Privacy Policy

“Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable. This may include, but is not limited to, names, email addresses, phone numbers, business details, and financial and accounting information.

Information we may collect directly from you:

• Full name and business name
• Business and personal address
• Email address and phone number
• Device and connection information (IP address, browser type, pages visited)
• Billing information (processed via third-party payment providers — see Section 5)
• Details of services we have provided or that you have enquired about
• Information provided through support requests or surveys
• Any other information you provide to us in the course of using our services

How we collect personal information:

We collect personal information by lawful and fair means. We may collect information when you:

• Register for or use FINYR
• Contact our support team
• Visit our website
• Interact with our platform features, including AI-powered tools

Artificial intelligence and automated tools:

FINYR uses artificial intelligence (AI) tools to assist with the delivery of our services. These tools may process information to assist with tasks such as:

• Reviewing and categorising accounting transactions
• Drafting correspondence and summarising client interactions
• Automating compliance workflows and job management tasks

Our AI assistant processes data stored within FINYR only. It does not access live financial data from Xero or other connected accounting platforms. Queries submitted to our AI assistant are processed by external AI service providers under their own data processing terms.

Prior to any information being submitted to third-party AI processing services, FINYR applies a de-identification process designed to remove or suppress personal information. As a result, information transmitted to third-party AI providers is not, to the best of our knowledge and in the ordinary course of operations, personal information as defined under the Privacy Act 1988 (Cth).

Notwithstanding the above, all information handled in connection with our AI-assisted features is treated as confidential and managed in accordance with this Policy and applicable Privacy Laws. We do not use AI to make decisions that have a legal or similarly significant effect on individuals without human review.

We will update this Policy if our AI processing practices materially change.

You may choose not to provide personal information, but this may limit our ability to provide you with our services.

Through your use of FINYR, you may provide us with personal information about your clients or other third parties. If you do so, you must ensure you are authorised to disclose that information and that the individual is aware of, and has consented to, the collection and use of their information as described in this Policy.

Where you enable the Xero XPM Client Sync add-on, FINYR will import a limited set of client information from your Xero Practice Manager account. The information imported is limited to: client name, email address, and date of birth. No other Xero client data is accessed or stored by FINYR. This integration is an optional add-on and is entirely user-initiated. You are responsible for ensuring you have the appropriate authority to connect your Xero account and that your clients' information is handled in accordance with your own privacy obligations.

You are responsible for ensuring that any personal information you provide about others is accurate, up-to-date, and complete.

We collect and use personal information only for the purposes for which it was collected, or for purposes that are directly related. This includes to:

• Verify your identity and manage your account
• Provide, operate, and improve our platform and services
• Process billing and payments
• Respond to your enquiries and provide technical support
• Send you service notifications and updates relevant to your account
• Conduct analytics and research to improve our services
• Comply with our legal obligations

Direct marketing:

Where we have your consent, or where otherwise permitted by law, we may use your personal information to send you information about products or services we believe may be of interest to you. You may opt out of marketing communications at any time by following the unsubscribe instructions in our communications or by contacting us at privacy@finyr.com.au.

Even if you opt out of marketing, we may still contact you with important notices about our services, including security updates or material changes to our terms.

We do not intentionally collect sensitive personal information (such as information about health, race, religion, political views, or financial account credentials beyond what is necessary to process payments). Please do not submit sensitive personal information through our platform unless specifically requested and required for the provision of our services.

We use third-party payment processors to handle payment transactions. We do not store your full payment card details. You should review the privacy policies of our payment processors for information on how they handle your data. Our current payment processors include:

• Stripe: stripe.com/au/privacy
• Xero App Store: xero.com/au/legal/terms

We use cookies and similar technologies to operate and improve our website and services. Cookies help us identify users, remember preferences, and analyse usage patterns. You may disable cookies in your browser settings, but this may affect the functionality of our services.

Our servers automatically log certain information when you use FINYR, including your IP address, browser type, pages visited, and interaction data. Log data is used to monitor, maintain, and improve our platform and is handled in accordance with this Policy.

We only disclose your personal information to third parties where it is necessary to deliver our services or as required by law. This may include disclosures to:

• Xero, AWS (Amazon Web Services), Stripe, OpenAI, Google (Gmail, Google Drive), Microsoft (Outlook, OneDrive), and other third-party service providers and integrations that form part of our platform ("Authorised Recipients")
• Professional advisers (legal, accounting, or audit) where necessary
• Regulatory or law enforcement bodies where required by law

We take reasonable steps to ensure Authorised Recipients handle your personal information consistently with applicable Privacy Laws. We will not sell your personal information to third parties.

Where we engage third-party AI service providers as part of our platform, we take contractual and technical measures to limit the personal information those providers can access. Our agreements with such providers prohibit the use of any information submitted through our platform for purposes other than providing the relevant service to us.

Where you choose to connect a third-party account to FINYR, including Xero (XPM Client Sync), Google (Gmail, Google Drive), or Microsoft (Outlook, OneDrive), you authorise us to access and process information held in those accounts solely for the purpose of delivering the features you have enabled. All third-party integrations are entirely optional and user-initiated. You may disconnect any integration at any time through your account settings, after which we will cease accessing that account.

No third party has direct access to the data in your Xero account. Our AI assistant processes data stored within FINYR only. It does not access live financial data from Xero or other connected accounting platforms. Queries submitted to our AI assistant are processed by external AI service providers under their own data processing terms. Xero client data is not shared with or sold to any third party.

FINYR's use of information received from Google APIs, including Gmail and Google Drive, complies with the Google API Services User Data Policy, including its Limited Use requirements. In particular:

• We access Google account data only to provide or improve the features you have explicitly enabled within FINYR
• We do not use Google user data to serve advertising or for any purpose unrelated to the services you have requested
• We do not allow humans to read your Google account data unless you have given us express permission, it is necessary for security purposes, or we are required to do so by law
• We do not transfer Google user data to third parties except as necessary to provide our services, as required by law, or with your express consent

We take all reasonable steps to protect your personal information from unauthorised access, misuse, loss, or disclosure. Our platform is hosted on secure cloud infrastructure, and we implement technical and organisational safeguards appropriate to the nature of the information we hold.

However, no transmission of data over the internet is completely secure. You use our services at your own risk and are responsible for maintaining the security of your own access credentials.

We will notify you as soon as practicable if we become aware of a data breach that is likely to result in serious harm to you, in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).

If you no longer need your personal information held by us, or if it is no longer required for the purposes for which it was collected, we will take reasonable steps to destroy or de-identify it.

Our website and platform may contain links to third-party websites or services, such as Xero. This Policy applies only to personal information collected by FINYR. We are not responsible for the privacy practices of third-party websites and encourage you to review their privacy policies before providing any personal information.

You have the right to request access to the personal information we hold about you, and to request corrections if you believe it is inaccurate, incomplete, or out of date.

To make a request, contact us at privacy@finyr.com.au. We will respond within a reasonable timeframe. In some circumstances, we may charge a reasonable fee to cover the cost of providing access. We will notify you in writing if we decline to provide access or correct information, and explain our reasons.

If you believe we have handled your personal information in a way that does not comply with applicable Privacy Laws, please contact us at privacy@finyr.com.au. We will investigate your complaint and respond within a reasonable timeframe.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

We may update this Privacy Policy from time to time. Any changes will be posted on our website and will take effect immediately upon publication. Your continued use of FINYR after any update constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically.

For any questions, concerns, or requests relating to this Privacy Policy, please contact: