Privacy policy

Summary

This summary is a short guide. The full policy below gives the detail.

• TrueAgent Pty Ltd runs AP Maestro, a service that helps businesses handle supplier invoices.
• Most personal information we handle is in invoices and emails our customers send us. We handle it to provide the service to those customers. We follow the Australian Privacy Principles for all of it.
• We use OpenAI to read invoices. OpenAI processes them outside Australia, mainly in the United States. Neither we nor OpenAI use them to train AI models.
• If you connect a Gmail mailbox, we use what we read in it only to find and handle your invoices, as Google's Limited Use rules require (see 8.6).
• Our main database is in Sydney. Some of our service providers are overseas, mainly in the United States.
• We don't sell personal information.
• You can ask to see or correct your information, and complain to us if something goes wrong.

1. Who we are and what this policy covers

1.1 This policy explains how TrueAgent Pty Ltd (ACN 636 626 956) (we, us, our) handles personal information for AP Maestro. That includes the AP Maestro app (the Service), the apmaestro.com website, and our sales and support for AP Maestro.

1.2 We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth).

1.3 TrueAgent's other services are covered by the TrueAgent privacy policy at trueagent.com.au/privacy.

2. The information this policy covers

2.1 Account information. This is information about the people who use the Service and the people who contact us. It includes their name, email address and how they use the Service.

2.2 Customer Data. This is what our customers put into the Service: invoices, statements, emails and attachments, supplier details, coding, approvals and comments. It often includes personal information about other people, such as a sole trader's name, email address and bank details. We handle Customer Data to provide the Service to the customer, as our Terms of Service set out.

2.3 We follow the Australian Privacy Principles for both kinds of information, and this policy covers both. If we hold your personal information, you can ask us for access or correction, or complain to us. This is true even if a business put your information in the Service.

2.4 The business that put your details in the Service may also have duties to you. You can contact that business as well as us.

3. What we collect

3.1 People who use the Service

• Your name and email address.
• Your role in each business you belong to, and any limits on which companies or suppliers you can see or approve.
• What you do in the Service, such as approvals, edits, comments, and who invited you. These are kept as a history of each invoice.
• Your sign-in details. Our sign-in provider keeps a password hash and records of your sign-in sessions. These records, and our hosting provider's request logs, can include your IP address and browser type.
• If you connect a Microsoft 365 or Gmail mailbox, the name and sign-in address of the account you connect.
• How you use the Service, recorded by our analytics tool (see section 9).

3.2 People named in Customer Data

Invoices, statements and emails can contain:

• supplier names, business names, ABNs, addresses, email addresses and phone numbers;
• bank details printed on invoices, such as account name, BSB and account number;
• names and addresses of the people or businesses an invoice is billed to, and customer account numbers;
• for each email in an inbox connected to the Service, the sender, recipients, subject and time it arrived. We use these to find invoices and to avoid processing an email twice. For emails with no invoice, we delete these details after 90 days;
• the email text, if the customer turns on a setting that sends email text to our AI. With that setting on, we keep the first 2,000 characters, and the full text of an email that holds a supplier statement;
• for email sent to an AP Maestro intake address, a copy of the whole email.

When a customer connects Xero or QuickBooks, we copy the names, ABNs and ids of its contacts, so we can match invoices to suppliers. For suppliers, we also copy email addresses and bank details, so we can check the bank details on invoices. We don't keep bank details or email addresses for the customer's own customers. From QuickBooks we copy only the BSB and the last digits of each account number.

3.3 People who use our website

• If you book a walkthrough: your name, email, phone (optional), business name, your answers about your business, and any notes.
• How you use the website, recorded by our analytics tool (see section 9).

3.4 Sensitive information

We don't ask for sensitive information, such as health information. It can appear in documents customers send us. We ask customers not to send it unless it is part of an ordinary business document. If we find sensitive information we don't need, we delete it.

4. How we collect it

4.1 We collect personal information:

• from you, when you use the Service, contact us or book a walkthrough;
• from our customers, when they invite you, upload documents, forward emails, or connect mailboxes and accounting systems;
• from connected systems such as Xero, QuickBooks, Microsoft 365 and Gmail, with the customer's permission; and
• automatically, through cookies and our analytics tool, when you use the website or the Service.

4.2 Sometimes we receive personal information we didn't ask for. We check within a reasonable time whether we could have collected it ourselves. If not, we delete it or remove the details that identify people, as soon as practicable, where it is lawful and reasonable to do so.

