Privacy Policy
We collect the information we need to keep your books and lodge your BAS, and nothing more. We use it only to provide our services and meet our legal obligations, we share it only with the ATO, the providers that run our systems and people you ask us to share it with, and we never sell it. We follow the Australian Privacy Principles in the Privacy Act 1988.
1. Who we are
This policy covers Redhorse Accounting (ABN 43 532 575 493), a sole trader practice and registered BAS agent based in Brisbane. If the practice moves to Growit Group Pty Ltd, this policy will cover that company and we'll tell clients first. It applies to our website, client portal, receipts email addresses and chat assistant.
For any privacy question or request, email hello@redhorseaccounting.com.au with "Privacy" in the subject line.
2. What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Contact and account details | Your name, email, mobile, business name, ABN, login | You, at sign-up |
| Financial records | Receipts, supplier bills, invoices, bank transactions, reports, BAS figures | You (photo, upload, email) and your Xero file |
| Payroll details (if you use our payroll service) | Employee names, hours worked, pay rates, pay periods, leave and super details | Your timesheet software (e.g. Deputy) and your Xero file |
| ATO records | Activity statement accounts, lodgement history, amounts owing | The ATO, through our agent access |
| Tax return preference | Whether you want a partner tax agent, what matters to you, your own accountant's name and email | You, at sign-up |
| Communications | Emails, portal queries and answers, chat messages | You |
| Payment details | Billing name, payment method, and for direct debit your bank account details, held by our direct debit provider, Ezidebit | You, at sign-up |
| Technical data | IP address, browser, pages visited, login times | Your device, when you use our website or portal |
We don't ask for your tax file number. If you give us information about other people, such as employees, please make sure they know you've shared it with us.
3. How we use it
We use your information to:
- keep your books in Xero, prepare your BAS and lodge it with the ATO
- run the portal: read receipts, show your results, enter bills, reconcile your bank feeds, process payroll if you've chosen it, and flag unusual items
- write your monthly CFO-style review
- match you with a partner tax agent, or prepare your books for your own accountant, if you ask
- bill you and keep the records the law requires
- answer your questions and handle complaints
- keep our systems secure and improve the portal, using anonymised data where we can
We don't sell your information or use it for third-party advertising. We may email you about changes to our services; you can opt out of anything that isn't essential to your account.
4. AI and automated processing
The portal uses AI (Claude, provided by Anthropic) and automated rules to:
- read receipts and invoices and suggest supplier, date, amounts, GST and account coding
- flag possible duplicates, GST errors, unusual coding and high hours for review
- draft your monthly CFO-style commentary
- answer general questions about our services in the website chat
These are suggestions, not final decisions. You check each receipt's coding, and a qualified person reviews your figures before any BAS is lodged. No decision that significantly affects you is made by automation alone.
Our AI provider processes your information only to provide the service to us. Under its commercial terms, it doesn't use your information to train its models.
5. Who we share it with
| Who | Why | Where |
|---|---|---|
| Australian Taxation Office | To lodge your BAS and manage your activity statement account | Australia |
| Xero | Your books live there; the portal connects to it with your permission | Australia, New Zealand and the United States |
| Cloudflare | Hosts our website, receives emailed receipts, protects against attacks | Global network, including the United States |
| Microsoft Azure | Runs the portal and stores your records and receipt images | Australia (Sydney, Australia East region) |
| Anthropic | AI that reads receipts, drafts commentary and powers the chat | United States |
| Ezidebit (part of Global Payments) | Collects your monthly fee if you pay by direct debit | Australia |
| A partner tax agent | Prepares your tax return, only after you confirm the match | Australia |
| Your own accountant | Your year-end books, only when you ask | Australia |
| Regulators and professional bodies | Only where the law or our professional obligations require it | Australia |
Our providers may only use your information to provide services to us. Where information goes overseas, we take reasonable steps to make sure it's protected to a standard comparable to the Australian Privacy Principles.
6. Security and how long we keep it
We protect your information with encrypted connections, hashed passwords, access limited to the people who need it, signed links between our systems, and regular backups. The portal can't move money or change your bank details in Xero.
We keep your records for five years after the period they relate to, in line with record-keeping laws, then securely delete them. When you leave, you can download your records for 30 days. Chat messages from website visitors who don't become clients are deleted after 90 days.
If a data breach is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner as the law requires.
7. Website, cookies and the chat assistant
Cookies. The portal uses a cookie to keep you signed in. Our website uses only cookies needed for it to work, and privacy-friendly visit statistics (Cloudflare Web Analytics) that don't identify you. We don't use advertising cookies.
Chat assistant. The website chat is answered by AI, not a person. It gives general information about our services, not advice about your situation. Please don't enter tax file numbers, bank details or other sensitive information in the chat. If you share your name and email in a chat, we may contact you to follow up.
8. Your rights and complaints
You can ask to see the personal information we hold about you, or ask us to correct it. Email us and we'll respond within 30 days. There's no charge for asking.
If you have a privacy complaint, email us first and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
9. Changes to this policy
We'll update this policy when our services or the law change. The date at the top shows the current version. If we make a significant change, we'll tell clients by email and in the portal before it takes effect.