Privacy & Data Security Policy

This Privacy & Data Security Policy explains what information STAXAI collects from you, how it is used, where it is stored, who can see it, which other services receive it, and what your rights are. It is written in plain language so that you can understand exactly what happens to your data.

STAXAI is operated by A.C.N. 697 439 080 PTY LTD t/as STAXAI (ABN 21 697 439 080), an Australian business. This policy is made under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Account information

When you sign up, STAXAI collects your email address and a password. You must verify your email address before you can use your account. Your password is handled by Supabase Auth, which stores only a bcrypt hash of it, never the password itself. If you turn on two-step sign-in, an authenticator app is linked to your login.

Business Profile

To personalise the tools to your business, you complete a Business Profile. This includes your business name, trading name, ABN, industry, locations and service area, services and products, team size, licences and marketing preferences. You can update it at any time.

Content Library

You can add content to the Content Library by uploading documents and photos, scanning your website, importing files from Google Drive, OneDrive, SharePoint or Dropbox, and scanning your Gmail or Outlook email. STAXAI stores the original files and the full text extracted from them, together with summaries and categories produced by AI. Photos are described by AI, and financial documents have their figures extracted into a structured form.

Email

If you connect a Gmail or Outlook mailbox, STAXAI is given read-only access to it. STAXAI does not request permission to send, delete or change your email.

• Email Assistant. Each scan reads the emails received within your chosen look-back period (30 days unless you change it). For Gmail this is every message in that period; for Outlook it is your Inbox. STAXAI reads the sender, subject, date and full body of each email. Attachments are not downloaded. The full body is saved as a text file in your account, and a summary row (sender, subject, date, AI summary and category, and a link to the email) is stored for display.
• Content Library email scan. Each scan reads the full body of every email in the look-back period that has not already been scanned, and downloads its attachments (images, PDF, Word, Excel, PowerPoint and text files up to 20 MB). STAXAI stores the email body, the attachment files and the full text extracted from them, together with an AI summary and category. Emails the AI classes as irrelevant (for example spam) are still stored, marked as rejected.

Connected business systems

If you connect an accounting or job management system, STAXAI reads data from it and stores it in your account. Most transaction history is limited to the last 24 months; unpaid invoices and bills are kept however old they are.

• Xero, QuickBooks and MYOB: invoices, bills, quotes, payments, customers and suppliers (names and contact details), items, chart of accounts, profit and loss and balance sheet reports, bank and money transactions recorded in the accounting system, and projects or jobs
• ServiceM8: jobs, clients, staff, job materials, job activity and form responses
• Fergus: jobs, customers (including contacts and addresses), invoices and quotes
• Buildxact: estimates

Bank data

If you connect your bank through the Consumer Data Right, STAXAI receives your bank accounts, balances and transactions. This is explained in full in Section 5.

Social media accounts

If you connect Facebook, Instagram or LinkedIn, STAXAI stores the connection so it can publish the posts you schedule, and reads post and page performance figures (such as views and engagement). When you connect LinkedIn, STAXAI reads your LinkedIn name, email address and profile picture. If you choose Facebook ad accounts, STAXAI also reads their monthly ad spend.

Subscription and billing

Payment is processed entirely by Stripe on Stripe's own checkout and billing pages. STAXAI never sees or stores your card number. STAXAI stores your Stripe customer ID, your subscriptions and their payment status, your activated tools and your trial status.

Usage data

STAXAI records how you use its AI features: which tool made each request, the amount of AI processing used and its estimated cost, and monthly usage counts that enforce generation limits. These records are linked to your account while it exists and are deleted when your account is deleted.

Team member data

If you invite team members, STAXAI stores each member's email address, display name, security level, invitation status and the dates they were invited and joined.

STAXAI does not send you marketing email. The email STAXAI sends relates to your account and the tools you use.

Database and file storage

STAXAI uses Supabase for its database, sign-in and file storage. Supabase runs on Amazon Web Services infrastructure. Stored files (uploads, email text, attachments and generated documents) are kept in a private storage area; they are opened through short-lived signed links rather than public addresses. Supabase notes that backups, logs and its own sub-processors may fall outside the project's region.

Platform hosting

The STAXAI web application and its server functions are hosted on Vercel, and the server functions run in Vercel's Sydney region (syd1). Vercel does not publish a region for its logs.

Data sent to other services

Your data does not stay only in Australia. To operate the tools you use, parts of it are sent to other services, several of them overseas — most importantly to Anthropic for AI processing (Section 4). Every service that receives your data, what it receives and where it is located, is listed in Section 8.

