Privacy Policy

The Company (“the Service”) is a private financial dashboard for sole traders and small companies. This policy explains what we collect, why, where it is stored, and what control you have over it. It applies to the Service at thecompany.systems and its subdomains.

Who is responsible for your data

The Service is operated from Australia by its sole operator, who is the data controller. You can reach us at hey@archiekerr.com for any question or request described in this policy.

What we collect

Account information. You sign in with Google. We receive your email address, name and Google account identifier from that sign-in. We never receive or store your Google password.

Financial data you enter or import. This is the substance of the Service and includes bank transactions, invoices, clients and their contact details, expenses, income records, receipts and uploaded documents, superannuation contributions, and financial-year summaries.

Third-party credentials. If you connect Stripe or an email sending provider, we store the API keys you supply so the Service can act on your behalf.

Operational data. Standard server and security logs, and a record of emails the Service has sent for you, so that delivery failures can be diagnosed.

What we do not do

• We do not sell your data, and we never have.
• We do not share your data with advertisers or data brokers.
• We do not use your financial data to train machine-learning models.
• We do not run third-party advertising or tracking pixels on the Service.

How your data is isolated

Every record is tied to your account. Access is enforced in the database itself through row-level security, so a request carrying your session can only ever read rows belonging to you. This is enforced independently of application code, which means an application bug alone is not enough to expose another account’s data.

API keys you supply for third-party services are encrypted at rest using AES-256-GCM before being written to the database.

Where your data is stored, and who processes it

The Service relies on a small number of infrastructure providers. Each is a data processor acting on our instructions:

• Supabase hosts the database, authentication and file storage.
• Vercel hosts and serves the application.
• Google provides sign-in.
• Stripe processes invoice payments, where you have connected it. Card details are handled by Stripe and never reach our servers.
• Resend delivers invoice and receipt emails, where you have connected it.

These providers may store or process data outside Australia. Where that happens, your data remains subject to this policy and to each provider’s own contractual obligations.

How long we keep it

We keep your data for as long as your account exists, because the Service’s purpose is a durable multi-year financial record. If you delete your account, the associated records are deleted with it. Note that financial records you have relied on for a tax return may need to be retained by you under Australian law for up to five years; export anything you need before requesting deletion.

Backups may retain copies for a limited period after deletion, after which they age out.

Your rights

You can request access to the data we hold about you, correction of anything inaccurate, an export of your records, or deletion of your account and its data. Write to hey@archiekerr.com and we will respond within 30 days.

If you are in Australia and are not satisfied with how we have handled a privacy matter, you may refer it to the Office of the Australian Information Commissioner.

Cookies

The Service sets one cookie, which stores your sign-in session so you stay logged in. It is strictly necessary for the Service to function, and there are no analytics, advertising or tracking cookies.

Security incidents

If a breach occurs that is likely to result in serious harm, we will notify affected users and the relevant Australian authority as required under the Notifiable Data Breaches scheme.

Children

The Service is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.

Changes to this policy

If this policy changes materially, we will update the date at the top of this page and notify account holders by email before the change takes effect.