Privacy Policy — BAS Buddy

Effective date: 6 September 2026

BAS Buddy ("BAS Buddy", "we", "us", "our") is a web application that helps small businesses and bookkeepers extract bookkeeping information — such as vendor, ABN, invoice date, totals, GST and line items — from tax invoices and receipts stored in their own Google Drive.

This Privacy Policy explains what information we collect, how we use and store it, who we share it with, and the choices and rights you have. It applies to the BAS Buddy website and application at https://basbuddy.com (the "Service").

The Service is operated by BAS Buddy as a cloud-hosted software-as-a-service offering. You can reach us at team@basbuddy.com for any privacy matter, including the requests described in section 8.

1. Information we collect

1.1 Account information

When you create an account, we collect:

Your name and email address;
A password, which we store only as a cryptographic hash — we never see or store your actual password;
Account metadata (role, creation and update timestamps);
If you subscribe to a paid plan, billing information — your billing contact details, and payment card details collected and processed on our behalf by a payment provider. We do not store full card numbers on our servers.

1.2 Google user data (Google Drive)

With your explicit consent through Google's OAuth consent screen, BAS Buddy requests read-only access to your Google Drive using the following scopes:

If you choose to connect a Drive account, we collect and store:

OAuth credentials — an access token and refresh token, so the Service can continue to read your Drive on your behalf until you disconnect it or revoke access;
File metadata — names and identifiers of folders you browse and of receipt/invoice files in the folders you choose to sync;
File contents — copies of the receipt and invoice files (e.g. PDFs, images) that you select or that sit in the folders you choose to sync.

BAS Buddy is read-only: it cannot modify, move, delete or create anything in your Google Drive.

You decide which folders to connect. BAS Buddy does not scan your entire Drive unless the folders you connect contain those files.

1.3 Receipt and bookkeeping data

For each receipt or invoice you process, we store the file, its source (file name, Google Drive file ID), and the data extracted from it: vendor name, vendor ABN, invoice date, invoice number, total amount, GST amount, line items, and the AI's confidence scores for those fields. This is the core working data of the Service.

1.4 Automatic and technical data

When you use the Service, our servers process standard technical information such as IP addresses, request timestamps and user-agent strings in security and rate-limiting logs. We do not use this information for advertising or profiling.

1.5 Website analytics

The public marketing pages of this website use Google Analytics 4, which sets small cookies in your browser (such as _ga) so we can understand aggregate usage — which pages are visited, for how long, and on what type of device. We use this to improve the site, not to advertise or to profile individuals. You can prevent Google Analytics from recognising you on return visits with Google's official opt-out browser add-on, or by blocking or deleting cookies in your browser settings.

We do not knowingly collect special-category data, and the Service is not directed at children (see section 9).

2. How we use your information

We use the information above solely to operate the Service:

To create and secure your account and authenticate you (account information);
To connect to your Drive, list the files and folders you choose, download the receipts you sync, and keep that connection working (Google user data);
To run AI extraction on receipt files and show you the extracted bookkeeping fields for your review and correction (receipt data);
To let you export your data in CSV, Xero-compatible and MYOB-compatible formats;
To send essential transactional emails, such as password reset emails;
To manage your subscription, process payments and prevent payment fraud, if you subscribe to a paid plan;
To protect the Service against abuse (rate limiting, security logs).

We do not use your data to advertise, to build behavioural profiles, or for any purpose unrelated to providing the Service.

3. AI processing of your receipt files

To extract bookkeeping fields, the receipt/invoice files you sync are sent over encrypted connections to third-party AI services configured by us, which may include:

OpenAI (image/vision models) — receipt images are sent for data extraction;
Microsoft Azure Document Intelligence — receipt files are sent for invoice analysis;
Google Gemini — an alternative extraction provider that may be enabled by the Operator.

These providers process the files only to return the extracted fields to BAS Buddy. We do not permit them to use your content for any other purpose, and we do not send them your account information, your Google OAuth tokens, or data about any files you have not chosen to sync. Extraction results are stored in your BAS Buddy account so you can review, correct and export them.

4. Google user data — Limited Use disclosure

BAS Buddy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practical terms, this means:

We use Google Drive data only to provide the receipt-syncing and extraction features you have asked for;
We do not transfer Google user data to third parties except the AI processors described in section 3 (and only the file contents needed for extraction), or to infrastructure providers described in section 5;
We do not allow humans to read your Google user data, except in the limited circumstances permitted by the Google API Services User Data Policy (for example, with your consent, for security incident response, or as required by law);
We do not use Google user data to train generalised machine-learning or AI models, and we do not use it for advertising.

5. Sharing and storage

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes. We share data only with the service providers that host and operate the Service:

Render — application hosting, static site delivery and rate-limiting storage (Singapore region);
Supabase — managed PostgreSQL database hosting (Sydney region), where account, receipt and extraction records are stored;
Google — Google Analytics 4 on the public marketing pages, to measure aggregate site usage (see section 1.5);
AI providers — as described in section 3;
Email delivery provider — to send transactional emails such as password resets;
Payment provider — to process subscription payments, if and when you subscribe to a paid plan.

These providers process data on our behalf under their own security and confidentiality terms. Google OAuth tokens for your Drive are stored only in our database, encrypted in transit, and are never exposed to other users.

Data may be stored or processed in Australia, Singapore, the United States and other countries where the above providers operate. Where required, we rely on the providers' recognised transfer safeguards.

6. Data retention and deletion

Receipt files, extracted data and account records are retained for as long as your account is active and the Service needs them to function, so that you can review and export your history.
Google OAuth tokens are deleted when you disconnect your Drive account in the Service, or when you delete your account. You can also revoke BAS Buddy's access at any time through Google's security settings page ("Third-party apps with account access" at https://myaccount.google.com/permissions); revoking access there means the Service can no longer read your Drive.
Account deletion: you may ask us to delete your account and all associated personal data at any time by emailing team@basbuddy.com from your registered address. We will delete your account, receipt records and Google tokens, except where we must retain minimal records for legal or security reasons.
Backups and logs may persist for a limited window (typically up to 30 days) before being purged.

7. Security

We protect your data with:

HTTPS/TLS for all traffic between your browser, our API and third-party services;
Password hashing (never storing plaintext passwords);
Short-lived signed session tokens;
OAuth state parameters and PKCE during Google authorisation;
Access restricted to BAS Buddy.

No system is perfectly secure, but we design the Service to limit what can be exposed: we hold only the data described in this policy, and we keep it read-only with respect to your Drive.

8. Your rights

You may at any time:

Access your data — all receipt and extraction data is visible in the app and exportable as CSV;
Correct your data — every extracted field is editable in the app;
Disconnect your Google Drive — within the app or via Google's security settings page;
Delete your account and data — by emailing team@basbuddy.com.

We handle requests in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) where they apply to us, and with comparable rights in other jurisdictions. If you have a privacy concern, contact us first at team@basbuddy.com and we will work to resolve it.

9. Children's privacy

BAS Buddy is intended for business owners and bookkeepers aged 18 and over. We do not knowingly collect personal information from children under 18. If you believe a child has created an account, contact us and we will remove it.

10. Changes to this policy

We may update this Privacy Policy as the Service evolves. If we make material changes — particularly to how Google user data is used — we will update the effective date above and, where appropriate, notify you in the app or by email before the change takes effect.

11. Contact

Questions about this policy or your data:

BAS Buddy

Email: team@basbuddy.com

Web: https://basbuddy.com