STAXAI is powered by Anthropic's Claude AI. When you use an AI feature, the relevant content from your account is sent to Anthropic's API for processing, and the result is stored in your account.

What Anthropic does with your data

Under Anthropic's Commercial Terms of Service, which govern STAXAI's use of the API, Anthropic may not train its models on content sent through the API. Anthropic automatically deletes API inputs and outputs within 30 days. Anthropic keeps content for up to 2 years if its automated systems flag it for a breach of Anthropic's Usage Policy, and may keep content longer where the law requires it.

What content is sent to Anthropic

• Business Profile — included with almost every AI request so the output fits your business
• Content Library — uploaded documents (PDFs are sent whole; the text of Word, Excel and PowerPoint files is sent), photos and images, website page text, imported cloud files, and financial documents for figure extraction
• Email (Content Library scan) — sender, subject and the full email body (long emails are sent in sections, up to about 72,000 characters), plus attachments and the text extracted from them
• Email (Email Assistant) — sender name and address, subject, and the first 2,000 characters of each email body
• Accounting and job data — for Business Insights, Cash Flow & Capex, Strategic Plan and Compliance Calendar: chart of accounts, profit and loss and balance sheet figures, invoices and bills (including customer and supplier names, invoice numbers, amounts and due dates), customer and supplier totals, payments and cash movements with their descriptions, job and project figures, and payment patterns
• Bank data — bank transaction dates, descriptions, amounts and direction, and bank balances (see Section 5)
• Industry Edge and Grants & Tenders — your industry, services, products, locations and service area, together with public news, grant and tender listings
• Strategic Plan — your planning answers, Business Insights findings, Content Library items and financial summaries
• Socials & Marketing — post briefs and campaign inputs (including any customer names or testimonials you enter), your photos, and past post captions with their performance figures
• Website Chatbot — the full conversation with each website visitor, including any contact details the visitor types (see Section 9)
• Design Visualiser — your design answers and descriptions (photos for Design Visualiser are sent to Google, not Anthropic)

What is never sent to Anthropic

• Your password or sign-in credentials
• Your card or payment details
• The access tokens for your connected services

The Cash Flow & Capex tool can connect to your bank under the Consumer Data Right (CDR), Australia's regulated system for sharing bank data. STAXAI receives your bank data through Wych, an accredited data recipient.

How STAXAI receives your bank data

STAXAI receives your bank data under the Business Consumer Disclosure Consent model. STAXAI is not a CDR representative of Wych. Wych, as the accredited data recipient, collects your bank data with your consent and discloses it to STAXAI as the recipient you nominate. Once your bank data is disclosed to STAXAI, it leaves the CDR system, and STAXAI handles it under this policy.

Wych's accreditation

Wych is listed on the Consumer Data Right Register as Activate Wych Pty Ltd, accreditation number ADRBNK2005, with an active, unrestricted accreditation. Its brands on the Register are Wych Data and Wych Australia Pty Ltd (ABN 92 644 746 047). You can check this on the register at cdr.gov.au.

What STAXAI receives and stores

• Accounts: account name, BSB, the last 4 digits of the account number (the full account number is never stored), account type, and connection and consent dates
• Balances: the current balance of each account and when it was last updated
• Transactions: for posted Australian-dollar transactions — date, amount (credit or debit), the bank's description or reference, the bank's transaction identifier, and for transfers the other account's BSB and last 4 digits

On first connection STAXAI retrieves up to 24 months of transaction history. The consent you give includes basic and detailed customer information, but STAXAI does not retrieve or store it. The only personal information STAXAI sends to Wych is your account email address, which Wych uses to set up your connection. STAXAI never sees your bank login.

What bank data is used for

Bank data is used by Cash Flow & Capex: to show your consolidated bank balance, to match bank transactions to your invoices, bills and forecast items, to detect transfers between your own accounts, to learn your payment patterns, to check each week's balance when you finalise it, and to build your cash flow forecast. Your total bank balance also appears in Business Insights. STAXAI also uses the transaction descriptions to remember how you have allocated similar transactions before.

