Privacy Policy

VaultYou is an Australian-owned business software platform that helps small businesses manage quotes, invoices, expenses, compliance dates and business planning. In this policy, "we", "us" and "our" refer to the operator of VaultYou (vaultyou.com.au).

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs). This policy explains what we collect, why we collect it, how we hold it and how you can access or correct it.

We only collect information we genuinely need to provide the service:

• Account information — your name, email address and authentication identifiers. If you sign in with Google, we receive your email address, name and profile image from Google; we never receive your Google password.
• Business information — business name, trading name, ABN, GST registration status, business address, contact details and logo.
• Operational records you create — customers, quotes, invoices, expenses, receipts, tasks and notes.
• Support and feedback — messages, bug reports and any screenshots you choose to attach.
• Technical information — browser type, device type, operating system, approximate location derived from IP address, and pages viewed. See our Cookie Policy.

We do not collect sensitive information (as defined in the Privacy Act) such as health information, and we ask that you do not upload it.

We use personal information to:

• create and secure your account and your business workspace;
• provide the features you use — quoting, invoicing, expenses, reporting and reminders;
• generate AI guidance grounded in the business data in your own workspace;
• respond to support requests and act on beta feedback;
• monitor reliability, detect abuse and protect the service; and
• send you service-related messages such as password resets and important notices.

We do not sell your personal information, and we do not use your business data to serve you advertising.

When you use the AI Coach or an AI-assisted feature, the relevant parts of your business data (for example invoice totals, overdue amounts or an expense description) are sent to a third-party AI model provider so a response can be generated and returned to you.

Only the context needed for your request is sent. AI output is general guidance produced by a language model — it can be incomplete or wrong, and it is not accounting, tax, legal or financial advice. See our AI Disclaimer.

We share personal information only with service providers who help us operate VaultYou, and only to the extent needed to deliver the service:

• Cloud hosting and database providers — application hosting, database and file storage.
• AI model providers — to generate responses to your AI requests.
• Analytics — aggregated usage measurement (Google Analytics 4).
• Email delivery — transactional messages such as password resets.

Some of these providers may store or process data outside Australia. Where that happens we take reasonable steps, as required by APP 8, to ensure the overseas recipient handles the information consistently with the Australian Privacy Principles.

We may also disclose information where required by law, or to protect the rights, safety or property of VaultYou or its users.

All traffic to VaultYou is encrypted in transit using TLS. Each business workspace is isolated at the database level with row-level security, so records belonging to one business cannot be read by another. Uploaded files such as logos and receipts are held in private storage that requires an authenticated, authorised request.

No online service can guarantee absolute security. If a data breach occurs that is likely to result in serious harm, we will assess and notify affected individuals and the Office of the Australian Information Commissioner in line with the Notifiable Data Breaches scheme. Read more on our Security page.

We keep your information while your account is active. If you ask us to delete your account, we delete or de-identify your personal information unless we are required to keep it — for example, records we must retain to meet a legal obligation.

You remain responsible for retaining your own business and tax records for the periods required by the ATO. Export or download anything you need before requesting deletion.

Under APP 12 and APP 13 you can request access to the personal information we hold about you, and ask us to correct anything inaccurate or out of date. Most information can be viewed and edited directly in the app under Settings.

For anything else, email privacy@vaultyou.com.au. We will respond within a reasonable period, normally within 30 days.

If you believe we have breached the Australian Privacy Principles, contact us first at privacy@vaultyou.com.au with the details. We will acknowledge your complaint and aim to resolve it promptly.

If you are not satisfied with our response, you can refer the matter to the Office of the Australian Information Commissioner at oaic.gov.au.

We may update this policy as the product develops. Material changes will be notified in the app or by email before they take effect, and the "last updated" date at the top of this page will always reflect the current version.