5. How we use it

5.1 We use personal information to:

• provide the Service, including reading invoices, suggesting coding, routing approvals and sending bills to accounting systems;
• check supplier bank details against the customer's records, to help prevent payment fraud;
• send emails the Service needs to send, such as invitations, notices and digests;
• send emails to suppliers when a customer's user asks us to;
• give support, fix problems and keep the Service secure;
• understand how the Service is used, so we can improve it (see section 9);
• bill our customers and keep business records;
• tell people who have agreed to hear from us about AP Maestro (see section 13); and
• meet our legal obligations.

5.2 We don't sell personal information. We don't use Customer Data for advertising or marketing. We never show one business's data to another business, or use it for another business.

6. AI and automated decisions

AI we use

6.1 We use OpenAI's API to:

• read each invoice or statement. We send OpenAI the whole document and its file name;
• work out what kind of document it is;
• suggest which of the customer's companies an invoice belongs to. For this we send details such as the billed-to name and address, the supplier name, the invoice number, and the email sender and subject;
• suggest which supplier sent an invoice. For this we send the supplier names and ABNs on the customer's list, and the details printed on the invoice;
• suggest account codes. For this we send invoice line details, amounts, the supplier name, the customer's chart of accounts and its past coding. We don't send the document or bank details for this; and
• if the customer turns on the setting, read the text of incoming emails.

6.2 OpenAI processes this data in the United States, and may use other countries. We have set our requests so that OpenAI does not store them for later use. OpenAI may keep them for up to 30 days to check for misuse, or longer if the law requires it or to protect against harm.

6.3 OpenAI's terms say it does not use our API data to train its models, and we have not agreed to let it. We don't use Customer Data to train AI models.

Steps done by software

6.4 The Service uses software, including AI, for some steps. These steps use:

• the names, ABNs, addresses, email addresses and account numbers on invoices, for suppliers and for the people invoices are billed to;
• bank details printed on invoices, and bank details in the customer's accounting system;
• the sender, recipients and subject of emails; and
• the customer's own records, such as its companies, suppliers, past invoices and past coding.

6.5 The software does these steps on its own, with no person deciding each one:

• It decides whether a document is an invoice, a credit note, a statement, a remittance or something else. Only invoices and credit notes go on for approval.
• It assigns an invoice to one of the customer's companies. It does this when the customer's rules match, or when an AI suggestion passes a confidence level the customer has set.
• It links an invoice to a supplier.
• It fills in account codes. It uses the customer's saved rules, past coding and AI suggestions above a set confidence level. It remembers the codes a business's staff chose for a supplier, and reuses them for that business only.
• It holds an invoice when the bank details on it differ from those in the customer's accounting system. While the invoice is held, no one can approve it or send it to the accounting system. It stays held until an admin records that they checked the details with the supplier.

6.6 The software also helps people decide. It flags possible duplicates and credit notes, marks invoices for checking, and suggests companies, suppliers and account codes. A person sees these before the invoice is approved.

6.7 These steps can affect whether or when a supplier is paid. Each invoice is approved in the name of a user at the customer's business before it goes to the accounting system. Usually that user approves it. A user can also let an outside AI assistant approve invoices for them (see 6.8). The Service does not make payments. If you think one of these steps has affected your invoice, contact the business you invoiced, or contact us (see section 12).

Outside AI assistants

6.8 A user can connect an outside AI assistant, such as Claude or ChatGPT, to the Service. The assistant can then do what that user can do with invoices, documents and emails. That includes reading them, approving invoices, and sending invoices back to suppliers by email. When the assistant asks, we send it the information. The assistant's provider, such as Anthropic or OpenAI, is usually in the United States. It handles the information under its own terms. Our promise in 6.3 does not cover that provider. An admin can turn this off for their business, and can see and remove connected assistants.

7. Who we share it with

7.1 We share personal information with:

• our service providers, listed in section 8, who help us run the Service;
• the customer's accounting system, when the customer tells us to. For example, approved bills go to Xero or QuickBooks. Approved changes to a supplier's bank details or email, and new supplier contacts a user creates, go there too;
• suppliers, when a user of the business chooses to email them. These emails can include the invoice and the reason it was sent back. They can include the bank details printed on the invoice, so the supplier can confirm them. They can also list invoices missing from a statement. When you send a supplier an email through the Service, it includes your email address so the supplier can reply to you;
• outside AI assistants, when a user connects one and the assistant asks for information (see 6.8);
• other users in the same business, according to their role;
• our professional advisers, such as lawyers and accountants, where needed;
• a buyer of our business, if we sell all or part of it, under a duty to protect the information; and
• government and law enforcement bodies, where the law requires or allows it.

