Privacy Policy

What we collect

When you create an account: your name, email address, business name, ABN and business structure, venue name and suburb, and the plan you chose. If you sign in with Google, Xero or Apple, we receive your name and email address from them and an identifier for your account with them. We never see or store a password: sign-in is by emailed code, passkey, or one of those services.

When you connect your accounting software (Xero or MYOB): your chart of accounts, bank feed transactions, bills, invoices, contacts, payments and payroll data for the organisation you connect. Recora reads this to keep your books and writes back the entries you approve. We hold an access token for the connection, encrypted, and you can revoke it at any time from Settings or from inside Xero or MYOB.

When you connect a point of sale, delivery or roster platform (Square, Lightspeed, Doshii, Ordermentum, Deputy, Tanda, Planday, Employment Hero or similar): daily sales, payouts, orders, menu items, and staff rosters and timesheets, including staff names and hours. We do not receive card numbers; payment platforms keep those.

When you send us documents: bills, receipts and statements you upload, photograph in the app, or forward to your Recora email address, and the sender and subject of the forwarding email.

When you connect an email inbox (Gmail, Outlook or another provider): see “Connected email inboxes” below. This is optional.

When you use the app: the actions you take (approvals, edits, settings), the device and browser you use, your IP address, and if you turn on notifications, a push token for your phone. We log errors and requests to keep the service running.

When you pay: our payment provider Stripe collects your card details directly. We receive your subscription status and the last four digits of the card, never the full number.

Why we use it

To do your bookkeeping: read documents, code transactions, match payments, prepare BAS and compliance dates, and post approved entries to your accounting software. To send you the notifications you choose. To answer your support requests. To keep the service secure and to meet our legal obligations. We use artificial intelligence (Anthropic’s Claude models, run inside Amazon Web Services in Sydney) to read bills and suggest coding; the suggestions are shown to you and the AI provider does not keep or train on your data.

We do not sell your information, and we do not use it for advertising.

Connected email inboxes

If you choose to connect an email inbox, Recora looks only at who sent each message, its subject line, and the names of its attachments, to pick out supplier bills, receipts and statements. It then saves those attachments and the sender’s name and address. It does not read, store or display the text of your emails, and it does not look at messages without attachments. You can disconnect the inbox at any time in Settings, which revokes our access immediately.

Recora’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we only use Gmail data to provide the bill-capture feature you turned on; we do not transfer it to others except as needed to provide that feature, to comply with the law, or as part of a merger or acquisition with notice to you; we do not use it for advertising; and humans at Recora do not read it unless you ask us to for support, it is needed for security, or the law requires it.

Who else handles your information

We use a small number of service providers, listed on our sub-processors page. The main ones are Amazon Web Services (hosting, email and AI, in the Sydney region), Xero or MYOB (your ledger), Stripe (payments), and Apple and Google (sign-in and phone notifications). Each is bound by its own privacy terms and only receives what it needs for its job.

Your accountant or bookkeeper sees your Recora data only if you invite them. Staff you add see only what their role allows.

Where it is kept

All of your data is stored in Australia, in Amazon Web Services’ Sydney region, encrypted at rest and in transit. Some providers above operate outside Australia (for example Stripe and Google process sign-in and payment details in the United States); where that happens we take reasonable steps to make sure they protect your information to Australian standards.

How long we keep it

While your account is open, we keep your books and documents so they are available to you and your accountant. Australian law requires business records to be kept for five years (seven for wages records), so after you close your account we keep bills, statements and the entries we posted for seven years, then delete them, unless you ask us to delete sooner (see below). Account details, logs and tokens are deleted within 90 days of closing your account. Backups are overwritten within 35 days.

Your choices

You can see and correct your details in Settings. You can disconnect any app or inbox at any time. You can export your data (every bill, transaction and report) from Settings. You can delete your venue and all its data from Settings, Venue; this removes it from Recora immediately and from backups within 35 days, and does not touch anything already in Xero or MYOB. If deleting would leave you without records the law says you must keep, we will tell you before we do it.

To ask a question, make a complaint or request access to or correction of your information, email privacy@recorabooks.com.au. We answer within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Data breaches

If we become aware of a breach that is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

Children

Recora is for businesses and is not directed at anyone under 18.

Changes

We will post changes here and, for anything significant, email account owners before the change takes effect.