Privacy Policy · AccountKit

AccountKit Pty Ltd (ACN 600 935 813) (“we”, “us”, “our”) takes the privacy of your and your clients’ information very seriously.

We are committed to protecting your privacy and respecting and upholding your rights under the Australian Privacy Principles (“APPs”) contained in the Privacy Act 1988 (Cth) and the General Data Protection Regulation (EU 2016/679) (the “GDPR”) and any other relevant laws pertaining to privacy of individuals in jurisdictions which our Services are available (collectively, “Privacy Laws”).

We understand your requirements to keep client information confidential and wish to ensure that we make as clear as possible how we treat personal information to help you be fully informed about sharing your own and your clients’ personal information with us. This Privacy Policy sets out how we collect, use, store, share and disclose your and your clients’ personal information.

The defined terms in this Privacy Policy (“Policy”) have the same meaning as in our Terms of Use, which you should read together with this Policy. By accessing our Website and using our Services, you consent to the terms of this Policy and agree to be bound by it.

Key areas covered by this Policy;

Collection of Your Personal Information
Collection of Others’ Personal Information from You
Purpose of the Collection of Your Personal Information
Collection of Payment Information
Use of Cookies
Uses of Log Files
Links to Other Websites
Protection of Your Personal Information
Disclosure of Your Personal Information
Google API Services User Data Policy & Limited Use Requirements
Contact Information
Miscellaneous

The Privacy Policy was last updated on 27 March 2026.

Details of Updates

27 March 2026 - Further updates to better align with the GDPR, Terms & Conditions and Data Processing Agreement. Updates specifically to Section 1; Section 6; New Section 8; Section 13 (formerly Section 12); New Section 14; Section 16 (formerly Section 14).
17 April 2025 - Updated to comply with the General Data Protection Regulation (EU 2016/679) along with future potential AI utilisation. Updates specifically to Section 1; New section 2, New section 6, updates to section 7 (prior section 5), New section 8 and updates to sections 12 (prior section 9) and 14 (prior section 11).
27 September 2023 - Updated section 9 to include "Integrations" 9 and section 10 to add in Annature and FuseSign.
22 August 2022 – Updated to add more details to all sections, including adding sections 11 and 12
09 December 2020 - Added section 10. Google API Services User Data Policy & Limted Use Requirements with respect to our integration with Google (Gmail & Google Drive)
01 March 2019 - Update to add Stripe payment gateway privacy information
27 March 2018 - Company name was updated from MBSoft Pty Ltd to AccountKit Pty Ltd
30 June 2017 - Original post

1. We Collect Your Personal Information

Our Services involve the storage of data. That data can include personal information. “Personal information” is information about an identifiable individual, or other entity and may include, but is not limited to, information such as the individual’s name, email address, telephone number, bank account details, taxation details, and accounting and financial information.

Personal information we collect

We may collect personal information directly from you including, but not limited to your:

full name;
business name;
address;
email address;
mobile and business phone number;
location, including country and state;
device ID, device type, geo-location information, computer and connection information, statistics on page views, traffic to and from sites, ad data, IP address, standard web log information;
billing information (including credit card or bank details);
details of the products and services we have provided to you or that you have enquired about, including any additional information necessary to deliver those products and services and respond to your enquiries;
any additional information relating to you that you provide to us directly through our website or app or indirectly through your use of our website or app or online presence or through other websites or accounts from which you permit us to collect information;
information you provide to us through customer surveys; and
any other personal information that may be required to facilitate the provision of Services to you.

How we collect personal information

We will collect Personal Information only by lawful and fair means and never in an unreasonably intrusive way. Generally, we may collect personal information directly from you when you:

register to use AccountKit;
use AccountKit and our Services;
post to our Website, community forum, social media pages, or our blog;
contact the support team; and
visit our Website.
from our business partners or other third-party sources that provide consumer data, such as information about your interests, demographic information, and marketing details.

Use of Automated Tools and Artificial Intelligence

We may use automated tools and technologies, including artificial intelligence, to support certain features of our Services, such as data processing, analysis, and workflow automation.

Where such tools are used:

they are designed to assist users and improve efficiency;
outputs are intended to support, not replace, human decision-making; and
we do not use automated processing to make decisions that have legal or similarly significant effects on individuals without appropriate human involvement.

We do not use customer data submitted through the Services to train general-purpose artificial intelligence models without appropriate safeguards and transparency.

Where third-party providers are used to support these capabilities, they will act as service providers or subprocessors and will be subject to appropriate data protection obligations.

You can always choose not to provide your personal information to us, but it may mean that we are unable to provide you with our Services. If you wish to remain anonymous when you use our Services, do not sign into it or provide any information that might identify you.

We require you to provide accurate, up-to-date and complete personal information at the time it is collected.

