Archived version of the Privacy Policy, last updated 10 September 2026

Last Updated: 10 September 2026

What changed in this update

• We have corrected what we say about tax file numbers. A document you upload for reading is sent to our AI providers in full, so a TFN printed on that document goes with it. Sections 9 and 10 now explain this, why it is permitted, and how to avoid it if you prefer.
• Anthropic (United States) is now named as an AI provider, alongside OpenAI and Mistral AI, in the overseas country list and in our no-training commitment.
• FediPilot, our desktop AI assistant, is now described (Section 2), including the facts it remembers between sessions and how to see or delete them.
• The automated-processing section has been rewritten against the Privacy Act automated decision-making rules that commence on 10 December 2026, and now states plainly that our AI makes suggestions a person reviews.
• New material covers client identification and screening, search embeddings, staff dictation, and how your feedback text is read by automated tooling.
• We now explain the legal basis for sending information overseas as reasonable steps plus contractual protection, rather than resting it on your consent.

1. Introduction

Our Commitment:

Tax7 R&D Pty Ltd (ABN 28 677 982 544), the owner and operator of the business names Fedix and MyLedger ("we", "us", "our"), is committed to protecting your privacy and ensuring the security of personal information we handle. This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you use the Fedix and MyLedger platforms ("the Platform") and related services, including our artificial intelligence features, open banking integrations, voice services, email integrations, and electronic signature capabilities. It also outlines your rights and choices regarding your personal information.

We are bound by and comply with the following Australian legislation and regulatory frameworks:

• Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs)
• Privacy (Tax File Number) Rule 2015
• Competition and Consumer Act 2010 (Cth), Part IVD -- Consumer Data Right (CDR)
• Electronic Transactions Act 1999 (Cth)
• Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act

We aim to be transparent about our data practices. By using our services or providing personal information to us, you acknowledge and consent to the practices described in this Privacy Policy. Where we rely on consent as a legal basis for processing, you may withdraw that consent at any time (see Section 13).

Scope:

This Policy covers personal information about: (a) representatives of our subscribing firms (our customers), (b) end-users or clients of those firms whose personal data may be input into the Fedix or MyLedger platforms by the subscribing firm, and (c) any individual who interacts with our services, including through voice calls, email, or shared review links. In other words, if you are an accounting firm using our Platform, this Policy explains how we handle both your business's information and any personal information about your clients that you upload to our system. It also covers personal information collected through our website, billing systems, support channels, voice agent, email integrations, and open banking connections.

If we update this Privacy Policy, we will post the new version on our website and update the "Last Updated" date. We encourage you to check back periodically for any changes.

2. Personal Information We Collect

We may collect and hold a range of personal information necessary to provide our services. The types of personal information we collect can include:

Account and Contact Information (Customers):

For our subscribing accounting firms and their users, we collect information such as the firm's name, business contact details (address, phone number), account administrator's name, email address, and other profile information. This also may include professional details like the tax agent registration number or other qualifications if you provide them. We collect login credentials (such as usernames and hashed passwords) for the Platform, and we support Single Sign-On (SSO) via Microsoft Azure Active Directory. If you contact us for support, we will collect the information you choose to provide in that interaction (such as contact details and the content of your communications).

Client Data (End-Users' Personal Information):

The Platform is used by our customers to input and manage data about their own clients (for example, taxpayers or businesses that are clients of the accounting firm). Through your use of our services, we may process personal information about your clients, which could include identifying information (such as names, addresses, contact details, dates of birth), financial information (such as income, expenses, bank transaction details, assets and liabilities, tax file numbers, ABNs, payroll data), tax and accounting records (such as tax returns, financial statements, invoices), and any other personal details that you or your staff enter into the Platform. This data can be quite sensitive in nature given it relates to financial and tax matters. Important: We collect and use this information on your behalf as part of providing the service to you; we rely on you to have obtained any necessary permissions from your clients to input their personal data into the Platform.

Financial and Tax Information:

Beyond general client data, our Platform processes specific financial and tax information including: bank transaction histories (imported via file upload or open banking), Business Activity Statement (BAS) data including GST flags and amounts, Income Tax Return (ITR) data, Division 7A loan calculations, depreciation schedules, capital gains tax (CGT) computations, rental property income and expense data, journal entries, chart of accounts, and financial statements. This information is processed solely to provide the accounting and tax services you request through the Platform.

Transaction and Payment Information:

If you make payments to us (for subscriptions) or if you use our integrated payment gateway to charge your clients, we collect information about the transactions. For example, for subscription payments we might record the billing name and address, the last four digits of your credit card (note: full card details are handled by Stripe, not stored on our systems), the amount paid, and the payment date. For payments you process through the Platform, we collect details such as payer name, amount, date, and reference info for the transaction, as well as fees applied. We do not see or store your clients' full payment card numbers as that is handled by Stripe. We may store your clients' contact information (like name and email) if needed to facilitate receipts or invoices.

Open Banking / Consumer Data Right (CDR) Data:

If you choose to connect bank accounts through our open banking integration (powered by Adatree as our accredited intermediary), we collect Consumer Data Right (CDR) data. This includes bank account details (account name, BSB, account number, account type), transaction history (dates, amounts, descriptions, categories), account balances, and account holder information. CDR data is collected only with the express, informed, voluntary, current, and specific consent of the relevant data holder or consumer. CDR data is subject to additional protections as described in Section 5 of this Policy. You may withdraw your CDR consent at any time.

Voice and Audio Data:

If you or your clients interact with our AI voice agent (available via our business phone lines, powered by Twilio), we may collect voice recordings of telephone calls, voice-to-text transcriptions generated from those recordings, metadata about calls (caller number, duration, timestamps), and AI-generated summaries of call content. Callers are told at the start of each call that the call may be monitored and recorded, that they may be speaking with an AI assistant, and that they can ask to be transferred to a person at any time. Voice data is used to facilitate AI-powered responses, create bookings, and improve service quality.

Dictation:

If you or your staff use dictation to enter notes and other text, the audio you record is sent to our speech-to-text provider to be converted to text. The audio is not retained after the conversion is complete; the resulting text is stored with your practice's data like any other note you write.