7.2 A small number of TrueAgent staff can access all customer accounts to set up, support and secure the Service. They access Customer Data only when they need to for those reasons.

8. Our service providers and overseas disclosure

8.1 This means personal information may be disclosed to recipients in the United States, Germany, and the other countries where Cloudflare, OpenAI and Google operate. Before we send personal information overseas, we put a written contract in place with each provider. The contract requires the provider to use the information only to provide services to us, and to keep it secure. It also requires the provider to tell us about a data breach, and to delete the information when we ask. We remain responsible for how these providers handle the personal information we send them.

8.2 When a customer tells us to, we send information to its accounting system, such as Xero or QuickBooks. Xero Limited is a New Zealand company. Xero says it processes data in Australia, New Zealand and the United States. Intuit, which runs QuickBooks, is a United States company. These companies handle the information under the customer's own agreement with them. We handle data from QuickBooks, Xero, Microsoft 365 and Gmail for our customers, not on behalf of Intuit, Xero, Microsoft or Google.

8.3 We will update this list before we add a provider that handles Customer Data. We will also update it before a provider starts handling Customer Data in a new country. We tell customers as our Terms of Service describe.

8.4 If you connected a Microsoft 365 mailbox, disconnecting it in AP Maestro stops our access from our side. To remove our access fully, your Microsoft admin should also remove the AP Maestro app in the Microsoft Entra admin centre. You can review apps with access to your account at https://myapps.microsoft.com.

8.5 If you connected a Gmail mailbox, disconnecting it in AP Maestro stops our access from our side. To remove our access fully, remove AP Maestro from your Google account at https://myaccount.google.com/permissions. A Google Workspace admin can also remove it for the whole organisation.

8.6 Information we receive from Google

When a customer connects a Gmail mailbox, Google asks the person signing in to let AP Maestro:

• read their email, so we can find invoices and statements. We read each email's sender, recipients, subject, date, text and attachments; and
• if the customer turns on labelling, add and remove AP Maestro's own labels on emails, so the customer can see in Gmail which emails we have handled. We don't send, delete or move email, and we don't mark it as read.

We use this information only to provide the Service's features to that customer: finding and reading invoices and statements, matching them to the right company and supplier, and labelling the emails we handled.

We keep it as sections 3 and 11 describe, and protect it as section 10 describes. The tokens that let us read a Google account are kept in an encrypted store. When an admin removes a Gmail sign-in in AP Maestro, we delete its tokens straight away. For emails with no invoice or statement, we delete the sender, recipients and subject after 90 days. Invoices and statements we found are kept while the customer's account is open. When the customer's agreement with us ends, we delete everything we received from Google with the rest of its Customer Data, as 11.4 describes. To ask us to delete Google data sooner, contact us (see sections 12 and 17).

We share it only to provide those features, as sections 6 and 8 describe. We send the invoices and statements we find to OpenAI to read them, with each email's sender and subject, and its text if the customer turns that on (see 6.1 and 6.2). We don't sell it or use it for advertising. We don't use it to train AI models, and we have not agreed to let OpenAI use it for training (see 6.3). Otherwise we disclose it only if the law requires it, to keep the Service secure, or to investigate misuse. Our staff don't read it unless the customer asks us to for support, we need to for security or to investigate misuse, or the law requires it.

AP Maestro's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. The policy is at https://developers.google.com/terms/api-services-user-data-policy.

9. Cookies, analytics and screen recordings

9.1 The Service uses cookies to keep you signed in and to remember which business you are working in. These are needed for the Service to work. The Service also stores layout preferences in your browser.

9.2 We use PostHog for analytics on the website and in the Service. PostHog records pages visited, clicks, errors and screen recordings of sessions. It uses a cookie and browser storage to recognise your browser. In the Service, PostHog links this to your user account, your email address and your business name. We have set PostHog not to keep your IP address.

9.3 In the Service, screen recordings hide the text on screen. They show layout, clicks and page changes, not invoice details, names or email subjects. On the website, recordings hide what you type into forms.

9.4 We don't use advertising cookies. You can block or delete cookies in your browser settings. If you block the cookies the Service needs, you won't be able to sign in.

10. How we hold and protect it

10.1 We hold personal information electronically, in databases and file storage run by the providers listed in section 8.

