Privacy policy
- We collect what we need to put your property statements and bills into Xero: your sign-in, the documents you send, and what we read from your Xero books.
- Documents you send are read by an AI model. Your Xero books are never sent to one.
- We don't sell your information, show you ads or track you around the web.
- Your data is stored in Sydney, Australia. A few of our providers are in the United States.
- You can ask to see, correct or delete your information at any time: email privacy@zerocile.io.
Who we are
Zerocile is run by HandsBros Limited of 7 Pearce Place, Wanaka, New Zealand ("we", "us"). Our privacy officer is David Jenkins, who you can reach at privacy@zerocile.io.
This policy is written to meet New Zealand's Privacy Act 2020 and, for people in the United Kingdom, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
What we collect
About you
- Your account: your email address and, if you sign in with Google, your name. We never see or store a password.
- Your workspace: its name, who's in it, and your settings (for example whether you get the Monday email).
- Your Xero connection: the access Xero gives us when you connect, stored encrypted. We never see your Xero password.
From what you send and connect
- Documents: the statements, invoices and other files you forward or upload, the email they came in (sender, recipients, subject, date) and what we read from them.
- Screenshots you add when asking us to explain a bank line.
- Your Xero books: the organisations you connect, their accounts, tax rates, tracking categories, contacts, bank accounts, and the transactions needed to avoid posting anything twice and to make tax packs.
- Your answers: how you've told us to code things, so we can do it the same way next time.
About other people
Statements and invoices often name other people, such as tenants, tradespeople and property managers. We handle that information only to provide the service to you, and only you and the people in your workspace can see it. By sending it to us you confirm you're allowed to.
Automatically
Basic technical records, such as the time of a request and any errors, kept to run and secure the service. We use only the cookies the service needs to work (see Cookies below), and no analytics or advertising trackers.
How we use it
- To read your documents and post entries and draft bills to your Xero organisations, and to show you anything that needs your answer.
- To send you the emails the service needs: sign-in links, invites, replies when mail went to the wrong address, and the Monday email unless you turn it off.
- To make tax packs and explain bank lines when you ask.
- To keep the service secure, fix problems and improve it.
We don't use your information for advertising, we don't sell it, and we don't use your documents or books to train AI models.
Our legal bases (UK)
For people in the UK, we rely on: performing our contract with you (running the service you signed up for); our legitimate interests in keeping the service secure and working well, balanced against your rights; and meeting legal obligations, such as keeping financial records. For other people's details in your documents, we act on your instructions as your processor, and you decide why that information is handled.
How documents are read
Each document you send, and each screenshot you add, is read by an AI model run by Anthropic, PBC, to turn it into lines with dates and amounts. Anthropic's commercial terms don't allow it to train its models on what we send. Everything after that, including what's matched against your Xero books, happens in Zerocile itself. Your Xero data is never sent to an AI model.
Who we share it with
Only the providers we need to run the service, each bound to protect it and use it only for us:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, file storage and sign-in | Sydney, Australia |
| Fly.io | Running the app | Sydney, Australia (a United States company) |
| Anthropic | Reading documents and screenshots | United States |
| Postmark | Sending and receiving email | United States |
| Signing in, if you choose Google | United States |
Xero receives what we post to your organisations, because you've asked us to. Xero's own privacy policy covers what it does with it.
We may also disclose information if the law requires it, to protect someone's safety, or to a buyer if Zerocile is ever sold, in which case this policy would continue to apply.
Sending information overseas
Our main storage is in Australia, and some providers are in the United States. Before using a provider outside New Zealand or the UK, we make sure it protects information in a way comparable to the law where you are: for New Zealand, as the Privacy Act requires; for the UK, using the UK's adequacy regulations (including the UK–US data bridge) or the UK's approved contract terms for international transfers.
How long we keep it
- While your account is open, we keep what's needed to run it, including your documents, so entries can be checked and tax packs made.
- If you close your account, we delete your documents and workspace within 90 days, except anything we must keep by law, such as records of payments to us. Backups are overwritten on their normal cycle.
- Entries we posted to your Xero organisations stay there: they're part of your books, and Xero holds them.
How we protect it
Information is encrypted in transit, Xero access is stored encrypted, each workspace's data is kept separate from every other's, and only the people in a workspace can see it. Very few people at Zerocile can reach stored data, and only to run or fix the service. If a privacy breach is likely to cause serious harm, we'll tell you and the Office of the Privacy Commissioner in New Zealand, or the Information Commissioner's Office in the UK, as the law requires.
Your rights
You can ask us to:
- see the information we hold about you, and correct it if it's wrong (New Zealand and UK);
- delete it, restrict how we use it, object to how we use it, or give it to you in a portable form (UK).
Email privacy@zerocile.io. We'll answer within 20 working days in New Zealand, or one month in the UK, and there's no charge. If someone in a document you sent asks us about their information, we'll pass the request to you, because you decide how it's used.
If you're not happy with how we've handled your information, tell us first. You can also complain to the Office of the Privacy Commissioner in New Zealand, or the Information Commissioner's Office in the UK.
Cookies
We use only cookies the service needs: to keep you signed in, to finish connecting Xero, to remember which workspace you last opened, and to show a message once after you do something. They aren't used to track you, and we use no analytics or advertising cookies, so there's nothing to opt into.
Children
Zerocile is for adults managing their own property finances, and isn't meant for anyone under 18.
Changes
If we change this policy in a way that matters, we'll email account holders before it takes effect. The date at the top shows when it last changed.