FediPilot (Desktop Assistant):

If you use FediPilot, it runs on your own computer and reads the client folders you point it at, so that it can prepare working papers and fill in lodgement forms. It sends the material it needs to read to our AI providers, including Anthropic (United States), in the same way as the rest of the Platform (see Sections 6 and 9). It also stores short factual notes about you, your practice, and your clients so that it does not have to ask again -- see Session memory in Section 9. FediPilot does not lodge anything and does not send anything to the ATO; its Xero connection is read-only.

Email and Communication Data:

If you connect your Microsoft 365 account to the Platform, we access email data via the Microsoft Graph API. This may include email content (subject lines, body text, and attachments), sender and recipient information, email metadata (dates, read status, folder location), and contact information from your address book. We use this data to provide email management features within the Platform, including AI-powered email triage, drafting responses on your behalf, and sending emails through your connected account with your authorization. We access only the email data necessary to provide the requested features and in accordance with the permissions you grant during the Microsoft OAuth consent flow.

Meeting and Calendar Data:

If you connect your Microsoft 365 account, we may also access calendar and meeting data including calendar events (titles, descriptions, attendees, times), meeting transcripts and recordings where available and authorized, and action items extracted from meetings. This data is used to provide calendar synchronization, scheduling features, and AI-assisted meeting summaries within the Platform.

Document and File Data:

We collect documents and files that you upload to the Platform, including bank statements, receipts, invoices, tax documents, and other financial records, and identity documents you upload for client verification. These documents are processed using Optical Character Recognition (OCR) and AI reading technology. To do that, the document is sent to our AI providers in full -- for scans and photographs, the image itself is sent, because that is how it is read. See Section 9 for who those providers are and Section 10 for how a tax file number appearing in a document is handled. The extracted data may include names, addresses, ABNs, amounts, dates, and other information contained in the uploaded documents.

Usage Data and Device Information:

We automatically collect certain information about how the Platform is accessed and used. This includes technical information like your IP address, browser type, device type, operating system, referring URLs, and timestamps of actions. We may log user activities on the Platform (e.g. login times, features used, clicks, errors) to help troubleshoot issues and improve the service. This usage data may be collected via cookies or similar tracking technologies on our website or interface. This information generally does not identify an individual by itself, but it can be associated with your user profile. It helps us understand usage patterns and secure our services.

AI Interaction Data:

When you use our AI Copilot or other AI-powered features, we collect data relating to your interactions with the AI, including: chat session transcripts (your messages and the AI's responses), records of AI tool executions and their outcomes, AI-generated suggestions (such as transaction categorizations and comment recommendations) and whether you accepted, modified, or rejected them, feedback signals you provide on AI outputs (such as thumbs up/down ratings), and per-client memory facts extracted from AI sessions to improve future interactions. This data is used to provide, improve, and personalize AI features within the Platform.

Communications:

If you correspond with us (such as through email, support tickets, or chat), we will collect whatever information you provide in those communications. This could include your contact information and a record of the correspondence. We may also record calls to our support line if you call us, and we will inform you if a call is being recorded.

We will only collect sensitive information (such as health or criminal record information) if it is reasonably necessary for our functions and with consent or as otherwise permitted by law. Tax file numbers are not sensitive information under the Privacy Act but are separately regulated by the Privacy (Tax File Number) Rule 2015 -- see Section 10.

How We Collect Information:

In most cases, we collect personal information directly from you or your authorized users when you enter it into the Platform or send it to us. For example, you fill out account registration forms, upload client data, or send us an email. We also collect information automatically (like usage data) as described above. We collect information from third-party sources when you authorize integrations, including: bank transaction data via open banking (Adatree/CDR), email and calendar data via Microsoft Graph API, accounting data via Xero integration, and identity verification via Microsoft Azure AD. If we ever collect personal information from third-party sources for other purposes (like marketing lists or public databases), we will do so in compliance with law and will inform you as required.

3. How We Use Personal Information

We use the collected personal information for purposes consistent with the reason it was provided, and in furtherance of operating our business and providing our services. The main purposes for which we use personal information include:

Providing and Operating the Service:

We use personal information to set up and maintain your user account, to provide you with access to the Platform's features, and to process transactions. For example, we use your login information to authenticate you, your contact information to communicate with you, and your clients' financial data to generate reports or calculations that you request. Any information input into the Platform (client data, etc.) is used to carry out the software functions -- such as organizing the data in practice management, performing bank reconciliation, generating BAS and ITR forms, calculating Division 7A loans, maintaining depreciation schedules, and producing financial statements.

AI Feature Functionality:

Our Platform incorporates artificial intelligence features powered by third-party AI models: OpenAI (United States) for general AI tasks, Mistral AI (European Union) for OCR and document processing, and Anthropic (United States) for FediPilot and for selected AI assistant features in the Platform. When you use AI-powered tools, we send the relevant input data to the AI model and return the result to you. Our AI Copilot provides access to a broad set of specialised tools that can assist with tasks such as transaction categorization, report generation, email drafting, data quality auditing, and workflow automation. The AI can carry out multi-step workflows at your direction, and actions with real-world consequences require your explicit confirmation first. We use your data in this context solely to provide the requested AI-driven function, and the data may be temporarily processed by the third-party AI provider for that purpose. Importantly, we do not permit our third-party AI providers to use your data to train their models. We operate under API terms of service that contractually prohibit model training on customer data.

Cross-Practice Anonymous Learning:

To improve the accuracy and usefulness of AI features for all users, we operate a cross-practice anonymous learning system. When a transaction categorization pattern or accounting rule is confirmed by any practice, the pattern (not the underlying personal data) may be anonymized and shared across all practices to benefit the broader user base. This process involves: (a) stripping all personally identifiable information (names, addresses, ABNs, account numbers) from patterns before they enter the shared pool; (b) hashing practice identifiers with SHA-256 so no practice can be identified; (c) applying confidence scoring so only well-established patterns are shared; and (d) implementing time-decay so old patterns gradually lose influence (180-day half-life). You may opt out of contributing to cross-practice learning at any time (see Section 13). Cross-practice learning never includes tax file numbers, CDR data, or raw financial figures.

