Privacy Policy

1.1 This Privacy Policy explains how Finnex AI Pty Ltd (ABN 37 673 499 655) (Finnex, we, us) collects, holds, uses and discloses personal information in connection with the Finnex workpaper application, the Finnex Excel add-in, the Finnex MCP tools, our websites and related services (the Service).

1.2 Finnex is bound by the Privacy Act 1988 (Cth) (the Privacy Act), including the Australian Privacy Principles, and, in respect of tax file numbers, the Privacy (Tax File Number) Rule 2015.

1.3 Words defined in our Terms of Service, such as Customer, Client, User, Practice Account and Customer Content, have the same meaning in this policy.

1.4 The Service is used by accounting practices to prepare work for their clients, so Finnex holds two kinds of personal information:

• information about Users and the people who contact us, which Finnex collects for its own purposes; and
• information about the Customer’s clients and their contacts, contained in Customer Content, which Finnex holds on the Customer’s behalf to provide the Service (see section 13).

2.1 Identity and account information. When a User signs in with a Microsoft Entra ID work or school account, Finnex receives the User’s name, email address and the identifiers Microsoft holds for the User and their organisation, together with information about how the sign-in was authenticated, which Finnex uses to verify that multi-factor authentication was used. Administrators may add a practice name, logo, offices, letterhead, and Users’ roles and permissions.

2.2 Billing information. When the Customer purchases a Monthly Plan, storage pack or AI credit top-up, Finnex collects the billing name, billing address and transaction history. Payment card details are entered directly with, and held by, Stripe. Finnex holds only the card brand, last four digits and expiry date.

2.3 Customer Content. General ledgers, trial balances, journals, invoices and bills, bank statements, ageing reports, tax schedules, documents and files, account mappings, review notes, queries and responses, and the workpapers and financial statements built from them. Customer Content commonly includes personal information about the Customer’s clients and their directors, employees, customers and suppliers.

2.4 Tax file numbers and ATO data. Where the Customer uses the Service to lodge with the Australian Taxation Office, Finnex collects the Client’s tax file number and the data exchanged with the ATO, as described in section 6.

2.5 Communications. Messages sent to Finnex, and records of support provided, including support sessions under section 9.4.

2.6 Usage, device and security information. IP address, browser and operating system, the features used and when, session activity used to enforce the idle lock, records of AI usage (the feature, the Client or workpaper it was for, and the tokens and credits used), and error and diagnostic information.

3.1 Finnex collects personal information:

• from Users, when they use the Service or contact us;
• from Microsoft, when a User signs in;
• from Third-Party Platforms the Customer connects, such as Xero, QuickBooks Online and Microsoft 365, at the Customer’s direction;
• from the Australian Taxation Office, in response to a request the Customer makes through the Service;
• from Stripe, in connection with payments; and
• automatically, as the Service is used.

3.2 Where Finnex collects information about an individual from someone else, such as a Client’s details provided by the Customer, the Customer is responsible for giving that individual any notice the law requires.

4.1 Finnex uses personal information to:

• provide the Service, including importing and synchronising accounting data, mapping accounts, performing review procedures, drafting journals and schedules, compiling statements, and lodging with the ATO where the Customer instructs;
• provide the AI features described in section 5;
• operate Practice Accounts, including sign-in, multi-factor authentication, sessions, roles and invitations;
• take payment, issue invoices and administer Monthly Plans;
• provide support and notify Users about their account, security and changes to the Service;
• secure the Service, detect and prevent fraud and misuse, and enforce our Terms of Service;
• measure and improve the Service, using aggregated or de-identified information wherever practicable; and
• comply with the law.

4.2 Finnex sends product announcements only to Users, in accordance with the Spam Act 2003 (Cth), and each announcement includes a way to unsubscribe. Finnex does not sell personal information and does not use Customer Content for advertising.

5.1 The Service uses large language models to map accounts, review transactions, read documents, draft notes, queries, journals and reconciliations, and answer questions about a workpaper. To do so, the parts of Customer Content a feature needs, such as account names, transaction lines, document text and the User’s instructions, are sent to Finnex’s AI model provider and the result is returned to the Service.

5.2 Finnex’s AI model provider is Alibaba Cloud (Model Studio), which processes requests in its Singapore region. Finnex engages it on terms that permit it to process the data only to provide its service to Finnex.

5.3 Finnex does not use Customer Content to train artificial intelligence models. Finnex does not send tax file numbers, data received from the ATO, payment card details or sign-in credentials to any AI model provider.

5.4 Where a User connects their own AI assistant to the Service through the Finnex MCP tools, that assistant’s handling of data is governed by its provider’s terms and privacy policy, and the User controls what it may access.

6.1 Finnex collects a Client’s tax file number only where the Customer provides it to prepare or lodge a return or statement with the ATO, and uses and discloses it only for that purpose, as permitted by taxation law and the Privacy (Tax File Number) Rule 2015.

6.2 Tax file numbers are encrypted before they are stored, are never shown again in the Service once saved, and are disclosed only to the ATO. Data received from the ATO is stored separately from other Customer Content and is used only for the purpose for which it was obtained.

6.3 Finnex destroys or de-identifies a tax file number when it is no longer required for a lawful purpose, including when the Client or the Practice Account is deleted.

7.1 Finnex discloses personal information only as needed to provide the Service, or as otherwise set out in this policy, to:

• service providers engaged under contract, which may use it only to provide their services to Finnex: Microsoft (cloud hosting, storage, identity and email delivery), Stripe (payments) and Alibaba Cloud (AI processing);
• Third-Party Platforms the Customer connects, when the Service reads from or writes to them at the Customer’s direction;
• the Australian Taxation Office, when the Customer lodges through the Service;
• the Customer and its Users, according to the roles and permissions the Customer sets;
• professional advisers, regulators, courts and law enforcement, where required or authorised by law; and
• a successor to all or part of Finnex’s business, in which case Finnex will notify Customers before their information becomes subject to a different privacy policy.

