Privacy Policy

Effective 3 November 2026. This policy explains how Bakio (ABN [ABN]) ("we") handles personal information in connection with Bakio. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Two kinds of personal information

1. About our customers' people: the names, work emails, sign-in details and activity of the staff who use a business, and billing contacts. We collect this to provide, secure and bill for the Service.
2. Inside a customer's business: the information a business keeps about its own clients (for example documents, financial records and correspondence). The business controls that information and is responsible for it under the Privacy Act; we handle it only on its instructions, to provide the Service.

What we collect, and how

• Details you give us: name, email, business name, ABN, billing contact, and the content you put into the Service.
• Created as you use it: sign-in times, IP address, device type, the actions you take (kept as an audit trail for your business's security), and error reports.
• Payment details are entered on Stripe's pages; we keep only a reference and the last four digits — never full card or bank account numbers.
• Push-notification tokens for the mobile app, if you allow notifications.

We collect information directly from you or your business. We do not buy personal information.

How we use it

To provide and support the Service, keep it secure (including detecting misuse), bill for it, tell you about changes that affect you, and meet legal obligations. We do not sell personal information, and we do not use the content of your business to train AI models.

Who we share it with

Only the service providers we need to run the Service, under contracts that require them to protect it:

• Amazon Web Services — file storage, backups and email delivery (Australia (Sydney))
• DigitalOcean — application servers and databases (Australia (Sydney))
• Anthropic (Claude API) — AI features (United States)
• Stripe — subscription payments (card and direct debit) (Australia and the United States)
• Pusher — real-time updates in the app (no document content) (Australia (ap4 region))
• Sentry — error monitoring (technical data, minimised) (United States)
• Apple and Google — push notifications to the mobile app (United States)

We may also disclose information where the law requires it, or to protect someone's safety.

Overseas disclosure

Your business's data is hosted in Australia (Amazon Web Services and DigitalOcean data centres in Sydney, Australia). Some providers above process limited information overseas, mainly in the United States: payment processing, error monitoring and push notifications. AI features send the content they work on to our AI provider, Google (Gemini), which may process it outside Australia. We take reasonable steps to ensure overseas recipients handle the information consistently with the APPs.

Security and retention

Each customer has its own database; data is encrypted in transit, backed up daily to separate storage, and access by our staff is limited and logged. We keep information while the account is active, then delete it: a business 30 days after its subscription ends, with backups expiring within 35 days. Tax invoices are kept for the period tax law requires.

Data breaches

If we become aware of a data breach likely to result in serious harm, we will act under the Notifiable Data Breaches scheme and tell affected businesses without undue delay.

Access, correction and complaints

You can ask to access or correct personal information we hold about you by emailing [privacy email]. For information inside a business's business, please contact that business first. If you have a complaint, email us; we will respond within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

Changes

We will post any change here with a new effective date, and tell business owners of significant changes.

Contact: Bakio, [address] — [privacy email]