2. We do not collect sensitive Personal Information

We will not collect sensitive Personal Information or special categories of Personal Information (as defined under the relevant Privacy Laws) from you. We ask that you do not send us, or do not disclose, any sensitive personally identifiable information (such as information related to racial or ethnic origin, sex life or sexual orientation, political opinions, religious or other beliefs, genetic or biometric data, health criminal background or trade union membership) on or through our Services. If you do provide any sensitive Personal Information, we will require that you provide express consent to us collecting that information as part of you using our Services.

3. We May Receive Personal Information from You About Others

Through your use of AccountKit, we may also collect information from you about someone else. If you provide us with personal information about someone else, such as your clients, you must ensure that you are authorised to disclose that information to us and that, without us taking any further steps required by applicable data protection or privacy laws, we may collect, use, store and disclose such information for the purposes described in this Policy.

This means that you must take reasonable steps to ensure the individual or entity concerned is aware of and consents to the various matters detailed in this Policy, including the fact that their personal information is being collected, the purposes for which that information is being collected, the intended recipients of that information, the individual's right to obtain access to that information, our identity, and how to contact us. You must also provide accurate, up-to-date and complete personal information about others when disclosing this information to us.

Where requested to do so by us, you must also assist us with any requests by the individual to access or update the personal information you have collected from them and entered into AccountKit or our Website or Services.

4. We Collect, Hold, and Use your Personal Information for Limited Purposes

We collect your personal information so that we can provide you with our Services and any related services you may request. In doing so, we may use the personal information we have collected from you for purposes related to the Services including to:

verify your identity;
provide our Website, products and Services to you;
administer, protect, improve or optimise our services (including performing data analytics, conducting research and for advertising and marketing purposes);
billing you for purchases or for using our Services;
notify you of new or changed information relating to AccountKit, or other information relating to us or our business partners;
carry out marketing or training relating to AccountKit;
assist with the resolution of technical support issues or other issues relating to AccountKit;
to carry out any other purpose you have consented to;
comply with laws and regulations in applicable jurisdictions; and
communicate with you.

By using AccountKit, you consent to your personal information being collected, held and used in this way and for any other use you authorise. We will only use your personal information for the purposes described in this Policy or with your express permission.

Use of personal information for direct marketing

Where we have your express consent, or where we are otherwise permitted by law, we may use your personal information to send you information about products and services we believe are suited to you and your interests or we may invite you to attend special events.

At any time, you may opt out of receiving direct marketing communications from us. Unless you opt out, your consent to receive direct marketing communications from us and to the handling of your personal information as detailed above, will continue. You can opt out by following the unsubscribe instructions included in the relevant marketing communication, or by contacting us in writing at support@account-kit.com.

Despite opting out of direct marketing communication, in the event of an important event, we may still contact you to notify you of essential changes to our Services, including notifications of data breaches or changes in material terms to this Policy or our Terms of Use.

5. We Do Not Retain Your Payment Information

If you are a user of our paid service, we utilise third party payment processing companies to collect payment information, including your credit card number, billing address and phone number. We will share this payment information with the third party processing company, and as such you should be aware of the appropriate terms and conditions of these companies. We do not store your payment information.

Some payment providers we use include:

Stripe - Utilised from 1 March 2019 - https://stripe.com/au/ssa
Xero App Store – Utilised from 1 January 2021 - https://www.xero.com/au/legal/terms/
Other third party payment providers – as updated on this Policy, or notified to you in-app from time to time

6. What is our Legal basis?

Under the GDPR, we must have a legal basis to process Personal Information collected from individuals residing in the European Union. We rely on several legal bases to process your Personal Information, including:

where it is necessary to provide you with access to, and use of, products, services and websites;
for our legitimate interests to provide, operate and improve our Services;
where you have freely and expressly consented to the processing of your Personal Information by us, which you may withdraw at any time; or
where we are under a legal obligation to process your Personal Information.

Our Role in Processing Personal Information

Depending on the context in which personal information is processed, AccountKit may act as either a data controller or a data processor.

We act as a data controller in relation to personal information we collect and process about our users directly, including account registration details, billing information, and use of our Website and Services.
We act as a data processor in relation to personal information processed on behalf of our customers through their use of the Services, including client data, financial data, and communications entered into or generated within AccountKit.
When acting as a data processor, we process personal information only on the instructions of our customers and in accordance with our Data Processing Agreement.
Where we process personal information on behalf of our customers, such processing is governed by our Data Processing Agreement.

7. We Use Cookies

We use cookies, web beacons and similar technologies (collectively “Cookies”) on our Website. By accessing or using this Website, you agree that we can store and access Cookies in accordance with this Privacy Policy. You will be able to accept or reject the collection of Cookies by us.