Automated Processing and Automated Decisions:

The Platform uses automated processing to help with your work. The kinds of personal information involved are client and transaction records, the documents you upload, communications, and client identification information. The automated processing includes: suggesting how to categorise transactions, flagging unusual transactions and possible data-quality problems, suggesting GST treatment, drafting documents and correspondence, reading uploaded documents, and reviewing client information for identification and screening purposes.

These are suggestions. A person makes the decision. The Platform presents AI output for you to accept, change, or reject, and actions with real-world consequences -- sending an email, submitting information to an external service, deleting data -- require your explicit confirmation first.

Because a person decides, we do not consider that we make decisions about individuals solely by automated means that significantly affect their rights or interests. From 10 December 2026, the Privacy Act requires privacy policies to describe automated decision-making of that kind. The one feature we treat as within that scope out of caution is client identification and screening, because an adverse screening result could affect a person's access to a service -- and there too, a person in your practice reviews the result and decides. We will keep this section current, and if we ever introduce a feature that makes such a decision without a person involved, we will set out here the kinds of personal information used and the kinds of decisions made before that feature is switched on.

If you believe an automated suggestion about you was wrong or unfair, contact us at privacy@fedix.com.au and a person will review it (see also Section 13).

Client Identification and Screening:

Where you use our client identification and screening features, we process the client information and identity documents you provide in order to produce a summary and highlight things that may warrant your attention. This uses AI, and identity documents are sent to our AI providers as described in Section 9.

This is an aid to your own work. Our screening is not a sanctions, politically exposed person, or watchlist database. From 1 July 2026, accountants and trust and company service providers have their own obligations under the AML/CTF regime, including customer due diligence and record keeping. Those obligations stay with your practice.

Voice AI Agent:

Our AI-powered voice agent handles incoming telephone calls to our business lines. The voice agent uses AI to understand caller intent, provide information, and create bookings on behalf of the caller. Call recordings and transcriptions are used to fulfill the caller's request, create accurate records of interactions, and improve service quality. Callers are told at the start of each call that the call may be monitored and recorded, that they may be speaking with an AI assistant, and that they can ask to be transferred to a person at any time.

Email Processing:

Where you have connected your Microsoft 365 account, we read and process emails via the Microsoft Graph API to provide email management features within the Platform. This includes AI-powered email triage and categorization, drafting email responses using AI, and sending emails on your behalf through your connected email account. Email processing occurs only within the scope of permissions you grant during the Microsoft OAuth authorization flow, and you may revoke this access at any time through your Microsoft 365 account settings.

E-Signature Processing:

We provide electronic signature functionality that allows you to send documents for signing and to sign documents electronically. We process signer identity information, timestamps, document content, and audit trail data to facilitate and record e-signatures in compliance with the Electronic Transactions Act 1999 (Cth) (see Section 11).

Payments and Fees:

We use personal information to process your subscription payments and to facilitate payments you make or receive via the Platform. For example, we will use your provided payment details to charge subscription fees. If you charge a client through the Platform, we use the client's information and the transaction details to process the payment via Stripe and to record the transaction. We also use your information to calculate any fees owed to us (such as the percentage transaction fee for using the payment gateway) and to invoice you or deduct such fees.

Communicating with You:

We use contact information (email, phone) to send service-related communications. This includes: confirmations and receipts (for sign-ups, payments, etc.), technical or security alerts (e.g., password reset emails, important security notifications), and administrative messages about your account or changes to the service. We may also send you occasional product updates, newsletters, or marketing communications about new features or promotions, but you will have the ability to opt out of marketing emails if you prefer. Even if you opt out of marketing, you will still receive critical service communications.

Support and Customer Service:

If you contact us with a question or for help, we will use the information you provided and information in our systems to assist you. For example, if you report a problem, we may access your account (with your permission) or look into your recent activity logs to troubleshoot the issue. We may also use your feedback or questions to improve our documentation or training materials. Where you send us feedback, questions, or bug reports, this includes automated tooling that reads that text and drafts proposed software changes for our engineers to review. Please avoid putting client personal information in free-text feedback -- send us a reference instead and we will look it up.

Improvement and Development:

We may use de-identified or aggregated information derived from personal data to analyze how our services are used and to improve our Platform's functionality and user experience. For instance, we might track which features are most used by accountants to inform where we should add enhancements. We analyze AI interaction patterns (in aggregate, without revealing any personal specifics) to improve AI accuracy, tune suggestion confidence thresholds, and develop new AI capabilities. We do NOT allow our third-party AI providers -- OpenAI, Mistral AI and Anthropic -- to train their models on your data. We operate under API terms of service that explicitly prohibit model training on customer data. Any internal use of data for development or improvement purposes uses anonymized and aggregated datasets only, in compliance with privacy laws.

Legal Compliance and Security:

We may use personal information as required to comply with applicable laws, regulations, and legal processes. For example, maintaining proper financial records for taxation, fulfilling obligations under privacy law (such as responding to personal data access requests), or preventing, detecting, and investigating fraud, security breaches, or other potentially prohibited activities. If necessary, we will use personal data to enforce our Terms and Conditions or to protect our rights, privacy, safety, or property, as well as those of our users or the public.

Other Purposes:

If we need to use your personal information for a purpose that is materially different from the above, and not obvious to you, we will seek your consent or provide notice as required by law. We do not use personal information for unrelated third-party advertising purposes. We do not sell personal information to data brokers. Any use of your data is primarily to serve you and operate our software service.

4. Disclosure of Personal Information

We will not sell or rent your personal information to third parties for their marketing purposes. We only disclose personal information to third parties in the ways described below, or as permitted by law, and always with appropriate safeguards.

Service Providers:

We use trusted third-party companies to perform certain functions on our behalf in connection with operating the Platform. We only share personal information with them as necessary for the services they provide. Key service providers include:

Cloud Hosting and Infrastructure: We host data on DigitalOcean (Sydney, Australia region) and MongoDB Atlas (Sydney, Australia region). Our primary data storage is within Australia. These providers store databases and files for our application and enable our Platform to run continuously.

