Privacy Policy

We collect information in three ways:

• Account information — when a practice signs up: name, email address, business name, plan and billing details.
• Client information uploaded by practices — the practice (our customer) adds their own clients' names, email addresses and mobile numbers so requests can be sent. Client documents and question responses are uploaded through the client portal.
• Usage and technical data — log data, IP addresses, device and browser information, and actions taken in the app (used for security, auditing and product improvement).

Documents uploaded to DocChaser (receipts, invoices, tax documents) may contain personal information and, occasionally, sensitive information. Practices are responsible for ensuring they are authorised to collect and upload this information.

• To provide the service: sending requests, reminders, and delivering collected documents to the practice.
• To scan Xero ledger data (where connected) to identify bills missing attachments.
• To match uploaded documents to requested items using automated analysis.
• To operate billing, plan limits and account administration.
• To send service communications (invites, reminders, status notifications).
• To maintain security, prevent fraud and keep an audit trail of staff actions.

We do not sell personal information. We do not use client documents to train third-party models.

We share information only with the service providers needed to run DocChaser:

• Supabase — database, authentication and file storage.
• Stripe — payment processing and invoicing. Card details are handled by Stripe and never touch our servers.
• Email and SMS providers — to deliver requests, reminders and notifications.
• Xero — where a practice connects their Xero organisation, we exchange data under Xero's API terms.
• AI processing providers — document matching analysis, subject to contractual confidentiality.

Some of these providers process data outside Australia. Where they do, we take reasonable steps to ensure they handle personal information consistently with the APPs. We may also disclose information where required by law.

For client data, the accounting or bookkeeping practice is the party that decides why and how the information is collected. DocChaser processes that data on the practice's instructions. If you are an end client of a practice using DocChaser and want to access or correct your information, please contact the practice directly in the first instance.

We retain account and client data while the practice's account is active. Practices can delete clients, requests and files at any time. When an account is cancelled we provide a grace period for data export, after which data is deleted from production systems, with backups expiring on a rolling schedule. We may retain limited records where required for legal, tax or dispute purposes.

We protect data with encryption in transit and at rest, row-level access controls on every table, expiring single-purpose client portal links, and an audit trail of staff actions. See our Security page for details. No method of transmission or storage is 100% secure; if we become aware of a data breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

You may request access to, or correction of, personal information we hold about you by contacting us at privacy@docchaser.com.au. If you believe we have breached the APPs, contact us first and we will respond within 30 days. If you are not satisfied, you may lodge a complaint with the Office of the Australian Information Commissioner (oaic.gov.au).

We may update this policy from time to time. The current version is always available on this page, and material changes will be notified to account holders by email.

Privacy questions and requests: privacy@docchaser.com.au