Cookies are small files that can be stored on and accessed from a user’s device when the user accesses a website. They enable authorised web servers to recognise you across different websites, services, devices and browsing sessions.

We may use Cookies to enable users to access and use our Website and Services, including to:

identify users of our Website and Services;
process user requests;
improve user experience;
remember user preferences on our Site;
monitor the use of our Site and for analysis of our user base;
facilitate communication with users;
control access to certain content on our Site; and
protect our Site.

You can delete and refuse to accept browser Cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of the Website.

Unless you have adjusted your browser setting so that it will refuse Cookies, our system will issue Cookies when you direct your browser to our Website.

8. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including to provide our Services, comply with legal obligations, resolve disputes, and enforce our agreements.

Retention periods vary depending on the nature of the information and how it is used. In general:

Account and user data is retained for the duration of the customer relationship and for a reasonable period thereafter;
Customer-submitted data (including client, financial, and communication data) is retained in accordance with customer instructions, including deletion upon request or following termination of the Services;
System logs and technical data are retained for a limited period necessary for security, monitoring, and system integrity;
Backup data may be retained for a limited period after deletion before being securely overwritten.

Where personal information is no longer required, we take reasonable steps to delete or de-identify it.

9. Choices Regarding Your Privacy

You may be provided with choices with how we collect and process your information, including:

opting out or adjusting preferences for cookies when your device accesses the Website;
customise your browser settings to disable or reject cookies across the internet. It's important to note that deleting cookies or declining them in your browser settings might affect the functionality of our Services.
If you’re accessing the Services from a mobile device, using your device's operating system to select options on how it collects and utilises your information for interest-based advertising.

10. AccountKit Uses Log Files

When you use AccountKit, our servers automatically record certain information in server logs. These server logs may include information such as your web request, Internet Protocol (“IP”) address, browser type, referring / exit pages and URLs, number of clicks and how you interact with links on AccountKit, domain names, landing pages, pages viewed, mobile carrier, and other such information. Log files help us to monitor, analyse, improve and maintain AccountKit and to diagnose and address any issues, including security issues.

The data collected through log files will not be kept for longer than is necessary to fulfil the purposes mentioned above. We will handle any personal information collected by log files in the same way that we handle all other personal information.

11. Links to Other Web Sites

Our Website and Services may contain links to third party websites including social media networks. This Policy applies solely to information collected directly by us or as otherwise outlined in the Policy. We are not responsible for the practices employed by websites linked to or from within AccountKit, nor the information or content contained therein. Please remember that when you use a link to go from AccountKit to another website or provider, such as Xero, our Policy is no longer in effect and your activities on that third party website is subject to such third party website’s own rules and policies.

12. We Will Take All Reasonable Steps to Protect Your Personal Information

We are committed to protecting the security of your personal information and we take all reasonable precautions to protect it from unauthorised access, modification or disclosure.

However, the Internet is not in itself a secure environment and we cannot give an absolute assurance that your information will be secure at all times. Transmission of personal information over the Internet is at your own risk and you should only enter, or instruct the entering of, personal information to the Service within a secure environment.

You are required to enable Two Factor Authentication to access AccountKit, to add another layer of security preventing those accessing your account. We strongly recommend using complex passwords, using a VPN and the whitelisting functionality within AccountKit to ensure your own security. For more information please refer to the Help section of our Website.

We will advise you at the first reasonable opportunity upon discovering or being advised of a security breach where your personal information is lost, stolen, accessed, used, disclosed, copied, modified, or disposed of by any unauthorised persons or in any unauthorised manner.

Other than liability that cannot be excluded by law, we will not be liable in any way in relation to any breach of security or any unintended loss or disclosure of personal information.

13. We Will Only Disclose Your Personal Information in Limited Circumstances

We may disclose personal information to third-party service providers where necessary to provide our Services. These may include providers of hosting, infrastructure, payment processing, analytics, communications, and integrations.

These third parties may process personal information on our behalf as service providers or subprocessors.

We take reasonable steps to ensure that such providers:

are subject to appropriate contractual obligations relating to data protection and confidentiality; and
process personal information only for the purposes for which it is disclosed and in accordance with applicable Privacy Laws.

Where personal information is disclosed to third-party integrations selected or enabled by the user (such as accounting systems, document management systems, or communication platforms), those third parties will process personal information in accordance with their own privacy policies and terms.

A list of key third-party providers and integrations may be made available upon request.

We will not otherwise disclose your personal information to a third party unless required by law or permitted under this Privacy Policy. This may include disclosures required to comply with legal obligations, such as court orders, subpoenas, or regulatory investigations. Where appropriate, we will notify you of such disclosures.

14. International Transfers of Personal Information

AccountKit is based in Australia, and personal information processed through our Services is primarily stored in Australia.

