Privacy Policy

1. The kinds of personal information we collect

Depending on how you interact with us, we may collect:

• Account and contact information – such as your name, email address, phone number, firm name, role and login credentials.
• Enquiry information – information you provide when you use our contact form, sign up, or communicate with us.
• Plan, usage and billing information – your Firm’s subscription plan (“Plan”), the credits included in it and consumed (“Credits”), the review types submitted and when, the user who submitted each review, top-up purchases, invoices and payment history. Payment card details are collected and held by our payment providers, not by us (see section 5).
• Usage and technical information – such as IP address, device and browser type, pages visited, and interactions with the Service, collected automatically including through cookies and analytics tools.
• Advertising and campaign information – information about how you interact with our advertising and marketing, including which ads or campaigns led you to our website, cookie and advertising identifiers, and the pages and actions you complete on our site. See sections 4, 5 and 6.
• Content you submit – documents, workpapers and files you upload for review (“Customer Data”), which may contain personal information about your clients and other individuals. See section 7.

2. How we collect personal information

We collect personal information directly from you when you register, contact us, use the Service or submit documents; automatically through your use of our website and platform; and, where relevant, from your Authorised Users. Where you submit documents containing personal information about third parties (such as your clients), you collect that information on your own account and disclose it to us for processing on your behalf.

We may also receive information indirectly from advertising and analytics providers, such as aggregated or de-identified reports about how our advertising campaigns are performing.

3. Why we collect, hold, use and disclose personal information

We collect and use personal information to:

• provide, operate, maintain and improve the Service;
• create and manage accounts and authenticate users;
• run automated checks and AI analysis on documents you submit and return Output to you;
• respond to enquiries and provide customer support;
• administer Plans, Credits and usage, issue tax invoices, process payments and manage billing;
• maintain the security, integrity and performance of the Service;
• measure, target and improve our advertising and marketing, including on Meta platforms (see section 6);
• comply with our legal obligations; and
• with your consent or where otherwise permitted, send you service updates and marketing communications.

4. Cookies, consent and similar technologies

Our website uses cookies, pixels, tags, local storage and similar technologies (together, “cookies”) to make the site work, remember your preferences, understand how the site is used, and measure and target our advertising. Cookies may be set by us or by third parties on our behalf.

We group cookies into the following categories:

• Strictly necessary – required for the website and platform to function, including security, load balancing and session management. These are always active and cannot be switched off.
• Analytics and performance – help us understand how visitors find and use our website so we can improve it. These include Google Analytics cookies (see section 5).
• Advertising and targeting – used to measure the effectiveness of our advertising and to show you relevant ads on third-party platforms. These include the Meta Pixel and its associated cookies (see section 6).

Your consent. Strictly necessary cookies are set automatically. Analytics and advertising cookies — including Google Analytics and the Meta Pixel — are set only where you have consented through the cookie notice presented when you first visit our website, or where we are otherwise permitted by law to set them. You can accept all cookies, reject non-essential cookies, or choose which categories you allow.

Changing or withdrawing your consent. You can change your cookie choices, or withdraw your consent, at any time using the cookie settings link in our website footer. Withdrawing consent stops further collection through those cookies but does not undo collection that has already occurred. You can also block or delete cookies through your browser settings, and most browsers let you refuse third-party cookies altogether. Disabling some cookies may affect how the website functions.

Our cookie notice and settings tool describe the specific cookies in use, their purpose and how long they last. We keep a record of the consent choices you make.

5. Google and other third-party services

We use reputable third-party providers to help operate our website and Service. These may include:

• Google Analytics – we use Google Analytics 4 to understand how our website is used, including which pages are visited and how visitors arrive. It may collect information such as your IP address, device and browser information, and your interactions with our site. Google processes this information in accordance with its own privacy policy, available at policies.google.com/privacy. You can opt out of Google Analytics across all websites using the browser add-on at tools.google.com/dlpage/gaoptout.
• Other Google services – we may use Google security and infrastructure tools, such as reCAPTCHA, to protect our forms and services from abuse. Where these are in use, they are described in our cookie notice.
• Meta Platforms – we use Meta advertising and tracking tools. These are described separately in section 6.
• Amazon Web Services (AWS) – cloud hosting and infrastructure on which the Service runs.
• Chargebee – our subscription billing platform, which manages Plans, Credits, invoices and payment collection. Chargebee processes information in accordance with its own privacy policy, available at chargebee.com/privacy, and may do so outside Australia, including in the United States (see section 9).
• Stripe – the payment gateway that collects and stores payment card details on our behalf; we do not store full card numbers. Stripe processes information in accordance with its own privacy policy, available at stripe.com/au/privacy, and may do so outside Australia, including in the United States (see section 9).
• Communication providers – to deliver emails and notifications.
• Cloud computing and AI development tools – enterprise secure cloud platforms and other AI diagnostic tools, used by our development team only when diagnosing and resolving platform issues (see section 7).

We only share the information necessary for these providers to perform their services, and we require them to protect personal information consistently with this Policy and applicable law. We do not sell your personal information, and we do not use your Customer Data to train third-party AI models.

6. Meta advertising and tracking tools

We advertise Taxpartna on Meta platforms, including Facebook and Instagram, and we use Meta business tools on our website. These tools are provided by Meta Platforms, Inc. and its affiliates, including Meta Platforms Ireland Limited (together, “Meta”).

What we use and what it collects

We use the Meta Pixel — a small piece of code placed on the pages of our public marketing website. When it is active, it records certain interactions, known as “events”, such as page views, content viewed, form submissions, enquiries and sign-up completions.

The information collected through these tools may include:

• your IP address, browser type, operating system, device information and general location derived from your IP address;
• the referring website or advertisement that brought you to our site, including Meta click identifiers where present;
• the pages and content you view on our website, the links you click and the actions you complete;
• cookie and advertising identifiers, including the Meta _fbp and _fbc cookies, which allow your activity to be linked across visits; and
• where you submit an enquiry or sign-up form, limited contact details such as an email address, which may be converted into a hashed identifier used for matching. Hashing does not make the information anonymous: Meta can match the identifier against information it already holds about you.

Why we use it

We use Meta tools to:

• measure whether our advertising is working — for example, how many people who saw an ad went on to visit our site or make an enquiry;
• understand which campaigns, ads and pages are effective so we can improve them and avoid wasting spend;
• build and refine advertising audiences, including custom audiences (based on website visitors or our contact lists) and lookalike audiences (people with similar characteristics), so our advertising reaches Australian accounting and tax professionals more likely to find Taxpartna relevant;
• show follow-up or reminder advertising to people who have previously visited our website; and
• exclude existing customers or particular groups from campaigns where that is appropriate.

Disclosure of information to Meta

Information collected by these tools is disclosed to and collected directly by Meta. This is a disclosure of personal information to a third party. In relation to that information, we and Meta each have our own responsibilities: we use it to measure and target our advertising, and Meta also uses it for its own purposes, including operating, measuring and improving its advertising systems and services.

Meta may combine the information it receives with information it already holds about you — for example, if you have a Facebook or Instagram account — and may use it to personalise the advertising and content you see on Meta platforms.

Where we upload contact lists to create custom audiences, we do so only where we are permitted to, and email addresses are hashed before transmission. Hashing protects the addresses in transit but does not anonymise them; Meta matches the hashed values against the accounts it holds.

We never include Customer Data in any Meta tool. The documents, workpapers, tax returns and client information you submit to the Taxpartna platform are never disclosed to Meta and are never used for advertising. Meta tools operate only on our public marketing website and are not present on the authenticated Taxpartna platform.

Meta handles the information it receives in accordance with its own terms and privacy policy, available at facebook.com/privacy/policy. Meta’s use of information through its business tools is also governed by its Business Tools Terms and Data Processing Terms.

Overseas handling

Meta is located outside Australia and stores and processes information overseas, including in the United States and Ireland. By continuing to use our website while these tools are active, you acknowledge that information collected through them may be disclosed to and processed by Meta outside Australia. Where we disclose personal information to Meta, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, including by relying on the contractual protections in Meta’s business tools and data processing terms.