Where bank data goes

• Supabase (AWS Sydney) — where your bank data is stored
• Anthropic (United States) — Anthropic's handling of this data is set out in Section 4. STAXAI sends Anthropic:
  • when you set up or re-project your cash flow: your unmatched transactions from the last 12 months (date, description, amount and whether it is a credit or debit)
  • when you sync: for each transaction that cannot be matched automatically, its date, its description (up to 140 characters) and its amount in whole dollars, with the names of the customers or suppliers it might belong to and, for each of them, the due date of their earliest unpaid invoice or bill and how many days after the due date they usually pay
  • for the cash flow analysis, insight tiles and capex planning: your opening bank balance, and forecast amounts that include transactions recorded from your bank (for the analysis, with the first 80 characters of each such transaction's description and the patterns learned from your transactions, each as its type, a name and its figures; for capex planning, with your forecast's lowest balance and the weeks until it first falls below your minimum balance)
  • for Business Insights: your total bank balance and the date it was last updated
  Your BSBs, account numbers (including the last 4 digits), account names and the bank's transaction identifiers are never sent to Anthropic.

Bank data is not sent to any other service.

Your consent

When you connect, you are taken to Wych's secure consent screens, where you choose your bank and give your consent; you then authorise the sharing with your bank directly. Your consent lasts for up to 365 days. STAXAI shows you the expiry date, and warns you in the platform and by notification 30 days before it expires. You can renew your consent at any time; the replaced consent is then withdrawn.

Withdrawing your consent

You can withdraw your consent at any time in either of these ways:

• Select Disconnect in the Cash Flow & Capex settings. STAXAI asks Wych to withdraw your consent and stops receiving your bank data.
• Stop sharing through your bank's own data sharing dashboard, in your internet banking or banking app. STAXAI detects this the next time your cash flow is synced, and stops receiving your bank data.

What happens to your bank data when you disconnect

When you disconnect, STAXAI stops receiving new bank data. The bank data STAXAI has already received — your accounts, balances and transactions, and the cash flow information built from them — is kept in your account so that your cash flow history stays complete. It is deleted when your account is deleted (see Section 10).

When your account is deleted

When your STAXAI account is deleted, STAXAI first withdraws every bank consent the account holds, in the same way as Disconnect, and then deletes the bank data it holds.

Encryption at rest

Supabase encrypts all stored data at rest using AES-256 encryption. On top of that, STAXAI itself encrypts the access tokens for your connected services and the identifiers that link your account to your bank connection (AES-256-GCM) before they are stored, using a key that is held separately from the database.

Encryption in transit

All data sent between your browser and STAXAI, and between STAXAI's servers and Supabase, is encrypted using TLS (HTTPS). Unencrypted HTTP requests to STAXAI are redirected to HTTPS.

Access control

Data your browser reads directly from the database is protected by Row Level Security (RLS), a database-level control that limits each query to your own account's data. STAXAI's server functions use a privileged database key and check, in code, that every request belongs to your account before reading or writing data.

Sign-in security

Sign-in is managed by Supabase Auth. Passwords are stored only as bcrypt hashes, and email verification is required. You can add two-step sign-in with an authenticator app from your Account page.

Connected service tokens

When you connect a service such as Gmail, Outlook, Google Drive, Xero or Facebook, the access tokens it issues are encrypted by STAXAI (AES-256-GCM) before they are stored, using a key held separately from the database, so a copy of the database alone does not reveal them. They are kept in a database table that only STAXAI's server functions can read, and are never sent to your browser. When you disconnect a service, the stored tokens are deleted immediately. For Google, Meta (Facebook and Instagram), Xero, QuickBooks, Buildxact, Dropbox and Fergus, STAXAI also cancels its access with the provider. For other services, including Microsoft (Outlook, OneDrive and SharePoint) and ServiceM8, you can remove STAXAI's access in that service's own settings. Data already imported from a service stays in your account after you disconnect it.

The access tokens STAXAI uses with Wych for bank data are held only in memory and are never stored.

API key protection

The keys STAXAI uses for Anthropic, Stripe, Google, Microsoft and its other services are held as server-side environment variables on Vercel and are never exposed to your browser. All AI requests are made from STAXAI's server functions.

You and your team members

Your account data is accessible to you and to any team members you invite, according to the security level you assign them: Level 1 (Account Owner), Level 2 (Manager) or Level 3 (Staff).

STAXAI administrators

As the operator of STAXAI, A.C.N. 697 439 080 PTY LTD t/as STAXAI has administrative access to the database and can view data stored in any account. This access exists for legitimate purposes — diagnosing technical issues, investigating support requests and making sure the platform operates correctly.

STAXAI will not access your account data without a legitimate reason, will not share your data with any third party except as described in this policy, and will not use your business content for any purpose other than operating the platform for you. If STAXAI accesses your account to investigate a support issue, you will be told if you ask.

Third parties

STAXAI does not sell your data and does not share it with advertisers. Your data is shared only with the sub-processors listed in Section 8, and only as needed to operate the tools you use.

