Privacy Policy

Version 2026-09-13. azedcost is a product of EMJ Services Pty Ltd, ABN 16 626 783 551.

We hold a little about you (who signed in, which organisations you belong to) and, for each organisation, the budgets, documents and Xero data its members put in or connect. That data is held in Australia to run the service for you, backed up nightly, and deleted when the organisation closes. We do not sell it or use it for advertising.

1. What we collect

Account. When you sign in with Google or Microsoft we receive your name, email address and a sign-in identifier from that provider. We do not receive your password. A first sign-in is recorded as an access request.

Organisation data. Budgets, forecasts, shoots, productions, documents you upload or link, the members you invite and their roles, and a history of who changed what and when.

Xero data. For a connected production we read, through Xero's API: transactions (invoices, bills, payments, bank transactions, manual journals), contacts, attachments, the chart of accounts and tracking categories, and reports such as the trial balance, profit and loss, balance sheet and aged receivables and payables. We store what we pull so the reports work without re-reading Xero. Transactions may include names and details of the people and suppliers your production pays.

Operational logs. Our servers keep ordinary logs (timestamps, addresses, actions in the application) for security and troubleshooting. When a new access request arrives we are notified of the requester's name and email address.

2. How we use it

To provide the Service: build budgets, push the chart to Xero at your request, pull actuals, produce reports and exports, and support you. To notify you about your organisation. To protect the Service against abuse. We do not use your data for advertising or profiling and we do not sell it.

3. Where it is held

The database is hosted by Supabase in Sydney, Australia; documents are held in private storage through the same provider and are reachable only through the application via short-lived links. The application runs on infrastructure we operate in Australia. Sign-in uses Google or Microsoft as the identity provider; email is sent through Google Workspace. Those providers process data under their own policies and may store some data (such as sign-in records) outside Australia.

4. Who can see it

Members of your organisation, in the roles its owner sets. Our staff (at present, the operator of the Service) can see account records and, for support and operation, organisation data. We disclose information to third parties only when the law requires it.

5. Xero

You authorise the Xero connection yourself and can revoke it at any time from Xero's Connected Apps page. We hold the connection tokens Xero issues in the database and use them only to read your organisation and, at your request, to create accounts and tracking categories in it. We never create, change or delete transactions.

6. How long we keep it

Organisation, budget and Xero data: for as long as the organisation exists. On closure it is deleted within a reasonable period.
Documents: kept with the budget they belong to; removed permanently when that budget is permanently deleted and nothing else uses them.
Backups: the database and documents are backed up nightly to encrypted storage we operate, with an offsite copy; backups roll off over a period of months.
Account records: for as long as your account exists and as required for our own tax and business records (generally seven years).
Operational logs: a rolling period of a few months.

7. Your choices and rights

You can disconnect azedcost from Xero at any time from Xero's Connected Apps page. You can export your budgets and reports at any time. You can ask us to close your organisation or account and delete your data, subject to our obligation to keep basic business records. You can ask what personal information we hold about you and have it corrected. Contact [email protected]; we aim to respond within 30 days. If you are not satisfied you may complain to the Office of the Australian Information Commissioner.

8. Cookies

The application uses a session token to keep you signed in and remembers a few display preferences in your browser. The public website sets no cookies and runs no analytics.

9. Changes

We may update this policy. The version date at the top changes when we do, and material changes are announced in the application.

10. Contact

EMJ Services Pty Ltd, ABN 16 626 783 551 — [email protected]