AI Service Providers: When you use AI features, data pertinent to the task is sent to external AI service providers for processing. Our current AI providers are OpenAI (United States) for general AI tasks including the AI Copilot, categorization, report generation, and agent orchestration; Mistral AI (France/European Union) for OCR and document processing; and Anthropic (United States) for FediPilot and for selected AI assistant features in the Platform. We send only the data needed for the task you asked for. For document reading, that necessarily means the whole document, including the image for a scan or photograph. We do not allow any third-party generative AI tool providers to train their models using your data. We operate under API terms of service with OpenAI, Mistral AI and Anthropic that prohibit the use of customer data for model training. Data sent to these providers is processed solely to generate the requested output and is not retained by the provider beyond the processing window specified in their API terms.

Payment Processors: We share necessary information with Stripe (United States, with Australian presence) to handle financial transactions. Stripe processes credit card details for subscriptions and client payments. They are authorized to use this information only as needed to provide the payment service and to comply with their own legal obligations (including anti-fraud and KYC requirements). Please refer to Stripe's Privacy Policy for details on their practices.

Identity and Authentication: Microsoft Azure Active Directory (United States) is used for Single Sign-On (SSO) authentication. When you log in via SSO, Microsoft processes your authentication credentials and provides us with identity tokens.

Open Banking: Adatree (Australia) operates as our accredited intermediary for Consumer Data Right (CDR) data. When you connect bank accounts, Adatree facilitates the secure transfer of banking data from your financial institution to our Platform. CDR data handling is subject to additional protections described in Section 5.

Communications: Twilio (United States) provides our SMS and voice telephony services, including the AI voice agent. Twilio processes phone numbers, call audio, and SMS content. Microsoft Graph API (United States) is used for email and calendar integration when you connect your Microsoft 365 account.

Accounting Integration: If you connect your Xero (Australia/New Zealand) account, we exchange accounting data between the Platform and Xero as authorized by you during the OAuth consent flow.

Analytics and Monitoring: We may use analytics tools to understand how the Platform is used or to catch errors. These tools might incidentally collect some data like user IDs or metadata, but we do not intentionally send them sensitive content.

Professional Advisors: On occasion, we may share necessary information with our professional advisors (lawyers, accountants, auditors) when needed for consultations in running our business, but this would only occur under duties of confidentiality.

We require our service providers to handle personal information in accordance with applicable law and only for the purposes we specify. They are not permitted to use your data for their own unrelated purposes. We strive to choose reputable providers that have strong security and privacy policies.

Within Your Organization:

If you are using our Platform as part of a firm (our customer), information that you input is generally available to others within your firm's account (subject to any permission settings the account admin configures). For example, if one employee uploads a client document, another employee at the same firm with appropriate access rights will be able to see that document. This is considered internal to your organization, not a disclosure by us to a third party. You control who in your team has access to various data through the Platform's settings.

Cross-Practice Anonymous Data Sharing:

As described in Section 3 (Cross-Practice Anonymous Learning), anonymized categorization patterns may be shared across practices to improve AI accuracy for all users. This sharing involves only abstract patterns (e.g., "transactions with narrative pattern X are typically categorized as Y"), never raw personal data. Practice identifiers are hashed with SHA-256, and all personally identifiable information is stripped before patterns enter the shared pool. Tax file numbers, CDR data, specific financial amounts, and client identities are never included in cross-practice sharing. You may opt out of this feature at any time.

Business Transfers:

If in the future our company is involved in a merger, acquisition, sale of assets, or similar corporate transaction, personal information may be transferred to the new owner or successor entity as part of that deal. We would ensure that the successor is bound to protect personal information in a manner consistent with this Privacy Policy (for example, by contract or by the nature of the transaction). We would also provide notice to you before personal information is transferred or becomes subject to a different privacy policy due to a corporate change.

Legal Compliance and Protection:

We may disclose personal information to courts, law enforcement, governmental or regulatory authorities if required to do so by law or if we have a good faith belief that such disclosure is reasonably necessary to (i) comply with a legal obligation, legal process or request (such as a subpoena, court order, or administrative request), (ii) enforce our Terms and other agreements, (iii) detect, prevent, or address fraud, security, or technical issues, or (iv) protect the rights, property, or safety of our company, our users, or the public. We will endeavor to limit the information disclosed to what is necessary and will object to overbroad requests when appropriate.

Your Consent or Direction:

We will disclose or share your information in other ways if you have expressly asked us to or consented. For instance, if you integrate or authorize a third-party application to access your data on our Platform, we will share data with that third party as needed (with your consent guiding the scope).

De-identified or Aggregated Data:

We may share information that has been anonymized or aggregated (so it is no longer associated with an identifiable individual) for various purposes -- such as statistical analysis, improvement of our services, benchmarking, or research. This is not personal information, and such data would not identify you or any individual. For example, we may publish reports on trends (e.g., "X% of reconciled transactions are categorized as office expenses") that contain no personal details. We ensure that de-identification is irreversible and that aggregated datasets cannot be re-identified through combination with other data sources.

5. Consumer Data Right (CDR) and Open Banking

Our Platform integrates with Australia's Consumer Data Right (CDR) regime to enable open banking functionality. This section describes the additional protections that apply specifically to CDR data.

Our CDR Accreditation:

We access CDR data through our accredited intermediary, Adatree, which holds the relevant accreditation under the CDR regime. We operate as an outsourced service provider under this arrangement and comply with the obligations applicable to our role, including the 13 Privacy Safeguards set out in the Competition and Consumer Act 2010 (Cth), Part IVD, Division 5.

Types of CDR Data Collected:

When you consent to connect a bank account, we may collect the following CDR data: account details (account name, BSB, account number, account type), transaction history (dates, amounts, descriptions, reference numbers), account balances (current and available), and account holder information (name and contact details as provided by the data holder).