Legal requirements

STAXAI may be required to disclose your data if compelled by Australian law, a court order, or a regulator with lawful authority to require it. You will be notified of any such request where the law allows it.

These are the services that receive your data as part of operating STAXAI. Locations are as each provider states in its own published documentation. Services you connect (such as your email, cloud storage, accounting system or social media accounts) receive only STAXAI's requests for your data, or the posts you publish; your data in those services is held under your own agreement with that provider.

Core platform

Bank data

AI image and content generation

Services you connect

Under Australian Privacy Principle 8, STAXAI discloses that many of these sub-processors are located overseas or process data overseas. By using STAXAI and connecting these services, you consent to these disclosures as necessary to operate the platform.

If you use the Website Chatbot on your own website, your website visitors' conversations are stored in your STAXAI account, including the full conversation, any name, email address and phone number the visitor provides, appointment requests with preferred times, and questions the chatbot could not answer. Visitors using the Design Visualiser through your chatbot may upload photos, which are stored in your account. STAXAI does not store visitors' IP addresses.

To answer visitors and summarise leads, each conversation is sent to Anthropic, visitor messages and unanswered questions are sent to Voyage AI, and visitor photos are sent to Google (Gemini). When a visitor leaves their details or asks for an appointment, STAXAI emails those details to you through SMTP2GO.

STAXAI does not use your visitors' details for any purpose other than operating your chatbot and showing them to you. STAXAI does not contact your visitors or add them to any mailing list. Conversations stay in your account until you delete them or your account is deleted.

While your account is active

Your data is kept while your account is active, with these exceptions:

• Email Assistant summaries are deleted automatically once the email is more than 90 days old. Whenever a summary is deleted — after 90 days, by you, or because the email was removed from your inbox — the email text saved for it is deleted with it.
• Bank data is kept after you disconnect your bank, until your account is deleted (Section 5).
• Anthropic deletes the content STAXAI sends it within 30 days (Section 4).

When your subscription ends

When your last subscription ends, or your free trial ends without a subscription, your account enters a 30-day closure period and you are sent an email. During this period your data is kept, but your tools are locked; you can resubscribe to restore full access, or delete your account straight away. If you sign up but never start a trial or subscription, the same 30-day closure period applies.

When your account is deleted

At the end of the closure period, or immediately if you select Delete Account on your Account page, your account is permanently deleted. This:

• withdraws every bank consent the account holds, in the same way as Disconnect (Section 5)
• deletes every database record belonging to your account, including your Business Profile, Content Library, email summaries, accounting and job data, bank data, chatbot conversations, tool outputs, usage records and notifications
• deletes all files stored for your account
• deletes your sign-in account
• deletes your Stripe customer record, which cancels any remaining subscriptions
• removes your connections to other services — access is cancelled with the provider for Google, Meta (Facebook and Instagram), Xero, QuickBooks, Buildxact, Dropbox and Fergus; for other services you can remove STAXAI's access in that service's own settings

If a team member deletes their own login, only their own data is deleted, not the account's.

What remains after deletion

• Internal scheduling records that contain your account identifier are deleted after 40 days.
• Operational logs kept by STAXAI's hosting provider may contain your account identifier and email address.
• Stripe keeps billing and transaction records under its own privacy policy.

Deleting your Facebook and Instagram data

You can have STAXAI delete the data it received from Facebook and Instagram in two ways: remove STAXAI in Facebook under Settings & Privacy > Settings > Apps and Websites and choose to send a deletion request, or delete your STAXAI account. A Facebook deletion request removes your Facebook and Instagram connection, its access tokens, the Facebook and Instagram links and results on your posts, your ad spend figures, and the Business Insights text built from them. The posts you wrote in STAXAI are kept, without their Facebook and Instagram links, and your Strategic Plan is kept as it is. Facebook gives you a link where you can check the status of your request.

Under the Australian Privacy Principles, you have the following rights in relation to your personal information:

STAXAI will respond to all privacy requests within 30 days.

STAXAI does not set cookies. To keep you signed in and remember your settings, STAXAI uses your browser's local storage and session storage. STAXAI does not use advertising cookies, tracking pixels or third-party analytics services, and does not display advertisements.

Some pages load resources from other services, which receive your browser's standard request information (such as your IP address) and may set their own cookies: Google Fonts, the jsDelivr content network (for page scripts and icons), Google Maps (for address search) and Loom (for embedded videos).

This Privacy & Data Security Policy may be updated as the platform changes. The effective date at the top of this page always shows the date of the current version.