How HPLedger online handles personal information · Effective 18 October 2026
Homepedia Pty Ltd ("we", "us") provides HPLedger online, a hosted accounting and payroll service. This policy explains how we handle personal information under the Privacy Act 1988 (Cth), the Australian Privacy Principles and, for Tax File Numbers, the Privacy (Tax File Number) Rule 2015. It forms part of our Terms of Service.
We hold two kinds of personal information. About our customers — the people who sign in and pay for the Service — we decide how it is handled. In our customers' books — their employees, contractors, customers and suppliers — we hold and process it for the business that entered it, which is responsible for collecting it lawfully and telling those people about it. If you are an employee or contact of one of our customers, please contact that business first; we will help them respond.
To provide, secure and support the Service; to do what you ask of it (for example prepare a payroll report or a payment file); to bill subscriptions; and to send you email about your account and the Service. We do not sell personal information, use it for advertising, or use it to train artificial-intelligence models. We do not send marketing email without your consent.
Tax File Numbers are used only for the payroll and tax reporting purposes the law allows. They are encrypted at rest, access to them is restricted, and they are only disclosed in the reports and files you direct the Service to prepare or send, or where the law requires.
The Service, its databases and uploaded files are hosted by DigitalOcean in Sydney, Australia. Each Organisation's ledger is kept in its own database, separate from every other customer's.
Within the Service, with the people the Subscriber gives access to an Organisation, such as staff and Advisers. Outside it, only with these service providers, under contracts that require them to protect it, and only for the purpose shown. Your browser loads the Service's pages, scripts and fonts from us alone; it does not fetch them from third-party sites.
Where you use a feature that sends a report to a government agency or a fund, the report goes through the provider named on that feature's page. We also disclose information where the law requires it.
Your books stay in Australia. Stripe and Resend may process the information they handle — billing details, and the email addresses and contents of emails we send — outside Australia, including in the United States.
We use encryption in transit (TLS), encryption of Tax File Numbers at rest, a separate database for each Organisation, hashed passwords, two-factor authentication for every User, role-based access and an audit trail. If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
We use one cookie, to keep you signed in. We do not use advertising or analytics cookies.
We keep an Organisation's information while it has a trial or a subscription, and for 3 months after it is locked; after that we may delete it. The Subscriber can ask us to delete it sooner. After deletion it is removed from our live systems and from backups as they expire. We keep information longer only where the law requires us to.
You can see and correct most of your information in the Service, and you can ask us for access to or correction of personal information we hold about you. If you have a concern about how we handle personal information, contact us; we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
We may update this policy. We will tell you about a material change by email or in the Service before it takes effect.
Homepedia Pty Ltd — admin@homepedia.com.au