Privacy Policy

1. Introduction

AdminZero ("we", "us", "our") operates the website getadminzero.com and the AdminZero application at app.getadminzero.com (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to protecting your privacy. Your financial data is sacred to us — we encrypt everything, minimise collection, and will never sell your data. By using AdminZero, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your name, email address, business name, ABN (Australian Business Number), phone number, and business address. This information is necessary to provide our invoicing and financial management services.

2.2 Financial Data

To provide our core services, we process the following financial data:

• Invoice details (client names, amounts, descriptions, payment status)
• Expense records (vendor names, amounts, categories, receipt images)
• Bank transaction data (imported via Basiq, a CDR-compliant intermediary)
• Tax estimates and BAS calculations (derived from your financial data)
• Subcontractor payment records and superannuation information

2.3 Bank Data

If you choose to connect your bank account, we access your transaction data through Basiq, an ACCC-accredited Consumer Data Right (CDR) intermediary. We only receive read-only access to transaction data — we can never move money or access your bank credentials. You can disconnect your bank at any time with one click.

2.4 Usage Data

We collect anonymised usage analytics (pages visited, features used, session duration) to improve the Service. We use PostHog for analytics. We do not sell this data to third parties.

2.5 Receipt Images

When you upload receipt images for expense tracking, we process them using AI (Claude Vision) to extract vendor, date, amount, and category information. Receipt images are stored securely in encrypted storage and are only accessible by you.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the AdminZero Service
• Generate invoices, track expenses, and calculate tax estimates on your behalf
• Send payment reminder emails to your clients (with your approval)
• Match bank transactions with your invoices and expenses
• Provide AI-powered categorisation and financial insights
• Send you account-related communications (e.g., BAS deadline reminders, billing notifications)
• Detect and prevent fraud or abuse of the Service

4. Data Security

We implement industry-standard security measures to protect your data:

• Encryption at rest: All data is encrypted using AES-256 encryption
• Encryption in transit: All communications use TLS 1.3
• Access control: Authentication via Clerk with support for multi-factor authentication (MFA)
• Payment processing: We never store or process credit card data directly — all payment processing is handled by Stripe, a PCI DSS-compliant provider
• Bank connections: Read-only access via CDR-compliant Basiq API — AdminZero can never move money

5. Data Sharing and Third Parties

We will never sell, trade, or rent your personal or financial data to third parties. In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, who will be bound by equivalent privacy obligations. We will notify you of any such transfer.

We share data only with the following service providers, solely to operate the Service:

• Supabase: Database hosting and file storage (encrypted)
• Clerk: Authentication and user management
• Stripe: Subscription billing and invoice payment processing
• Basiq: Bank account connection and transaction import (CDR-compliant)
• Anthropic: AI processing for invoice parsing, expense categorisation, and chat features
• Resend: Email delivery for invoices and payment reminders
• Vercel: Application hosting
• Sentry: Error monitoring (anonymised error data only)
• PostHog: Anonymised product analytics

Each provider is contractually obligated to protect your data and use it only for the purpose of providing their service to AdminZero.

6. AI and Your Data

AdminZero uses AI (powered by Anthropic's Claude) to provide features such as invoice parsing, expense categorisation, payment reminder composition, and the AI chat assistant. When processing your data through AI:

• Your data is sent to Anthropic's API solely for the purpose of processing your request
• Anthropic does not use your data to train their AI models (per their data usage policy for API customers)
• AI responses are generated in real-time and are not stored by the AI provider
• AdminZero is not a tax agent and AI outputs are not tax advice — always consult a registered tax professional

7. Data Retention

We retain your data for as long as your account is active or as needed to provide you the Service. Financial records are retained for a minimum of 5 years from the end of the relevant financial year, consistent with ATO record-keeping requirements.

We use soft deletes — when you delete data within the app, it is hidden from view but retained securely for compliance purposes. When you close your account, we will permanently delete all your personal data within 30 days, except where retention is required by law.

8. Your Rights

Under the Australian Privacy Act 1988, you have the right to:

• Access: Request a copy of all personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your account and personal data
• Export: Export all your financial data at any time in CSV or PDF format
• Withdraw consent: Disconnect your bank account or revoke any permissions at any time

To exercise any of these rights, contact us at privacy@getadminzero.com.

9. Cookies

AdminZero uses only essential cookies required for authentication and session management. We do not use advertising or tracking cookies. Our analytics provider (PostHog) uses privacy-focused, cookieless tracking.

10. Children's Privacy

AdminZero is a business tool and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children.

11. International Data Transfers

Your data may be processed in jurisdictions outside Australia (e.g., the United States, where some of our service providers are based). We ensure all international data transfers comply with the Australian Privacy Principles and that service providers maintain equivalent data protection standards.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or through a prominent notice on the Service. Your continued use of AdminZero after changes are posted constitutes acceptance of the updated policy.

13. Data Breach Notification

In the unlikely event of a data breach that is likely to result in serious harm, we will notify affected users and the Australian Information Commissioner as soon as practicable, in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, contact us at:

• Email: privacy@getadminzero.com
• Website: getadminzero.com

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).