CDR Consent Requirements:

CDR data is collected only with consent that is: (a) express -- you must actively opt in; (b) informed -- you are told exactly what data will be collected and how it will be used; (c) voluntary -- you are not required to provide CDR consent to use other Platform features; (d) current -- consent has not expired or been withdrawn; and (e) specific -- consent relates to particular data types and uses. CDR consent is time-limited and must be renewed periodically.

How to Withdraw CDR Consent:

You may withdraw your CDR consent at any time through the Platform's open banking settings or by contacting us at privacy@fedix.com.au. Upon withdrawal, we will cease collecting new CDR data from the relevant accounts. Previously collected CDR data will be destroyed or de-identified in accordance with our CDR data retention obligations (see below), unless retention is required by law.

CDR Data Retention and Deletion:

CDR data is retained only for as long as necessary to provide the services you have consented to. When CDR data is no longer needed for the consented purpose, or when you withdraw consent, CDR data will be destroyed or de-identified as required by the CDR rules. Redundant CDR data (data that is no longer required) is destroyed or de-identified within the timeframes prescribed by the CDR regime.

Restrictions on CDR Data Use:

CDR data is subject to strict use limitations under the CDR regime. In particular: CDR data is not used for cross-practice anonymous learning or pattern sharing; CDR data is not sent to third-party AI providers for model training or any purpose beyond providing the specific service you requested; CDR data is not used for direct marketing; and CDR data is not sold or disclosed to any third party except as required to provide the consented service or as required by law.

6. Cross-Border Data Transfers

Location of Data Processing:

We are an Australian-based service and we primarily host data in Australia. Our primary hosting infrastructure is located in DigitalOcean's Sydney (Australia) region, and our primary database is hosted on MongoDB Atlas in the Sydney (Australia) region. However, some personal information may be disclosed to, transferred to, or processed on servers in countries outside Australia in the course of using the third-party services described above.

The countries and regions where your data may be processed include:

• Australia (primary): DigitalOcean Sydney (hosting), MongoDB Atlas Sydney (database), Adatree (open banking/CDR), Xero (accounting integration)
• United States: OpenAI (AI processing), Anthropic (AI processing, including for FediPilot), Stripe (payment processing), Twilio (SMS and voice telephony), Microsoft Azure AD (authentication), Microsoft Graph API (email and calendar)
• European Union / France: Mistral AI (OCR and document processing)

We only transfer personal information internationally in compliance with Australian Privacy Principle 8 (APP 8). This means either the recipient is subject to a law or binding scheme substantially similar to Australian privacy protection, or we take reasonable steps to ensure they will handle the information in a manner consistent with the APPs (for example, by contract), or an exception applies (such as you consent to the transfer, or it is necessary for our contract with you). In practice, we have data protection agreements in place with our key service providers.

We rely primarily on APP 8.1: we take reasonable steps to ensure each overseas recipient handles personal information consistently with the Australian Privacy Principles, and we bind each of them by contract to do so. Where an exception applies -- for example where the transfer is necessary to perform our contract with you, or where you have consented by choosing to use a feature that requires it -- we may also rely on that exception. Consent is not the basis we lead with. If in future we rely on providers in additional locations, we will update this Policy accordingly.

While the overseas recipient of personal information will be subject to their own laws, we will remain responsible for protecting that personal information under Australian privacy law requirements, and will take such steps as are reasonable in the circumstances to ensure the information is safeguarded. We strive to work with reputable providers with strong privacy track records to mitigate this risk.

Note regarding CDR data: CDR data is subject to additional cross-border transfer restrictions under the CDR regime. CDR data will only be transferred overseas where permitted by the CDR rules and the Privacy Safeguards.

7. Data Retention and Deletion

We retain personal information only for as long as it is necessary to fulfill the purposes for which we collected it, or as required for our business operations or by law.

Active Accounts:

For as long as you have an active subscription or account with us, we will retain your account information and the data you have stored on the Platform. This is necessary to provide you with the service continuously. We also retain archives and backups of data to ensure reliability and disaster recovery.

Inactive Accounts:

If your subscription ends or your account is closed (either by you or us), we will retain your data for a limited period. Our standard policy is to retain the main data related to your account for approximately 90 days after termination of the service. This retention period allows for grace in case of account reactivation or retrieval of information that might have been forgotten. During this window, you may contact us to request retrieval of specific data if you did not download it before termination. After this period, we will proceed to delete or anonymize the personal information in the account. Client data that you had stored will be purged or irreversibly de-identified from our production systems, unless retention for longer is required (see exceptions below).

CDR Data:

CDR data is destroyed or de-identified when it is no longer needed for the consented purpose, when you withdraw CDR consent, or when required by the CDR rules -- whichever occurs first. CDR data is not retained beyond the period necessary to provide the service you consented to.

Voice Recordings:

Voice call recordings are retained for a period of 12 months from the date of the call, after which they are permanently deleted. Transcriptions derived from voice recordings may be retained for longer if they form part of a client record or booking, but the original audio recording is deleted after the 12-month period.

AI Session Data:

AI Copilot session transcripts and interaction data are retained for service improvement and to provide session history features. After 12 months, AI session data is anonymized (personal identifiers removed) but may be retained in anonymized form for analytics and AI improvement purposes. Client memory facts extracted from sessions are retained for as long as the client record exists and are deleted when the client is removed.

Cross-Practice Learning Patterns:

Anonymized cross-practice patterns are subject to a time-decay model where pattern confidence decays over a 180-day half-life. Patterns that are no longer confirmed by any practice and have decayed below the minimum confidence threshold are automatically deactivated and eventually purged from the system.

Legal and Operational Retention Obligations:

In some cases, we may need to retain certain information for longer than the standard period due to legal obligations or legitimate business purposes:

• Financial Records: Billing records, invoices, and payment history are retained for 5 to 7 years as required under Australian tax law.
• TFN Information: Destroyed or permanently de-identified once no longer needed for a lawful tax-related purpose, in accordance with the Privacy (Tax File Number) Rule 2015 (see Section 10).
• Log Data: Security and audit logs are retained for up to 12 months for security, fraud detection, and abuse prevention, unless a specific incident necessitates longer retention.
• Backup Storage: System backups may retain fragments of data for a longer duration even after deletion from live systems. Backups are secured and eventually rotate according to our backup retention schedule.
• Dispute or Enforcement Matters: If we are aware of a dispute, investigation, or legal claim, we may retain relevant information until the issue is resolved.
• E-Signature Records: Electronic signature audit trails and signed documents are retained for the statutory period applicable to the type of document signed (typically 5-7 years for tax and financial documents).

