Privacy Policy
We collect the information we need to keep your books and lodge your BAS, and nothing more. We use it only to provide our services and meet our legal obligations, we share it only with the ATO, the providers that run our systems and people you ask us to share it with, and we never sell it. We follow the Australian Privacy Principles in the Privacy Act 1988.
Draft for review. Have a lawyer check this policy before publishing. Square-bracketed items need confirming.
1. Who we are
This policy covers Growit Group Pty Ltd (ACN 646 718 078, ABN 15 646 718 078), trading as Redhorse Accounting, a registered BAS agent based in Brisbane. It applies to our website, client portal, receipts email addresses and chat assistant.
For any privacy question or request, email hello@redhorseaccounting.com.au with "Privacy" in the subject line.
2. What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Contact and account details | Your name, email, mobile, business name, ABN, login | You, at sign-up |
| Financial records | Receipts, supplier bills, invoices, bank transactions, reports, BAS figures | You (photo, upload, email) and your Xero file |
| Payroll details | Employee names, hours worked, pay periods | Timesheets you submit and your Xero file |
| ATO records | Activity statement accounts, lodgement history, amounts owing | The ATO, through our agent access |
| Tax return preference | Whether you want a partner tax agent, what matters to you, your own accountant's name and email | You, at sign-up |
| Communications | Emails, portal queries and answers, chat messages | You |
| Payment details | Billing name and payment method, held by our payment provider | You, at sign-up |
| Technical data | IP address, browser, pages visited, login times | Your device, when you use our website or portal |
We don't ask for your tax file number. If you give us information about other people, such as employees, please make sure they know you've shared it with us.
3. How we use it
We use your information to:
- keep your books in Xero, prepare your BAS and lodge it with the ATO
- run the portal: read receipts, show your results, enter bills and timesheets, and flag unusual items
- write your monthly CFO-style review
- match you with a partner tax agent, or prepare your books for your own accountant, if you ask
- bill you and keep the records the law requires
- answer your questions and handle complaints
- keep our systems secure and improve the portal, using anonymised data where we can
We don't sell your information or use it for third-party advertising. We may email you about changes to our services; you can opt out of anything that isn't essential to your account.
4. AI and automated processing
The portal uses AI (Claude, provided by Anthropic) and automated rules to:
- read receipts and invoices and suggest supplier, date, amounts, GST and account coding
- flag possible duplicates, GST errors, unusual coding and high hours for review
- draft your monthly CFO-style commentary
- answer general questions about our services in the website chat
These are suggestions, not final decisions. You check each receipt's coding, and a qualified person reviews your figures before any BAS is lodged. No decision that significantly affects you is made by automation alone.
Our AI provider processes your information only to provide the service to us. [It doesn't use it to train its models. Confirm against the provider's current commercial terms before publishing.]
5. Who we share it with
| Who | Why | Where |
|---|---|---|
| Australian Taxation Office | To lodge your BAS and manage your activity statement account | Australia |
| Xero | Your books live there; the portal connects to it with your permission | [Confirm with Xero: Australia and/or overseas] |
| Cloudflare | Hosts our website, receives emailed receipts, protects against attacks | Global network, including the United States |
| [Hosting provider] | Runs the portal and stores your records | Australia (Sydney) |
| Anthropic | AI that reads receipts, drafts commentary and powers the chat | United States |
| [Payment provider] | Collects your monthly fee | [Location] |
| A partner tax agent | Prepares your tax return, only after you confirm the match | Australia |
| Your own accountant | Your year-end books, only when you ask | Australia |
| Regulators and professional bodies | Only where the law or our professional obligations require it | Australia |
Our providers may only use your information to provide services to us. Where information goes overseas, we take reasonable steps to make sure it's protected to a standard comparable to the Australian Privacy Principles.
6. Security and how long we keep it
We protect your information with encrypted connections, hashed passwords, access limited to the people who need it, signed links between our systems, and regular backups. The portal can't move money or change your bank details in Xero.
We keep your records for five years after the period they relate to, in line with record-keeping laws, then securely delete them. When you leave, you can download your records for 30 days. Chat messages from website visitors who don't become clients are deleted after [90] days.
If a data breach is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner as the law requires.
7. Website, cookies and the chat assistant
Cookies. The portal uses a cookie to keep you signed in. Our website uses only cookies needed for it to work [and privacy-friendly visit statistics that don't identify you]. We don't use advertising cookies.
Chat assistant. The website chat is answered by AI, not a person. It gives general information about our services, not advice about your situation. Please don't enter tax file numbers, bank details or other sensitive information in the chat. If you share your name and email in a chat, we may contact you to follow up.
8. Your rights and complaints
You can ask to see the personal information we hold about you, or ask us to correct it. Email us and we'll respond within 30 days. There's no charge for asking.
If you have a privacy complaint, email us first and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
9. Changes to this policy
We'll update this policy when our services or the law change. The date at the top shows the current version. If we make a significant change, we'll tell clients by email and in the portal before it takes effect.