Privacy Policy

AusTax AI (ABN 71 924 049 898) ("we", "us", "our") operates austaxai.com.au. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

We collect: • Personal information: name, email address, date of birth, address, and phone number • Tax File Number (TFN): encrypted at rest using AES-256 encryption via Supabase Vault • Financial information: income details, receipts, and expense records you upload • Usage data: IP address, browser type, pages visited, and device information • Payment information: processed securely via Stripe — we do not store card numbers

We use your information to: • Provide and improve our tax return lodgement services • Analyse receipts and identify eligible tax deductions using AI • Facilitate review by registered Tax Agents • Lodge your tax return with the Australian Taxation Office (ATO) • Send transactional emails (e.g. confirmation of lodgement) • Comply with legal obligations under Australian tax law

IMPORTANT: AusTax AI uses third-party AI services to provide its core features. By using AI-powered features in the app, you consent to the following data sharing with Google LLC (Vertex AI Gemini service): What data is sent to Google Vertex AI: • Receipt images you upload — for OCR (text extraction) and category recognition • Extracted OCR text from receipts — for tax-deduction analysis • Your work-related profile context (occupation, employment type, work-from-home days, vehicle use, etc.) — to personalise deduction analysis • Your typed messages to the AI chat assistant • Your tax-related questions and the conversation context (when AI Memory is enabled) What is NEVER sent to any AI service: • Your Tax File Number (TFN) — kept encrypted in our database, never decrypted in AI calls • Your bank account or BSB numbers • Your full legal name in receipt analysis or memory extraction • Your home address or date of birth • Your payment / credit card details Who Google is and what they do with the data: • Google LLC operates the Vertex AI platform under their Cloud Data Processing Addendum • Per Google's Vertex AI terms, your data is NOT used to train Google's foundation models • Google retains AI request data only for the limited time needed to fulfil the request and maintain service abuse-detection logs (typically up to 24 hours, max 30 days) • Data is processed in Google Cloud regions chosen to comply with Australian data-residency expectations Your control: • AI consent is explicitly requested in the app on first use of any AI-powered feature • You can disable the AI Memory feature at any time in Settings — already-stored memory facts can also be deleted individually • You can request full account deletion in Settings, which removes your data from our systems within 30 days If you do not wish to share data with Google Vertex AI, you should not use AI features in the app — the app's AI-powered analysis is the core value proposition, so without consent the app's usefulness is significantly reduced. Email-forwarded receipts (Cloudflare Email Routing → AusTax AI): When you forward a receipt to receipts+<your-token>@austaxai.com.au: • Cloudflare Inc.'s Email Routing is a transit-only service — Cloudflare does not persistently store the email body or attachments; routing metadata (timestamps, sender / recipient) is retained per Cloudflare's standard log retention policy. • If the email contains a file attachment (PDF / image / HEIC), only the attachment is sent to Google Vertex AI for OCR. The email body is not sent. • If the email contains no file attachment, the HTML body — along with the subject and sender address — is sent to Google Vertex AI (us-central1, USA) for receipt-data extraction. This is the only path where email content beyond the attachment is sent to AI. • Sender address and subject line are stored alongside the resulting receipt record in our database (in the receipts.ocr_text field). These are retained on the same schedule as the receipt itself — see Section 7. • You can stop email-receipt ingestion at any time by (a) regenerating your forwarding token in Settings (the old token is deactivated immediately) or (b) deleting your account. Anonymous "Instant Scan" trial (/try — no account required): When you try a receipt without registering, via the no-login Instant Scan: • The receipt image you upload is sent to Google Vertex AI (us-central1, USA) for OCR and a light deduction analysis, exactly as described above. Location (EXIF/GPS) data is stripped from the image before it is stored. • We do NOT collect any Tax File Number, identity document, bank, or payment details on this anonymous surface. • The uploaded image and its analysis are held in a private, temporary storage area and automatically deleted after 7 days — or after 30 days if you enter your email to unlock the full result (so the emailed copy still resolves during that window). On deletion, the receipt content and your email address are purged from the record. • If you enter your email to see the full result, that address is added to our marketing list with your consent, so we can send you the analysis and occasional seasonal tax tips. Every such email carries a one-click, login-free unsubscribe link, and opting out is permanent.

Your Tax File Number is collected solely for the purpose of lodging your tax return with the ATO. It is: • Encrypted using AES-256 before storage (via Supabase Vault) • NEVER transmitted to any AI service or third-party system • Accessible only to registered Tax Agents handling your return, in a controlled decryption environment • Handled in accordance with the Taxation Administration Act 1953

When you submit a tax return for review by a registered Tax Agent, we collect ONE Primary Photo ID (passport / Australian driver license / ImmiCard). This is required by the Tax Practitioners Board factsheet TPB(PN) 5/2022 before any Tax Agent can lodge on your behalf. How we handle your ID: • Stored in a private, encrypted Supabase Storage bucket (Sydney region) • Visible to your assigned Tax Agent only via short-lived signed URLs (5 minutes) — never embedded in pages or emails • NEVER sent to any AI / OCR service — Agents verify visually • Automatically deleted within 72 hours after your Tax Agent marks the verification complete (extendable to 7 days maximum if the Agent needs more time to cross-reference details) • If the Agent rejects the upload (e.g. blurry photo), the file is deleted IMMEDIATELY and you're asked to re-upload What is retained: • An immutable audit log of every access, verification, extension, and deletion event is kept for 5 years per TPB record-keeping requirements. The audit log contains the action, timestamp, actor (Agent / system), and resource ID — never the ID image or its contents. Your control: • You can request immediate deletion of your POI file at any time (info@austaxai.com.au) • You can request access to the audit log of all access events on your POI • You can refuse to upload an ID, but your return cannot be lodged by a registered Tax Agent under TPB rules without identity verification

