Privacy Policy
Last updated: 9 October 2026.
Taxy Pty Ltd (ABN 33 666 815 890) (“Taxy”, “we”, “us”, “our”) provides cloud-based tax workflow platforms at app.taxy.au and iris.taxy.au. This policy explains how we handle personal information, in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
1. Who we are, and the two ways we handle data
Taxy is used by Australian accounting practices (“Firms”) to collect information and documents from their clients and manage tax workflows. We handle personal information in two distinct roles:
- As the entity responsible (controller) — for information about Firm staff who hold Taxy accounts (name, email, login and usage data), people who contact us, and visitors to our website.
- On a Firm’s behalf (service provider / processor) — for the client information a Firm and its clients put into Taxy (“Customer Content”), which can include identity details, contact details, financial information, tax file numbers, and supporting documents. The Firm decides what is collected and why; we handle it under our agreement with the Firm and only to provide the service. If you are a client of a Firm, contact that Firm first about your information — they control it, and our agreement with them governs how we process it (see our Data Processing Agreement).
2. What this notice covers — and doesn’t
It covers personal information we handle through our website and the Taxy platform. It does not cover a Firm’s own privacy practices, or third-party sites we link to — those have their own policies.
3. Personal information we collect, and how
| Category | Examples | Source |
|---|---|---|
| Account & identity | Name, email, role, password (hashed) | Firm / user at sign-up |
| Usage & device | Log-in events, in-app activity, IP, browser | Automatically, in use |
| Customer Content | Client identity, contact, financial data, tax file numbers, documents | Entered by the Firm and its clients |
| Support & comms | Messages you send us, support-access logs, call recordings | You / our systems |
| Website | Enquiry-form details, cookies | You / your browser |
We collect tax file numbers only as part of the Customer Content a Firm chooses to collect. We collect, use, store and disclose them only as necessary to provide the platform to the Firm, never use them to establish or confirm an individual’s identity, and otherwise handle them in accordance with the Privacy (Tax File Number) Rule 2015.
4. How we use personal information
To provide, secure, support and improve the platform; to communicate with account holders; to bill; and to meet our legal obligations. We use aggregated, de-identified usage data to improve the product. We do not sell personal information, and we do not use Customer Content for advertising.
Artificial intelligence
Taxy uses AI tools provided by Anthropic to develop, operate and support the platform. That work can involve personal information, including Customer Content, which Anthropic then processes on our behalf. We use Anthropic with model training turned off. Anthropic is listed on our Sub-processor list.
Where Taxy offers AI features within the platform, those features use models provided by Google Cloud Platform, operated in our Australian Google Cloud environment, and personal information is not used to train them. This is separate from Taxy’s use of Anthropic.
Meetings and calls
We may record and transcribe meetings and phone calls — for example sales, onboarding and support calls with prospective and existing Firms — to capture notes and follow-ups and to improve our service. We use Fireflies to transcribe video meetings and Aircall for business telephony (which captures phone numbers and call recordings). Participants are told at the start of each call that it is being recorded and may decline; if you ask us not to record, we won’t. We keep access to recordings least-privilege and do not use them to train AI models.
When we speak directly with a Firm or one of its clients, for example in onboarding or support, the conversation can include the Firm’s client information, which we handle on the Firm’s behalf. For those calls Fireflies and Aircall are our sub-processors, and both are listed on our Sub-processor list. Our other recordings, such as sales calls, are our own confidential records (Taxy as controller).
5. Cookies and website analytics
We use essential cookies to run taxy.au and Google Analytics 4 to understand website usage. Google Analytics is used for visitor analytics on our marketing site only — it does not receive Customer Content. You can control or disable cookies through your browser settings; disabling non-essential cookies will not affect your use of the Taxy platform.
6. How we share personal information
- Service providers (sub-processors) who help us run the platform — see our Sub-processor list. Each handles data under its written terms with us.
- The Firm whose account the Customer Content belongs to.
- Legal / safety — where required by law, or to protect rights and safety.
- On a business transfer (merger or sale), under confidentiality.
7. Retention
We keep personal information while an account is active and as needed for the purposes above or to meet legal obligations. On a Firm’s request we delete Customer Content within 60 days, except where we must retain it by law. Copies in our backups expire within 30 days after that, and security and audit logs of how the platform was used are kept for up to 400 days. When a Firm leaves, the tax file numbers, bank details and identity-document details we hold as separate fields are destroyed rather than returned to it. This matches Section 10 of our DPA.
8. Security
Customer Content is stored in Australia and encrypted in transit and at rest. Our staff accounts always use multi-factor authentication, and staff access to the Google Cloud systems that store it is limited to what the job needs and logged. See our Security page for detail. If a data breach is likely to cause serious harm, we will notify affected individuals and the OAIC without undue delay, consistent with the Notifiable Data Breaches scheme. Where the breach involves Customer Content, we agree with the Firm which of us notifies.
9. International transfers
Customer Content, including backups, is stored in Australia.
Some of the service providers we use hold personal information in the United States, and it is disclosed to them there:
- Twilio (SendGrid) sends notification emails and receives the emails clients send to the platform;
- Twilio (Segment) receives platform usage data;
- Anthropic processes personal information when Taxy’s AI tools are used in work that involves it (section 4);
- Fireflies records and transcribes our video meetings (section 4);
- Aircall holds the names, phone numbers and call details from our phone calls; the call recordings themselves are stored in Australia (section 4).
Each is listed, with the information it handles, on our Sub-processor list. Our own business tools, such as Google Workspace, Slack, Xero, Trello and Google Analytics, also hold personal information about our contacts in the United States, Europe and elsewhere. We take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles (APP 8).
10. Your rights
You may request access to, or correction of, your personal information, and may complain about how we have handled it. Contact us (below). If unresolved, you may complain to the Office of the Australian Information Commissioner (OAIC), oaic.gov.au. Clients of a Firm should contact the Firm first.
11. Updates
We may update this policy; material changes will be notified by email to account holders and/or a notice in the app. The “last updated” date shows the current version.
12. Contact
privacy@taxy.au · Taxy Pty Ltd, Level 7, 88 Phillip Street, Sydney NSW 2000.