Where you are located in the United Kingdom or European Economic Area, this means that your personal information may be transferred to, and processed in, a jurisdiction that may not provide the same level of data protection as your home jurisdiction.

Where personal information is transferred outside of the United Kingdom or European Economic Area, we take appropriate safeguards to ensure that such transfers comply with applicable Privacy Laws.

These safeguards may include:

entering into Standard Contractual Clauses or the UK International Data Transfer Addendum; and
implementing appropriate technical and organisational measures to protect personal information.

By using our Services, you acknowledge that your personal information may be transferred to Australia and other jurisdictions as described in this section.

15. We Adhere to API Services User Data Policies & Limited Use Requirements

AccountKit's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. Where we utilise other third party APIs (including but not limited to Microsoft, BGL, NowInfinity, Twillio, Dropbox, Box, Suitefiles, FYI, Annature, FuseSign and others), we will comply with their respective data policies and limited use requirements.

16. Access and Contact Information - Specific to Jurisdiction

We are dedicated to ensuring that individuals in certain jurisdictions have access to their privacy rights as provided by the Privacy Laws of your jurisdiction. We have set out details below dependent on your location.

Australia

You have the right to both ask:

for access to Personal Information that we hold about you; and
that we correct Personal Information we hold about you.

If you ask, we must within a reasonable timeframe give you access to your Personal Information and take reasonable steps to correct it if we consider it is incorrect, unless there is a law that allows or requires us not to.

We will notify you in writing and explain our reasons if we refuse to give you access to, or correct, your Personal Information.

European Economic Area

For the purposes of the GDPR, we are a ‘data controller’ of your Personal Information. Under the GDPR, an individual residing in the European Union has enhanced privacy rights, including the right to:

require us to correct any Personal Information held about you that is inaccurate or incomplete;
require the deletion of Personal Information concerning you in certain situations;
data portability for Personal Information you provide to us;
object or withdraw your consent at any time to the processing of your Personal Information;
object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you; or
otherwise restrict our processing of your Personal Information in certain circumstances.

Should we decline you access to your Personal Information, we will provide a written explanation setting out our reasons for doing so. These rights are limited in some situations – for example, we can demonstrate that we have a legal requirement to process your Personal Information. In some instances, this means that we may retain some data even if you withdraw your consent.

If you believe that we hold Personal Information about you that is not accurate, complete or up-to-date, then you may request that your Personal Information be amended. We will respond to your request to correct your Personal Information within a reasonable timeframe, and you will not be charged a fee for correcting your Personal Information.

If we no longer need your Personal Information for any of the purposes set out in this Privacy Policy, or as otherwise required by the relevant Privacy Laws, we will take such steps as are reasonable in the circumstances to destroy your Personal Information or to de-identify it.

Access, Management or Deleting your Personal Information

Under the GDPR, an individual residing in the European Union has enhanced privacy rights, including the right to:
require us to correct any Personal Information held about you that is inaccurate or incomplete;
require the deletion of Personal Information concerning you in certain situations;
data portability for Personal Information you provide to us;
object or withdraw your consent at any time to the processing of your Personal Information;
object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you; or
otherwise restrict our processing of your Personal Information in certain circumstances.

Subject to some exceptions provided by the relevant Privacy Laws, you may request access to your Personal Information in our customer account database, or seek correction of it, by contacting us at support@account-kit.com. Should we decline you access to your Personal Information, we will provide a written explanation setting out our reasons for doing so.

We will not charge a fee for responding to a request to access personal information unless the request is manifestly unfounded or excessive, in which case a reasonable fee may be charged.

If you believe that we hold Personal Information about you that is not accurate, complete, or up to date, then you may request that your Personal Information be amended. We will respond to your request to correct your Personal Information within a reasonable timeframe, and you will not be charged a fee for correcting your Personal Information.

You also have the right to lodge a complaint with a relevant supervisory authority if you believe that your personal information has been processed in a manner that does not comply with applicable Privacy Laws.

In the United Kingdom, the supervisory authority is the Information Commissioner’s Office (ICO), which can be contacted via www.ico.org.uk.

17. Miscellaneous

AccountKit is located in Australia and adheres to the privacy laws of Australia. If you are in a different jurisdiction, for example in the European Union or the state of California, you may be entitled to enhanced privacy rights. Please contact us if you wish to exercise your rights under the respective privacy laws of your jurisdiction, including the correction, deletion, porting, withdrawing of consent, or processing of your personal information.

AccountKit reserves the right to amend, modify, add or remove portions of this Privacy Policy at any time without notice and amendments will be effective immediately upon posting of the amended Policy on our website.

Please check this Policy from time to time for such changes. Your continued use of AccountKit following the posting of changes to this Policy will mean you accept those changes. Any amendments made to the Policy may be retrospectively applied if required by law.