Privacy Policy

Homepedia Pty Ltd ("we") provides the hosted HPLedger accounting service. This policy explains what personal information we collect and how we handle it, consistent with the Australian Privacy Act 1988 and the Australian Privacy Principles. It supplements our Terms of Service.

1. What we collect

• Account information — your name, email, and a hashed password; two-factor settings if you enable them.
• The data you enter — the accounting, contact, and payroll records you create, which may include employees' personal details and Tax File Numbers (TFNs).
• Usage and security logs — sign-in events and an audit trail of changes, used to operate and secure the Service.

2. How we use it

We use your information solely to provide, secure, support, and improve the Service — including letting people you authorise, and any accounting practice you engage, access the organisations you share with them. We do not sell your information or use the data you enter for advertising.

3. Tax File Numbers

TFNs are sensitive information protected by the Privacy (Tax File Number) Rule 2015. We collect them only because payroll and tax reporting require them, store them encrypted at rest, restrict access, and do not use or disclose them except as permitted by law.

4. Where it is stored

Your data is hosted on managed cloud infrastructure located in Australia. Each organisation's ledger lives in its own isolated database so one tenant's data is not commingled with another's.

5. Service providers

We use a small number of sub-processors to run the Service, under agreements that require them to protect your data:

• DigitalOcean — cloud hosting and database (Australia region).
• Resend — transactional email (e.g. password resets, invitations).
• OpenAI — only if you opt in to AI-assisted features (e.g. document parsing); the relevant content is sent for that purpose and is not used to train their models under their API terms.

6. Security

We protect your data with encryption in transit (TLS), encryption of TFNs at rest, per-tenant database isolation, hashed passwords, optional two-factor authentication, and access controls. No system is perfectly secure, but we take reasonable steps appropriate to the sensitivity of the data.

7. Retention

We keep your data while your account is active and for a reasonable period afterwards so you can export it, then delete or de-identify it unless the law requires us to keep it longer.

8. Your rights

You may access and correct your personal information, and request its deletion subject to legal retention obligations. To make a request or raise a privacy concern, contact us below. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC).

9. Changes

We may update this policy; material changes will be notified through the Service or by email.

10. Contact

Homepedia Pty Ltd — [email protected]