Privacy Policy

1. Introduction

SortBooks ("we", "us", "our") is an AI-powered bookkeeping platform that connects to your Xero accounting software to automate transaction categorisation and financial reporting. This Privacy Policy explains how we collect, use, store, and protect your personal and financial information when you use our service at sortbooks.work.

By using SortBooks, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the service.

2. Information We Collect

2.1 Account Information

• Name and email address (from Google sign-in or email registration)
• Profile picture (if provided via Google)
• Business name and organisation details

2.2 Financial Data from Xero

When you connect your Xero account, we access and store:

• Bank transactions (descriptions, amounts, dates, references)
• Chart of accounts and account categories
• Bank account names and balances
• Contact names associated with transactions
• Invoice and bill details for reconciliation

We only access data within the Xero scopes you authorise. We never access payroll data, employee records, or data outside the granted permissions.

2.3 Usage Data

• Pages visited and features used within SortBooks
• AI chat conversations with our CFO assistant
• Categorisation decisions and corrections you make
• Browser type, device information, and IP address

2.4 Billing Information

Payment processing is handled entirely by Stripe. We do not store your credit card numbers, bank account details, or other payment credentials on our servers. Stripe provides us with a customer ID, subscription status, and payment history metadata only.

3. How We Use Your Information

• To provide and maintain the SortBooks service, including syncing your Xero data
• To run AI-powered transaction categorisation using OpenAI's language models
• To generate financial reports, BAS/GST summaries, and cash flow analysis
• To power the AI CFO chat assistant with your financial context
• To improve our AI categorisation accuracy based on your corrections
• To send you service-related emails (welcome, trial reminders, weekly digests)
• To process your subscription payments via Stripe
• To detect and prevent fraud, abuse, and security incidents
• To comply with legal obligations and respond to lawful requests

4. AI Processing and Third-Party Services

4.1 OpenAI

We use OpenAI's API to categorise your transactions and power the AI CFO assistant. Transaction descriptions, amounts, and your chart of accounts are sent to OpenAI for processing. OpenAI does not use data submitted via their API to train their models. We have a Data Processing Agreement (DPA) with OpenAI that governs their handling of your data.

4.2 Stripe

Stripe processes all payments and stores payment credentials securely. Stripe is PCI DSS Level 1 certified. Please review Stripe's privacy policy at stripe.com/privacy for details on how they handle your payment information.

4.3 Xero

We connect to Xero via their official OAuth 2.0 API. You can revoke our access at any time from your Xero account settings. We comply with Xero's API Terms of Use and data handling requirements.

4.4 Resend

We use Resend to send transactional emails (welcome emails, trial reminders, weekly summaries). Resend processes your email address and name for delivery purposes only.

4.5 Google Analytics

We may use Google Analytics to understand how users interact with our marketing pages. This collects anonymised usage data. You can opt out using browser extensions or cookie settings.

5. Data Storage and Security

• All data is encrypted at rest using AES-256 encryption
• All data in transit is encrypted using TLS 1.2 or higher
• Xero OAuth tokens are encrypted with AES-256-GCM before storage
• Database access is restricted to application-level service accounts with tenant isolation
• We use a multi-tenant architecture with strict tenant isolation - no user can access another tenant's data
• Audit logs track all data access and modifications
• Our infrastructure is hosted on secure cloud providers with SOC 2 compliance

6. Data Retention

• Active account data is retained for the duration of your subscription
• After account cancellation, your data is retained for 30 days to allow re-activation
• After the 30-day grace period, all financial data is permanently deleted
• Audit logs are retained for 7 years to comply with Australian tax record-keeping requirements
• Aggregated, anonymised analytics data may be retained indefinitely
• You can request immediate deletion at any time (see Your Rights below)

7. Your Rights

You have the following rights regarding your personal data:

7.1 Right of Access

You can request a copy of all personal data we hold about you. We will provide this within 30 days.

7.2 Right to Rectification

You can update your account information at any time through the settings page, or contact us to correct any inaccurate data.

7.3 Right to Deletion

You can request deletion of your account and all associated data. We will process deletion requests within 30 days, subject to legal retention requirements.

7.4 Right to Data Portability

You can export your data in standard formats (CSV, JSON). Your financial data remains in your Xero account, which you always retain full control of.

7.5 Right to Restrict Processing

You can disconnect your Xero account at any time to stop data syncing while retaining your account.

7.6 Right to Object

You can opt out of marketing communications and non-essential data processing at any time.

8. GDPR Compliance (European Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your data under the following legal bases:

• Contract performance: Processing necessary to provide the SortBooks service
• Legitimate interest: Improving our service, fraud prevention, and security
• Consent: Marketing communications and optional analytics
• Legal obligation: Tax record-keeping and regulatory compliance

For data transfers outside the EEA, we rely on Standard Contractual Clauses (SCCs) and ensure all sub-processors maintain adequate data protection standards.

You may lodge a complaint with your local data protection authority if you believe your rights have been violated.

9. Australian Privacy Act Compliance

SortBooks complies with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). As an Australian-operated service:

• We only collect personal information that is reasonably necessary for our functions
• We take reasonable steps to protect personal information from misuse, interference, and loss
• We provide access to your personal information upon request
• We will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals of eligible data breaches
• Cross-border data transfers are made in compliance with APP 8

You may make a privacy complaint by emailing privacy@sortbooks.work. If you are unsatisfied with our response, you can contact the OAIC at oaic.gov.au.

10. Cookies

We use the following cookies:

• Authentication cookies: Essential for keeping you logged in (strictly necessary)
• CSRF tokens: Essential for security (strictly necessary)
• Analytics cookies: Google Analytics (optional, can be declined)

11. Children's Privacy

SortBooks is not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice on our website at least 14 days before the changes take effect. Your continued use of the service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

• Email: privacy@sortbooks.work
• General: hello@sortbooks.work
• Website: sortbooks.work