Your choices

You can control the use of Meta tools in the following ways:

• decline or withdraw consent for advertising cookies using our cookie notice or the cookie settings link in our website footer (see section 4);
• adjust your Meta ad preferences, and review or disconnect off-platform activity Meta has received about you, in your Facebook or Instagram account settings — see facebook.com/adpreferences;
• ask us, through taxpartna.com.au/contact, not to include your contact details in any contact list we upload to Meta to create custom audiences; we will apply that request to all future uploads;
• block or delete third-party cookies through your browser settings; and
• use industry opt-out tools, such as the Australian consumer opt-out at youronlinechoices.com.au.

Declining advertising cookies will not prevent you from using our website or the Service, and will not affect the quality of the Service you receive.

7. Documents you submit and how we handle them

The Service is designed to protect the sensitive information in the documents you submit:

• files are encrypted in transit (TLS 1.3) and at rest (AES-256);
• documents are processed within a secured, isolated environment;
• our automated review pipeline is self-contained and we do not share your Customer Data with third-party AI providers in performing your reviews — the only exception is the limited support and troubleshooting access described below;
• submitted files are subject to mandatory automatic purging — files are permanently purged in accordance with the retention settings that apply to your account; you may configure when purging occurs, or request an earlier purge at any time, but automatic purging itself cannot be disabled; and
• for users of the Performance Dashboard, certain non-sensitive metadata may be retained securely on AWS to provide reporting functionality.

Because your documents may contain personal information about your clients and other individuals, you are responsible for ensuring you have the authority and any necessary consents to disclose that information to us. In respect of Customer Data, we act as a processor on your behalf and handle it in accordance with your instructions and this Policy. Because submitted files are automatically purged, you are responsible for keeping your own copies and backups of any Customer Data and Output you need. While automatic purging is mandatory for submitted files, we do not describe the Service as operating on a “zero data retention” basis: limited information — being account information, Plan, usage and billing records and, for users of the Performance Dashboard, non-sensitive metadata — is retained as described in this Policy. Usage and billing records identify the review type, date, submitting user and Credits consumed, but do not contain the content of the documents you submit.

Customer Data is never used for advertising. We do not use Customer Data for marketing or advertising purposes, and we do not disclose it to any advertising or analytics provider.

Support, troubleshooting and credit requests. Authorised members of our support and development team may access Customer Data, and the related records of a review, where that is necessary to diagnose and rectify a platform bug or processing issue affecting a review you have submitted, to respond to a support request you make, or to investigate a request to restore a credit or refund a fee, including determining whether a review failed because of a fault in the Service. You consent to this access for all reviews as part of the Platform User Agreement. Access is limited to what is necessary for the purpose, is restricted to personnel on a need-to-know basis, is logged, and is used for no other purpose, including training AI models. In doing so our team uses cloud computing technology, including enterprise secure cloud platforms and other AI diagnostic tools provided under commercial enterprise agreements. Copies made for these purposes are destroyed as soon as practicable after the matter is closed and in any event within 7 days, or within 30 days for escalated matters, which we will tell you about. Any additional material you choose to send us to help resolve a matter, for example by secure upload, email or screen share, is handled in the same way.

Beta features. Some features of the Service are made available as beta features for evaluation. Customer Data submitted to a beta feature is protected in the same way as described in this section. Where a beta feature uses different retention or processing arrangements, we will say so in the Service before you use it, and those arrangements will not reduce the security and confidentiality commitments in this Policy. The support, troubleshooting and credit-request access described above applies to beta features in the same way.

Automated decision-making. The Service uses automated checks and AI to produce observations for review by a registered tax practitioner. We do not use personal information in computer programs to make decisions that could reasonably be expected to significantly affect an individual’s rights or interests; all decisions about a client’s affairs are made by the Firm.

8. Disclosure of personal information

We may disclose personal information to: our service providers and contractors (such as those listed in sections 5 and 6) who assist us in operating the Service or in measuring and delivering our advertising; professional advisers; a purchaser or successor in the event of a business sale or reorganisation; and government or regulatory bodies or other parties where required or authorised by law. We do not sell personal information.