10.2 We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, change or disclosure. These include:

• encrypting data in transit, and using hosting providers that encrypt stored data;
• limiting every request in the Service to one business's data;
• keeping files in private storage, with download links that expire after 5 minutes;
• keeping tokens for connected systems in an encrypted store;
• invite-only accounts and strong password rules;
• designing our system logs to avoid names, email addresses and document content. A few logs, such as a failed email delivery, can include an email address; and
• limiting which TrueAgent staff can access customer accounts.

10.3 No system is completely secure. If you think your account has been accessed without permission, contact us straight away.

11. How long we keep it

11.1 While a customer's account is open, we keep its invoices, documents, approvals and their history, so the customer has a full record. Moving an invoice to the bin hides it. It does not delete it.

11.2 Some information is kept for less time:

• For emails in a connected inbox that don't contain an invoice or statement, we delete the sender, recipients and subject after 90 days.
• We delete our copy of a whole email sent to an intake address 90 days after we process it.
• We delete export files 30 days after we make them.
• We delete screen recordings after 30 days.

11.3 When someone is removed from a business, they lose access straight away. We keep their name and email linked to the actions they took, because the business needs a record of who approved or changed what. When a person no longer belongs to any business, we delete their sign-in details within 30 days.

11.4 When a customer's agreement with us ends, we send the customer an export. The customer can download it for 30 days, and can ask for copies of its invoice documents in that time. When the customer cancels, we tell it the last download day and the deletion date. We remind its admins 14 days and 3 days before the last download day. We then delete the customer's Customer Data within a further 30 days. This includes our copies of its emails and of its accounting system data. We delete copies in backups as the backups expire, within 35 days.

11.5 Website bookings are kept in our email for 2 years after our last contact, unless you become a customer.

11.6 Billing and business records are kept for as long as tax and corporate law require, usually 7 years.

11.7 Analytics events are kept for up to 7 years under our analytics provider's rules. If you ask, we can delete your analytics data sooner.

11.8 We delete personal information, or remove the details that identify people, when we no longer need it for any purpose the law allows. This includes copies in backups, which we delete as the backups expire.

12. Your rights

12.1 You can ask for the personal information we hold about you, or ask us to correct it. Email support@apmaestro.com. You don't need to use a form. We will reply within 30 days. We don't charge for a request or for making a correction.

12.2 If your request is about Customer Data, we will still deal with it. We may tell the business it belongs to and ask for its view first. We won't refuse your request just because a business put the information in the Service.

12.3 We will check who you are before we act. This matters most for bank details, because people sometimes pretend to be a supplier to change them.

12.4 If we refuse a request, we will tell you why in writing and how to complain.

12.5 If we don't agree to correct your information, you can ask us to attach a note saying you think it is wrong. We will. If we correct information we gave to another organisation, you can ask us to tell them, and we will unless that is impracticable or unlawful. An invoice may be correct as a record of what was printed on it, even if the details have since changed.

12.6 You can use a pseudonym or stay anonymous when you ask us a general question. We need your name to set up an account.

13. Marketing

13.1 We send AP Maestro news and offers by email only to people who have agreed to receive them. Every marketing email says it is from us and has an unsubscribe link. You can also email support@apmaestro.com to opt out. We stop within 5 business days.

13.2 We don't send marketing to suppliers or anyone else whose details appear in Customer Data.

13.3 You can ask us where we got your details, and we will tell you.

14. Data breaches

14.1 If we suspect a data breach, we will assess it quickly, and within 30 days. If a breach is likely to result in serious harm, we will notify the people at risk and the Office of the Australian Information Commissioner. We don't need to if we act in time to prevent that harm. If the breach involves Customer Data, we will tell the customer without undue delay and work with them on the notices. A breach at one of our service providers is handled in the same way.

15. Complaints

15.1 If you have a complaint about how we have handled your personal information, email support@apmaestro.com. We will acknowledge it within 5 business days. We will look into it, and tell you in writing what we found and what we will do. We aim to resolve it within 30 days.

15.2 If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992 for information about your options.

16. Changes to this policy

16.1 We may update this policy. We will post the new version here with a new date. If a change makes how we handle Customer Data worse for our customers, we will tell them at least 30 days before it takes effect.

17. Contact us

Privacy Officer, TrueAgent Pty Ltd
Level 1, 255 Whitehorse Road, Balwyn VIC 3103
Email: support@apmaestro.com