AusTax AI operates a directory of tax agents and BAS agents registered with the Tax Practitioners Board (TPB). Listing data (practice name, registration number, business address, registration status) is sourced from the TPB public register published on data.gov.au under a Creative Commons Attribution 4.0 licence, and is refreshed approximately monthly. Contact details shown on a listing come either from the practice's own publicly published website or from the practice after it claims its listing. A practice may ask us to remove scraped contact details at any time via the unsubscribe link in any email we send it, or by emailing info@austaxai.com.au. When you post a client request, we collect your name, email address, optional phone or WeChat ID, suburb, the type of help you need, preferred language and any message you write. We send an anonymised summary (suburb, needs, language, message excerpt — never your name or contact details) to up to five matching practices by email. A practice sees your contact details only after it claims its listing on AusTax and unlocks your request. You can withdraw a request at any time using the link in your confirmation email; withdrawn requests can no longer be unlocked. Request records are retained for 24 months for dispute handling and then deleted. Practices that claim a listing provide a login email and, for paid plans, payment details processed by Stripe. We store the practice's chosen contact details, languages, services, website settings and custom domain. If a practice uses the client document portal, clients who sign up through that practice's link consent to sharing their AusTax data (receipts, income details, prior-year returns, identity documents) with that practice; this consent can be withdrawn in Settings and every export is logged.

We share your personal information with the following processors. Where the processor is located outside Australia, your data is subject to APP 8 cross-border disclosure rules; we take reasonable steps to ensure each processor handles your data consistently with the Australian Privacy Principles. • Google LLC (Vertex AI Gemini) — USA (us-central1): receipt OCR + AI deduction analysis + AI chat. See Section 4 for full data-share disclosure. • Supabase Inc. — Australia (Sydney region): primary PostgreSQL database and file storage. All app data including encrypted TFN, receipts, user profile, and AI analysis records reside here. • Stripe Inc. — USA: payment processing, customer ID, subscription metadata. We do not store card numbers. • Clerk Inc. — USA: authentication (email, user ID, name, auth session metadata). • Resend.com — USA: transactional email delivery (recipient email, name, message body of confirmations / notices). • RevenueCat Inc. — USA: iOS / Android in-app subscription management. Does not receive financial or tax data. • Cloudflare Inc. — USA / EU (global): CDN, DDoS protection, and Email Routing for the receipts+<token>@austaxai.com.au inbound email feature. Email content is transit-only at Cloudflare (not persistently stored). • Sentry — USA: error monitoring (stack traces, error messages, breadcrumbs). PII scrubbing is applied; see Section 9. • Vercel Analytics — USA: aggregated Web Vitals and page-load telemetry (non-identifying). • Google Analytics 4 — USA: page-view events and limited interaction events (e.g. calculator usage). Event payloads may include user-entered numeric values (income, refund estimate) from the calculator; client_id is a Google cookie identifier. • Registered Tax Agents (if / when you engage one through us in future): to review and assist with your return — these agents would be TPB-registered and Australian. We require all third parties to provide the same or equivalent levels of protection for your data as required by the Australian Privacy Principles. We do not sell your personal information to any third party.

We retain your personal information for: • Active accounts: for the duration of your subscription plus 7 years • Downgraded / cancelled accounts: receipt files are retained for 1 year after downgrade or cancellation and are flagged as 'inaccessible' (not deleted) during this period. Upon plan upgrade, access is restored. After 1 year, files are permanently deleted unless the account is fully deleted earlier. • Deleted accounts: data is permanently deleted within 30 days of account deletion request • Backups: may persist for up to 90 days after deletion • AI request logs (Google Vertex AI side): retained by Google for up to 30 days for abuse-detection only, never used for model training Why we retain active-account data for 7 years: • ATO record-keeping requirement: 5 years (s 262A Income Tax Assessment Act 1936) • ATO amendment window for individual returns: 4 years (s 170 ITAA 1936) • Possible objection / appeal periods: 4 years from assessment notice • Capital gains tax substantiation: may exceed 5 years for CGT events The 7-year period accommodates the longest applicable retention window under Australian tax law.

Under the Australian Privacy Act, you have the right to: • Access your personal information • Request correction of inaccurate information • Request deletion of your account and associated data • Withdraw consent for AI features at any time (in Settings) • Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) To exercise these rights, contact us at info@austaxai.com.au.

We implement industry-standard security measures including: • TLS 1.2+ encryption for all data in transit • AES-256 encryption for sensitive data at rest • Row-Level Security (RLS) policies in our database • Regular security audits and access controls

Privacy Officer AusTax AI ABN: 71 924 049 898 Email: info@austaxai.com.au