Data Export and Portability:

You may request an export of your data at any time while your account is active, or within the 90-day post-termination grace period. We can provide data exports in standard machine-readable formats including CSV, JSON, and PDF. To request a data export, contact us at privacy@fedix.com.au.

Deletion Process:

When personal information is no longer needed and is slated for deletion, we take reasonable steps to securely destroy or anonymize it. "Destroy" means we will delete the records from our databases, and "anonymize" means we alter the information so that it no longer can be associated with an identifiable individual. Please note that removal from our active databases does not immediately remove all traces of data from every system (due to caching, backups, etc.), but we will ensure that it is no longer readily accessible or used.

8. Data Security

We take security measures seriously to protect personal information against loss, misuse, and unauthorized access or disclosure. These measures include:

Encryption:

We use industry-standard encryption to protect data in transit and at rest. All data transmitted between your device and our servers is encrypted using HTTPS (TLS 1.2 or higher). Sensitive personal data stored in our databases, including tax file numbers, is encrypted at rest using AES-256-GCM encryption. Where personal identifiers such as TFNs appear in structured fields, we remove them before sending a record to an AI provider; documents you upload for reading are sent in full, including as images (see Sections 9 and 10). We maintain HMAC-based search hashes for encrypted fields to enable querying without exposing plaintext values. Encryption keys are subject to periodic rotation.

Access Controls:

We limit access to personal information to employees, contractors, and service providers who need to know it in order to operate and improve our services. Those with access are subject to confidentiality obligations. We employ Role-Based Access Control (RBAC) to ensure users can only access data appropriate to their role. Administrative access requires Multi-Factor Authentication (MFA/TOTP). All user accounts are individual (no sharing of logins among staff). Access to TFN information is further restricted and all access is audit-logged.

Security Testing and Maintenance:

We regularly update our software and infrastructure to address security vulnerabilities. We use firewalls and monitoring tools to guard against malicious activity. We conduct security assessments of the Platform and follow secure development practices including code review, input validation, parameterized database queries, and output encoding.

Organizational Policies:

Our team is trained on privacy and security best practices. We have internal policies for how to handle personal data, and we limit the personal data that is stored on portable devices. We also have an incident response plan for handling potential data breaches.

Despite our efforts, it is important to understand that no security system is impenetrable. We cannot guarantee absolute security of our systems or of data transmissions, and you accept the inherent risks of providing personal information and using internet-based services. We encourage you to also take precautions: use strong passwords, protect your account credentials, and log out of the Platform when finished, especially on shared devices.

Notifiable Data Breaches:

In the event of a data breach that affects your personal information, we will promptly assess the incident in accordance with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988. We will complete our assessment within 30 days of becoming aware of a suspected breach. If the breach is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable. In the case of a ransomware payment or cyber extortion event, we will report it to the Australian Signals Directorate (ASD) within 72 hours as required by Part 3 of the Cyber Security Act 2024 (Cth). We will also strive to minimize any damage and prevent future incidents.

If you believe your account or data may have been compromised or have any security concerns, please contact us immediately at privacy@fedix.com.au or call 1300 166 777.

9. Artificial Intelligence and Automated Processing

Artificial intelligence is a core component of our Platform. This section provides transparency about how AI is used, what data it processes, and your rights in relation to AI-driven features.

AI Features Overview:

Our Platform incorporates AI across multiple features, including but not limited to: an AI Copilot assistant with a broad set of specialised tools that can carry out multi-step accounting workflows at your direction; FediPilot, our desktop AI assistant (see Section 2); automated transaction categorization and comment suggestions (displayed as ghost text in the reconciliation grid); automated anomaly detection and data quality auditing; AI-powered report generation and rewriting; AI-assisted email drafting and triage; AI-assisted client identification and screening; OCR-based document processing (receipt scanning, bank statement extraction); AI voice agent for incoming telephone calls; and cross-practice anonymous pattern learning.

Data Processed by AI:

When AI features are invoked, the following data may be sent to AI providers: transaction data (narratives, amounts, dates), client context (entity type, industry), accounting categories and chart of accounts, the documents you upload, in full, email content (for AI triage and drafting), and voice audio (for transcription). For PDFs we send the document; for scans and photographs -- including photographs of receipts, invoices and bank statements, and identity documents uploaded for client verification -- we send the image itself, because that is how it is read. Text taken from a document is then processed further by a large language model.

We send only the data needed for the task you asked for. For document reading, that necessarily means the whole document. Where personal identifiers such as TFNs appear in structured fields, we remove them before sending a record to an AI provider. Documents you upload for reading are sent in full, including as images -- see Section 10 for how TFNs in documents are handled.

Third-Party AI Model Training:

We do not permit our third-party AI providers -- OpenAI, Mistral AI and Anthropic -- to use your data to train their models. We operate under commercial API agreements with each of them that prohibit training on data submitted through the API. Under those agreements the providers retain your data only for as long as their API terms allow for abuse monitoring and legal compliance. We review these agreements periodically to ensure these protections remain in place.

Cross-Practice Anonymous Learning:

Our cross-practice learning system improves AI accuracy by sharing anonymized categorization patterns across practices. This system: strips all personally identifiable information before patterns enter the shared pool; hashes practice identifiers with SHA-256; applies confidence scoring and time-decay (180-day half-life); never includes TFNs, CDR data, specific financial amounts, or client identities; and provides an opt-out mechanism. The shared patterns are abstract rules (e.g., "transactions matching narrative pattern X are typically categorized as Y") and do not contain or reveal any personal information.

