Privacy policy

1. Who we are

Billflation is run by Stray Anchor Pty Ltd (ABN 22 700 917 111, ACN 700 917 111), Yangebup WA 6164, Australia. In this policy "we" and "us" means Stray Anchor Pty Ltd. You can reach us about privacy at [email protected]. We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, whether or not an exemption would apply to us.

2. What we collect

When you connect Xero

• About you: your name, email address and Xero user ID, from Xero's sign-in. Your Xero password is entered on Xero's site; we never see it.
• About your organisation: its name, base currency and country.
• Supplier bills and credit notes from the last 25 months: supplier, dates, numbers, line descriptions, item codes, quantities, prices, tax amounts, account codes and currency.
• The suppliers on those bills: their names and, where Xero has one, a contact first name.

We don't read your bank accounts, payroll, or the invoices you send to customers. Our access to Xero is read-only: we can't create, change or delete anything there.

When you use Billflation

• Your settings, the matches you mark "not the same item", and any share cards you create.
• If you take the paid plan, Stripe handles the payment. We receive a customer reference, your plan and its status, never your full card number.
• Server logs: IP address, browser type, pages requested, and counts of calls we make to Xero. We keep these for up to 30 days to keep the service secure and to fix problems.

Cookies

We use one cookie to keep you signed in, and one short-lived cookie while you connect Xero. We don't use advertising or analytics cookies or tracking pixels, and our fonts are served from our own site.

3. How we use it

• To work out your report: which prices changed, by how much, and what it costs you a year.
• On the paid plan, to check new bills and tell you about new rises.
• To send service emails: scan finished, alerts, weekly digests and billing notices.
• To answer your questions, and to keep Billflation secure and working.
• To meet our legal obligations, such as keeping tax records.

We don't sell your information, use it for advertising, or share it for anyone else's marketing. We don't send your bills to any AI model, and we don't use your data to train AI or machine-learning models. Matching is done by fixed rules, and every result can be traced back to two of your bills.

4. Information about other people

Your bills name your suppliers, and sometimes a contact person at a supplier. We use those names only to show you your own report, and we never contact your suppliers. Share cards replace supplier names with a general description (for example, "Electrical wholesaler").

5. Who we share it with

We use a small number of service providers to run Billflation. They may only use your information to provide their service to us.

Xero is where your data comes from. We read it under the access you give us, and Xero's own privacy policy covers your use of Xero. We may also disclose information if the law requires it.

Overseas: your bills and results are stored in Australia. Cloudflare and Stripe may handle limited information (website requests, payment details) outside Australia; we take reasonable steps, including their contractual commitments, to make sure they protect it.

6. How long we keep it

• Raw data copied from Xero: up to 90 days from when we last fetched it.
• Your results (matched items, price changes, supplier totals): while your account is active.
• If you disconnect Xero: your bill data is deleted straight away. Your account and a summary of past reports are deleted 30 days later.
• If you choose "Delete all my data": everything is deleted straight away. Copies in our database backups are overwritten within 7 days.
• Billing records: kept for as long as Australian tax law requires (usually 5 years).

7. How we protect it

Data is encrypted in transit and at rest, and your Xero connection tokens are encrypted again with a separate key. Every request is tied to your own organisation, so one customer can never see another's data. Read more on our security page.

8. Your choices and rights

• You can disconnect Xero, or delete all your data, at any time from Settings.
• You can ask us for a copy of the personal information we hold about you, or ask us to correct it.
• You can delete a share card's link at any time; the card stops working straight away.

Email [email protected] and we'll reply within 30 days. If you're not happy with how we handle a privacy complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

9. Age

Billflation is for businesses. You need to be 18 or older to use it.

10. Changes to this policy

If we change this policy we'll update the date at the top. If a change matters, we'll also tell you by email before it takes effect.