Privacy policy

Who we are

Traction Advisory is operated by Astro Visual Trustee For Ardern Family Trust (ABN 64 629 433 886), an Australian bookkeeping practice. This policy explains what information we hold, why, where it is stored, and who can see it.

Questions about this policy or your information: use our contact form.

What we hold

• Account details — your name, email address and sign-in credentials (including a second factor), so you can sign in securely.
• Business financial information — when a Xero file is connected, we read accounting and (where payroll is enabled) payroll information from Xero to show dashboards and reports. Our access to Xero is read-only; we cannot change anything in your Xero file.
• Notes and settings — classifications, comments and preferences you enter in the app.
• Billing details — handled by our payment provider, Stripe. We never see or store your card number.

Overseas storage and disclosure

Traction Advisory is delivered using cloud infrastructure located outside Australia. Specifically:

• Your data — including your Xero accounting data, and payroll information where a payroll-enabled Xero file is connected — is stored in a database hosted by Supabase in Singapore.
• The service is delivered through Cloudflare's global network.
• Where you use our billing features, payment details are handled by Stripe.
• Emails we send you are delivered through Resend, our email provider.
• The service is hosted and built on Lovable, which also provides the AI service our assistant, Trixie, uses (see "AI assistant (Trixie)" below).

These providers store and process information on our behalf. They do not use your accounting data for their own purposes.

Your information is encrypted while it travels and while it is stored. Access to your Xero data requires a second factor at sign-in, and is limited to people you have authorised: our bookkeeping team while we work with you, anyone you invite to view your business, and — only with your specific approval and for a maximum of 72 hours — read-only support access. Every time someone views your figures, we record who, when and what kind of information, and keep that record for two years.

We remain accountable for your information wherever it is held. If you would prefer your data to be stored in Australia, please talk to us before connecting your Xero file, as this is not something we can change once your account is set up.

AI assistant (Trixie)

Trixie answers questions using your business's figures in the app. When you ask a question, the question and the figures Trixie reads to answer it are sent to OpenAI, through Lovable's AI service, to generate the answer. This processing happens outside Australia, in the United States.

We ask the provider not to store conversations, and under OpenAI's terms for business use, information sent this way is not used to train their models. The provider may keep it for a short time to detect misuse.

Your chats are saved in the app for 30 days after your last message, then deleted automatically. Only you can see your chats, and you can delete them sooner at any time in My Account.

How the service is built and maintained

Traction Advisory is built and maintained with Lovable, our hosting platform, and its AI development agent. The agent can access the database for maintenance and support. It works under our control and on our instructions.

Information about your business's people

Business financial information can include personal information about the business's employees (for example, pay-run totals) and its customers and suppliers (for example, names on invoices). We store only what is needed for the dashboards and reports. We do not store tax file numbers, dates of birth or home addresses.

Our clients are responsible for telling their people that their information is processed by their adviser's tools.

Who can see your information

Our team cannot read your organisation's data unless you invite us in for a support request, or your organisation is a client of Positive Traction, our bookkeeping practice.

• Your organisation's members — the people in your practice or business who have been given access.
• Viewers you invite — read-only, only for the clients you choose, and only while the invitation stands.
• Support access — a named person, read-only, for at most 72 hours, and only with the organisation owner's approval.
• Platform administrators — can see account and billing metadata to run the service, but cannot see your clients' financial figures.

We do not sell your information, and we do not share it with anyone else except the providers listed above, or where the law requires it.

How long we keep it

While your account is active we keep your information so the service works. Trixie chats are kept for 30 days after the last message. Security and access records are kept for two years; they record who did what and when, never the figures themselves.

You can delete your own account, and download a copy of your own data, in My Account. When an organisation or client leaves, its stored figures, reports and settings are deleted within 30 days of the request. Copies in our backups are removed as the backups expire, within our backup retention period.

Cookies

We use only essential cookies and similar browser storage — to keep you signed in and to remember display preferences, such as whether a menu is open. We do not use advertising or tracking cookies.

Your rights

You can ask us what information we hold about you, ask us to correct it, or ask us to delete it. Email us at the address below; we will answer within 30 days, free of charge. You can disconnect a Xero file at any time from the app's settings — disconnecting revokes our access at Xero immediately.

Data breaches

If a data breach is likely to cause serious harm, we will assess it promptly (within 30 days at most), tell the people affected and the OAIC, and tell you what we are doing about it.

Contact us and complaints

For privacy questions, access or correction requests, or complaints, use our contact form. We acknowledge every message within 2 business days and respond within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

If we change this policy we will update the date at the top and, for significant changes, let you know by email.