Human Oversight:

All AI outputs are presented as suggestions only. AI categorization suggestions appear as ghost text that users must explicitly accept or dismiss. AI-generated reports and communications are presented as drafts for user review before finalization. Destructive or consequential operations initiated through the AI Copilot require explicit user confirmation before execution. The AI does not make final decisions on behalf of users without human approval.

AI Accuracy Disclaimer:

While we strive for high accuracy, AI outputs may contain errors, inaccuracies, or hallucinations. AI-generated content (including categorizations, reports, emails, and recommendations) should always be reviewed by a qualified professional before being relied upon. We do not warrant the accuracy, completeness, or fitness for purpose of any AI-generated output. Users are responsible for verifying AI outputs before acting on them.

Session Memory:

So that you do not have to repeat yourself, the AI assistant records short factual notes from your sessions -- about how you like work presented, about your practice, and about your clients' circumstances. These notes are stored with your practice's data, are not shared with other practices, and are not used to train any AI provider's models. You can view, correct, and delete them at any time by contacting us at privacy@fedix.com.au, and they are deleted when the related client record or your account is deleted.

Search Embeddings:

We create numerical representations (embeddings) of some of your content so that search can find things by meaning rather than by exact wording. These are generated using an AI provider and stored with your practice's data. They are not shared between practices.

A Note for Your Clients:

Most of the personal information in the Platform is information about your clients, collected by you. When you use an AI feature on it, that information is sent to the AI providers listed in Section 6, including overseas. We think a person would reasonably expect their accountant to use software with these capabilities to prepare their work, but they can only expect it if they are told. We recommend your engagement letter or privacy collection notice tells clients that you use AI-assisted software and that their documents may be processed overseas by your service providers. Contact us at privacy@fedix.com.au and we will give you wording you can use.

Your AI Rights:

You have the right to: opt out of AI features in the Platform and use its manual functionality instead (FediPilot is itself an AI assistant, so opting out of AI means not using FediPilot; opting out does not change your subscription fee or your included AI credit allowance); opt out of contributing to cross-practice anonymous learning; request information about how a specific AI decision was reached; and contest any automated decision and request human review. To exercise any of these rights, contact us at privacy@fedix.com.au.

10. Tax File Number (TFN) Information

Tax file numbers are subject to additional protections under the Privacy (Tax File Number) Rule 2015, a legally binding rule made under section 17 of the Privacy Act 1988. A breach of the TFN Rule is an interference with privacy under that Act. We handle TFN information in strict accordance with these requirements.

Collection and Use:

TFNs may be entered into the Platform as part of a client's tax profile by the subscribing accounting firm. We collect and process TFN information solely for lawful tax-related purposes, including the preparation of tax returns and related compliance activities carried out by your practice.

Encryption and Storage:

TFNs are encrypted at rest using AES-256-GCM encryption. TFN data is stored in a manner that segregates it from other personal information where practicable. Access to stored TFN data requires specific authorization beyond standard Platform access.

Access Restrictions:

Access to TFN information is restricted to authorized personnel within the subscribing firm (as controlled by the firm's account administrator) and to our technical staff only when necessary for system maintenance or support. All access to TFN data is recorded in an audit log that captures the identity of the accessor, the timestamp, and the purpose of access.

Transmission:

TFNs are never transmitted via unencrypted email or other insecure channels. TFN data is transmitted only via our encrypted Platform (HTTPS/TLS) or through secure integrations with government systems (such as the ATO).

AI Processing:

Where you type or store a TFN in a structured field, we do not send it to our AI providers -- it is removed before the record is sent.

Where you upload a document that contains a TFN -- for example a scanned notice of assessment, a payment summary, or an identity document -- the document is sent to our AI providers in full so that they can read it. This includes the image itself for scans and photographs. It is not technically possible to remove a TFN from an image before it is read.

We do this only for the tax-related purpose you uploaded the document for, which is a purpose authorised by taxation law under Rule 10 of the Privacy (Tax File Number) Rule 2015. We do not send TFNs to AI providers for any other purpose. Our AI providers process the document under commercial agreements that prohibit them from using it to train their models, and they retain it only for the short period their API terms allow for abuse monitoring and legal compliance. TFNs are never included in cross-practice learning patterns or any shared data pool.

If you would prefer a document containing a TFN not to be processed this way, do not use the AI document-reading features for that document. You can enter the information manually -- the Platform's manual functionality works without AI.

Destruction:

TFN information is destroyed or permanently de-identified once it is no longer needed for a lawful tax-related purpose, in accordance with the Privacy (Tax File Number) Rule 2015. This includes when a client record is deleted, when the subscribing firm's account is terminated (after the 90-day grace period), or when the TFN is no longer required for the purpose for which it was collected.

11. Electronic Signatures

Our Platform provides electronic signature (e-signature) functionality in compliance with the Electronic Transactions Act 1999 (Cth) and equivalent state and territory legislation.

Audit Trail:

For every e-signature, we maintain a comprehensive audit trail that records: the identity of the signer (name and email address), the date and time of signing (with timezone), the IP address from which the document was signed, a cryptographic hash of the document at the time of signing to ensure document integrity, and the method of identity verification used. This audit trail is retained for the statutory period applicable to the signed document.

Document Retention:

Electronically signed documents and their associated audit trails are retained for the period required by applicable law, which is typically 5-7 years for tax and financial documents. You may download copies of signed documents at any time while your account is active.

Excluded Documents:

Certain types of documents are excluded from electronic signature under Australian law, including wills, powers of attorney, and certain real property transactions (which may vary by state and territory). Our Platform is not intended to be used for documents that are excluded from electronic signature by law, and we recommend obtaining legal advice if you are unsure whether a particular document type is suitable for electronic execution.

12. Cookies and Tracking Technologies

We use cookies and similar technologies on our website and Platform. This section explains the types of cookies we use and your choices regarding them.

Essential Cookies:

These cookies are strictly necessary for the Platform to function. They include authentication tokens (JWT), session identifiers, and CSRF protection tokens. Without these cookies, you cannot log in or use the Platform. These cookies cannot be disabled.

Functional Cookies:

These cookies remember your preferences and settings, such as your preferred theme (light or dark mode), language preferences, and UI layout choices. They enhance your experience but are not strictly necessary.