8.1 Some service providers process personal information outside Australia. The countries in which they are likely to do so are:

• Singapore: Alibaba Cloud, for AI processing;
• the United States: Stripe, for payments; and
• the countries in which Microsoft, Xero and Intuit (QuickBooks Online) operate their services, as described in their privacy policies.

8.2 Before disclosing personal information overseas, Finnex takes reasonable steps, including contractual protections, to ensure that the recipient does not breach the Australian Privacy Principles in relation to it.

9.1 The Service, including its databases, is hosted on Microsoft Azure in its Australia East (Sydney) region. Each Practice Account’s accounting data is held in its own logically separate database, with its credentials stored encrypted. Logs and monitoring data are kept on Finnex’s own monitoring systems within that hosting, and are not sent to an external monitoring service.

9.2 Files are stored in Finnex’s Microsoft Azure storage, or, where the Customer has enabled Microsoft 365 storage, in a SharePoint Embedded container in the Customer’s own Microsoft 365 tenant, where they are also subject to Microsoft’s terms and the Customer’s Microsoft 365 settings.

9.3 Finnex takes reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification and disclosure, including: encryption in transit and at rest; sign-in through Microsoft Entra ID, so Finnex never holds User passwords; mandatory multi-factor authentication for every User; sessions that end after 24 hours and lock after 15 minutes of inactivity; role-based permissions within each Practice Account; access to production systems restricted to authorised personnel; and logging and monitoring.

9.4 Support sessions. To provide support, investigate a problem or meet a legal obligation, authorised Finnex personnel may open a support session in a Practice Account, acting as a named User. A support session lasts no more than 60 minutes, is either read-only or read-write as selected when it starts, and cannot be used for billing, inviting or removing Users, connecting Third-Party Platforms, sending emails to a Client’s customers, posting journals to Xero or deleting Clients or workpapers. Every support session, including who opened it, when, why and as whom, is recorded.

9.5 No method of transmission or storage is completely secure, and Finnex cannot guarantee the security of information.

10.1 If Finnex becomes aware of a suspected data breach, it will promptly assess it and take reasonable steps to contain it. Where a breach is likely to result in serious harm, Finnex will notify the affected Customers and individuals and the Office of the Australian Information Commissioner, as required by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, and will cooperate with each affected Customer in meeting its own obligations under that scheme.

11.1 Finnex keeps personal information only as long as needed:

• Customer Content is kept while the Practice Account is active, including the content of Archived Clients until they are deleted. After a Practice Account is closed the Customer has 30 days to export it, after which Finnex deletes it from live systems and, in the ordinary course of its backup cycle, from backups.
• Trial accounts that are not converted to a paid account may be deleted within a reasonable period after the trial ends.
• Tax file numbers are kept only as section 6 describes.
• Account and billing records are kept while the Practice Account is active and then for as long as tax and corporations law require, generally seven years.
• Usage, diagnostic and security records are kept for up to 12 months, or longer where needed to investigate a security incident or required by law.

11.2 Administrators may delete Clients, workpapers and files from within the Service at any time. Deleting a Client removes its data from the Service; data held in a Third-Party Platform is not affected.

12.1 Users may view and update their profile and practice details in the Service. An individual may ask Finnex for access to, or correction of, the personal information Finnex holds about them, or for its deletion subject to Finnex’s legal obligations, by contacting support@finnex.ai.

12.2 Finnex will verify the individual’s identity, respond within 30 days, and not charge for making a request. If Finnex refuses a request, it will give its reasons in writing and explain how to complain, except where it would be unreasonable to do so.

13.1 If you are a client of an accounting practice that uses Finnex, your information reached Finnex because your accountant brought it into the Service to prepare your accounts or lodgments. Your accountant decides what is collected and how it is used, and Finnex holds and processes it on your accountant’s behalf.

13.2 Requests to access, correct or delete that information should be made to your accountant first. Finnex will assist them, and will refer any request it receives directly to the practice concerned where appropriate.

14.1 The Service uses only cookies and browser storage that are necessary for it to work: to keep Users signed in and enforce session limits, to protect against cross-site request forgery, and to remember preferences such as the theme. Finnex does not use advertising or cross-site tracking cookies. Blocking necessary cookies will prevent sign-in.

15.1 Individuals may contact Finnex with a general enquiry without identifying themselves. Because the Service handles financial and tax information and requires verified sign-in, it cannot be used anonymously or under a pseudonym.

15.2 The Service is supplied to businesses and is not directed at children. Finnex does not knowingly collect personal information from anyone under 18 as a User. Customer Content may incidentally include information about minors, for example dependants in a tax schedule, which Finnex handles as part of that content.

16.1 A complaint about how Finnex has handled personal information should be made in writing to support@finnex.ai, marked for the attention of the Privacy Officer. Finnex will acknowledge it promptly, investigate, and respond in writing within 30 days.

16.2 If the complainant is not satisfied with Finnex’s response, they may complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

17.1 Finnex may update this policy as the Service and the law change, and will publish the updated policy here with its effective date. If a change materially affects how Finnex handles personal information, Finnex will notify Administrators by email or in the Service before it takes effect.

Privacy questions, requests and complaints may be sent to:

• Privacy Officer, Finnex AI Pty Ltd, ABN 37 673 499 655
• Email: support@finnex.ai