9. Overseas disclosure

Our processing pipeline and infrastructure providers, including AWS, may store or process data — including personal information contained in the documents you submit — in data centres located in Australia and, in some cases, overseas. Our advertising and analytics providers, including Google and Meta, also process information overseas, including in the United States and Ireland. Our billing and payment providers, Chargebee and Stripe, also process information overseas, including in the United States. Where our development team uses cloud-based support tooling, including AI-assisted tools (see section 7), enterprise secure cloud platforms and AI diagnostic tool providers may also process relevant information overseas, including in the United States. Where personal information is disclosed to, processed by or stored by providers outside Australia, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles. By using the Service, you acknowledge that some information may be processed outside Australia.

10. Data security

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Our measures include encryption in transit and at rest, mandatory multi-factor authentication, role-based access controls, continuous monitoring, and hosting on AWS services covered by AWS’s SOC 2 Type II reports. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Data quality and retention

We take reasonable steps to ensure the personal information we hold is accurate, up to date and complete. We retain personal information only for as long as necessary for the purposes for which it was collected, to comply with our legal obligations, or to resolve disputes, and we then take reasonable steps to destroy or de-identify it. Submitted documents are subject to mandatory automatic purging in accordance with your account’s retention settings, as described in section 7. Plan, usage and billing records, including tax invoices, are retained for the periods required by Australian tax and corporations law, which may be up to seven years after the end of the financial year to which they relate.

Information collected through cookies and advertising tools is retained for the periods described in our cookie notice, or for the retention periods applied by the relevant provider.

You control your records – purge on request. A Firm Admin may, at any time, request that we purge all records associated with the Firm’s account, including any retained metadata and account information. On request we will permanently delete those records within a reasonable period and confirm once this is done, except billing and tax records we are required by law to keep, and any other information we are required to retain to comply with our legal obligations. An individual user may ask for access to or correction of their own personal information under section 13, or ask us to delete it by contacting us using the details in section 18, but a request to delete the Firm’s records must come from a Firm Admin. The Firm remains responsible for keeping its own copies of any Customer Data and Output it needs, in line with the retention settings it has chosen.

12. Direct marketing

We may send you marketing communications about the Service where you have consented or where otherwise permitted by law. You can opt out at any time by using the unsubscribe link in our emails or by contacting us. We do not use sensitive information for direct marketing without your consent.

We may also deliver advertising to you on third-party platforms, including Meta platforms, as described in section 6. Opting out of our email marketing does not automatically stop platform advertising — to control that, use the choices set out in sections 4 and 6.

13. Accessing and correcting your personal information

You have the right to request access to the personal information we hold about you, and to ask us to correct it if it is inaccurate, out of date or incomplete. To make a request, contact our Privacy Officer using the details below. We will respond within a reasonable time. There is generally no charge for making a request, although we may charge a reasonable fee for providing access in some cases. If we refuse access or correction, we will explain why and how you can complain.

Some information collected through advertising tools is held by the relevant provider rather than by us. Where that is the case, we will tell you and, where practicable, direct you to the provider’s own access and controls.

14. Data breaches

We maintain procedures to detect, assess and respond to data breaches. If a data breach that is likely to result in serious harm occurs, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme. Where an actual or reasonably suspected incident involves Customer Data held for a Firm, we will also notify that Firm’s administrator as soon as practicable in accordance with our incident response process, provide the information available to us and reasonable updates, and cooperate with the Firm in assessing and responding to the incident.

15. Children

The Service is intended for businesses and is not directed at children. The Service is available only to users aged 18 or over, and we do not knowingly collect personal information from anyone under 18 as a user. Documents submitted by a Firm may, however, contain personal information about individuals under 18, such as minor clients, dependants or beneficiaries; that information is Customer Data and is handled in accordance with section 7.

16. Complaints

If you have a concern or complaint about how we have handled your personal information, please contact our Privacy Officer using the details below. We will investigate and respond within a reasonable time. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

17. Changes to this Policy

We may update this Privacy Policy from time to time. The current version will always be available on our website, with the effective date shown at the top. If we make a material change that is adverse to you, we will give notice through the Service or by email before it takes effect, in the same way as under the Platform User Agreement. We encourage you to review this Policy periodically.

18. Contact us

Privacy Officer

Partna AI Pty Ltd (ABN 82 696 001 555; ACN 696 001 555), trading as Taxpartna.

Contact: https://taxpartna.com.au/contact