We store your business and account data in Australia. The database and authentication infrastructure is hosted via Supabase on Amazon Web Services in the Sydney region (ap-southeast-2). Web hosting and compute run via Vercel (Sydney region, syd1).

However, some optional AI assistant features send the specific content you ask the assistant to work with to third-party AI providers (such as Anthropic, OpenAI and Google). Depending on the provider and feature, that processing may occur outside Australia. We only use these features where you or your administrator have them enabled, and we work to minimise the personal information involved. If you do not want any data processed overseas, you can avoid using the AI assistant features.

7. How we protect your information (APP 11)

We take reasonable steps to protect personal information, including:

• Encryption in transit (TLS) and encryption at rest provided by our cloud platform;
• Application-layer encryption of especially sensitive fields such as TFNs;
• Tenant scoping applied in our application layer, so each customer’s data is separated on every request;
• Access controls and optional two-factor authentication; and
• Logging of changes to key records.

We align our security practices with the ATO’s Digital Service Provider Operational Security Framework. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Data breaches

We are subject to the Notifiable Data Breaches scheme under the Privacy Act. If we become aware of a data breach that is likely to result in serious harm to affected individuals, we will assess it promptly and, where required, notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable.

9. Accessing, correcting and complaining (APP 12–13)

You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date or incomplete. Email [email protected] and we will respond within a reasonable period (usually within 30 days).

Where we process employee data on behalf of a customer, please direct access and correction requests to that customer (the employer), who controls that information.

If you are concerned about how we have handled your personal information, contact us first. If you are not satisfied with our response, you can complain to the OAIC at oaic.gov.au.

10. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in and the site secure. We do not currently use analytics or advertising cookies. For full detail and to manage your preferences, see our Cookie Policy.

11. How long we keep information

We keep personal information for as long as needed to provide the service and to meet legal obligations. Financial and payroll records are generally retained for at least 5–7 years to meet Australian tax and record-keeping requirements. You may request deletion of your information at any time by emailing [email protected]. We record the request and apply a 30-day cooling-off period, during which you can cancel it; an administrator then carries out the deletion. Security and audit records, and any other information we are required to retain by law, are kept for their stated periods even after a deletion is carried out.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and update the effective date above; where changes are material we will take reasonable steps to notify you.

13. Contact us

For privacy questions or to exercise your rights, contact us at [email protected] or by post at Perth, Western Australia, Australia.