Analytics Cookies:

We may use analytics cookies to understand how users interact with our Platform, which features are most popular, and where users encounter difficulties. This data is collected in aggregate and is used to improve the Platform's usability and performance.

No Advertising Cookies:

We do not use third-party advertising cookies or tracking pixels. We do not serve advertisements on our Platform and do not share cookie data with advertising networks.

Managing Cookie Preferences:

You can set your browser to refuse some or all cookies or to alert you when cookies are being sent. However, if you disable essential cookies, some parts of the Platform (including login) will not function properly. Most modern browsers provide cookie management settings in their privacy or security preferences.

13. Your Rights and Choices

We believe in transparency and enabling our users to have control over their personal information. Your rights and choices include:

Access and Correction:

You have the right to request access to the personal information we hold about you (APP 12) and to request correction of any inaccuracies (APP 13). Most of the information related to your account can be viewed and edited by you directly when logged in. If you need assistance or wish to get a full copy of your personal data, you can contact us. We will handle access and correction requests in accordance with the APPs -- typically we will respond within 30 days. We may require you to verify your identity before releasing personal data.

Data Portability:

You have the right to request an export of your data in machine-readable formats (CSV, JSON, PDF). We will provide the requested export within a reasonable timeframe. This right applies to data you have provided to us and data generated through your use of the Platform.

Deletion/Erasure:

You may request deletion of your personal information. Upon receiving a valid deletion request, we will delete or de-identify the relevant data, subject to any legal retention obligations (see Section 7). If you are an end-client of one of our customer firms, you may need to direct your deletion request to the firm, as they control their client data on the Platform. We will assist our customers in fulfilling deletion requests.

Marketing Opt-Out:

If we send you marketing or promotional emails, you can opt out by clicking the unsubscribe link in the email or contacting us. Even if you opt out of marketing, you will still receive transactional or administrative communications (such as service notifications, security alerts, and billing communications).

AI Opt-Out:

You have the right to disable AI features and use the Platform's manual functionality only. FediPilot is itself an AI assistant, so opting out of AI means not using FediPilot. Opting out does not change your subscription fee or your included AI credit allowance. You may also opt out of contributing to cross-practice anonymous learning while continuing to use other AI features. To exercise either option, contact us at privacy@fedix.com.au and we will apply it to your practice.

CDR Consent Withdrawal:

If you have connected bank accounts via open banking (CDR), you may withdraw your CDR consent at any time through the Platform's open banking settings or by contacting us. Withdrawal of CDR consent does not affect the lawfulness of processing conducted prior to the withdrawal (see Section 5).

Automated Decision Contestation:

You have the right to contest any decision made by automated processing and to request human review. If you believe an AI-generated suggestion or automated decision is incorrect or unfair, contact us and we will arrange for a qualified person to review the matter.

Consent Withdrawal:

Where we rely on your consent to process personal information, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of any processing conducted prior to the withdrawal, and it may mean we cannot provide certain services to you if those services relied on consent.

Complaints:

If you have a concern or complaint about how we have handled your personal information, you have the right to complain and we encourage you to contact us first so we can try to resolve it (see Section 16 for contact details and the complaints process).

Please note that because our customers are businesses, if you are an individual end-client of one of our customer firms, your rights to access or correct information may also be exercisable through that firm. The accounting firm holds the primary relationship with you and may have their own privacy obligations to you. You are also free to contact us directly and we will do our best to assist or direct your request appropriately.

14. Children's Privacy

Our services are not designed for or directed at children under the age of 18. As a business platform for professional accounting use, we do not expect any child to be using our Platform. We do not knowingly collect personal information from individuals under 18. If you are under 18, you should not use the Platform or provide any personal information on it. If we become aware that we have inadvertently collected personal information from a child under 18, we will take steps to delete it as soon as possible. If you believe that we might have any information from or about a minor, please contact us so that we can address it.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, and other factors. When we make a material change, we will notify our users in an appropriate manner -- for example, by posting a prominent notice on our website or within the Platform, or by sending an email notification. The "Last Updated" date at the top will always indicate when the latest changes were made. We encourage you to review this Policy periodically to stay informed about how we are protecting your information. If you continue to use the Platform after a revised Privacy Policy has been posted, it means you accept the changes. For any significant changes, especially those that may require your consent, we will obtain such consent as required by law.

16. Contact Us and Privacy Complaints

If you have any questions, concerns, or requests regarding this Privacy Policy or the personal information we hold about you, please contact us at:

Privacy Officer, Tax7 R&D Pty Ltd
Email: privacy@fedix.com.au
General Enquiries: support@fedix.com.au
Address: Level 1, 213 Clarence Street, Sydney NSW 2000
Postal: PO Box Q28, Queen Victoria Building, NSW 1230
Phone: 1300 166 777

We will do our best to respond to your inquiry or request promptly and within any timeframes required by law (typically within 30 days for access and correction requests). If you are contacting us to exercise a privacy right, please provide enough information for us to verify your identity and locate your data (for example, the email associated with your account and the specific request).

Complaints:

If you believe we have breached your privacy rights or the Australian Privacy Principles, you may send us a written complaint to privacy@fedix.com.au. Please include details of the incident so we can investigate it. We will acknowledge your complaint within 7 business days and aim to resolve all complaints within 30 days. If you are not satisfied with our response or the way we handled your complaint, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC). The OAIC can be contacted at:

Phone: 1300 363 992
Email: enquiries@oaic.gov.au
Mail: GPO Box 5218, Sydney NSW 2001
Website: oaic.gov.au

For individuals outside of Australia: you may have rights under your local privacy laws as well. We will endeavor to respect those where applicable and will try to resolve privacy concerns in a fair and effective manner.

Effective Date:

This Privacy Policy is effective as of 10 September 2026 and replaces the version effective 31 March 2026. By using our Platform after that date, you acknowledge that you have read and understood this Policy. Your continued use of the Platform signifies acceptance of this Privacy Policy. Thank you for entrusting us with your data; we value your privacy and confidence in our services.