Ledger Buddy Privacy Policy
Version 1.2 | Updated 11 October 2026
1. Who we are
Ledger Buddy is operated by JR Photo and Video Pty Ltd ACN 677 761 787, trading as Ledger Buddy. We provide document collection, receipt review and authorised accounting integration software. This policy explains our handling of personal information under the Privacy Act 1988 (Cth) and Australian Privacy Principles.
This policy covers our public website (ledgerbuddy.com.au), the Ledger Buddy web app used by practices, the secure upload pages we send to clients, and LedgerBuddy for iPhone, our app for practice staff. Ledger Buddy is also written “LedgerBuddy”, including in the Apple App Store; both names refer to the same service.
We provide our service to bookkeeping and accounting practices. If you are a client of one of those practices, that practice is your point of contact, and this policy explains what we do with your information on their instructions.
2. The information we handle
About clients of the practices we serve:
name and business name
contact details, including mobile number and email address
information from the accounting file your practice has connected, such as Xero: for spend transactions, the date, payee, amount, reference, bank account, account code and whether a document is already attached; supplier bills used to match documents; supplier contact names; the file’s chart of accounts, tax rates and bank accounts; and a record of how the practice has previously coded each supplier, used to suggest treatment. Where your practice approves a change in the accounting file, we also keep a copy of the transaction as it was before the change, so it can be reviewed or reversed
documents you upload to our portal, such as receipts and tax invoices, and documents your practice uploads on your behalf, including from LedgerBuddy for iPhone
records of messages, delivery outcomes and account activity; voice recordings and transcripts only if a later voice service is enabled with the required consent
technical information about your use of our portal, such as IP address and device type
About the practices we serve and their staff: name, role, business contact details, sign-in and security records (including multi-factor authentication settings and, where used, a linked Xero sign-in identifier), account activity records, and, for users of LedgerBuddy for iPhone, the device and session details described in section 14.
About visitors to our public website: the analytics information described in section 15, and anything you choose to send us, such as a pilot registration or practice application.
We do not request tax file numbers. Do not upload tax file numbers, identity documents or unrelated sensitive information. If you supply them accidentally, contact your practice promptly. Screening reduces risk but cannot guarantee detection of every sensitive item.
Uploaded documents may contain personal, financial or sensitive information. We restrict processing to the service purpose and applicable authority, and may quarantine or reject unsuitable documents.
3. How we collect it
Most of the information we hold about a practice's client is not collected from that person. It is provided to us by the practice, or drawn from the accounting file the practice has connected on its client's instructions. Because of that, we give a collection notice on the secure upload page reachable from every message we send.
We collect information directly when you apply for an account, use the service or LedgerBuddy for iPhone, upload documents, reply to a message or visit our public website.
Practice staff can also upload a receipt on a client’s behalf, for example by photographing it with LedgerBuddy for iPhone. Those documents receive the same screening, storage, optional AI reading and review as documents a client uploads.
Information from Xero.
When a practice connects a Xero organisation, the practice authorises Ledger Buddy to access that file through Xero’s published interface. We use information from the file only to provide the service to that practice. We share it only with the service providers described in sections 6 and 7, for the purposes described there. Some uses also need the practice to have recorded the required client authority, for example transaction details and account names sent with a receipt for optional AI reading, and the merchant, amount and date included in an enabled document request. We do not sell information from Xero, supply it to other apps or third parties for their own use, or use it to train or improve any AI model. Xero’s handling of information in your Xero file is governed by Xero’s own privacy notice.
If you sign up or sign in with Xero.
If you choose “Sign up with Xero” or “Sign in with Xero”, Xero shares your name, email address and a Xero user identifier with us, with your permission. This does not give us access to any Xero organisation. When you sign up, we use these details to pre-fill your practice application; the email address comes from Xero and you add the remaining details yourself. Details from an unfinished sign-up expire after 30 minutes and are then deleted. We keep the Xero user identifier with your login so you can sign in with Xero later. Connecting a client’s Xero file is a separate step a practice user takes after the practice is approved.
4. Why we handle it
We handle this information to:
identify transactions in a connected accounting file that lack a supporting document
send enabled administrative reminders on a practice’s instructions to collect documents
receive and store documents you upload and return them to the practice's records
extract receipt details and suggest matches and accounting treatment for human review
provide, maintain, secure and support our platform
send notifications that practice users have turned on in LedgerBuddy for iPhone
understand and improve our public website (section 15)
comply with our legal obligations
We do not sell client information or use it for our own marketing or to train our own AI models. Anthropic’s commercial API terms state that customer data is not used for model training by default. Its standard API retention is up to 30 days, subject to service, safety and legal exceptions. We do not claim a zero-retention arrangement or that all providers are prohibited from retaining data.
5. Automated decision-making
This section describes the current service and its human review requirements.
Where document AI is enabled with the required client authority, the complete uploaded receipt image or PDF, including personal and financial information visible in it, is sent to Anthropic with relevant transaction context and account names for extraction and accounting suggestions. AI can make errors. Each accounting action requires individual review and approval; a suggested match does not establish that a receipt belongs to that transaction.
Automation uses contact details, transaction dates, amounts and merchants, uploaded document contents, account names, proposed tax treatment, document status and communication history.
Where reminders are enabled, software schedules authorised reminders. Software also performs safety screening and suggests matches and accounting treatment. Accounting records are not created or changed solely on an AI decision.
A practice user reviews the receipt, supplier, date, amount, account and GST treatment before approving an enabled accounting action. Ledger Buddy does not provide a supervising BAS or tax agent. The practice must arrange appropriately qualified or registered professional services where required.
You may ask your practice how a treatment was reached and request human review or correction. A later document must be reviewed; it does not trigger an automatic reversal in Xero. Automated voice calling is not available in the initial beta. Before any later release, separate identification, recording-consent and opt-out checks must be completed. Where introduced, the assistant must identify itself and the practice, disclose recording and obtain agreement before continuing. Declining a call must leave another way to provide documents.
6. Who we share it with
The practice that engaged us.
Your practice receives the documents and results. Approved documents may be attached to your Xero records.
Our service providers.
We use Cloudflare, AWS, HighLevel, Xero and Anthropic for the purposes described below. Google sign-in and Stripe payment services are used only where enabled; beta charging is disabled. Apple delivers LedgerBuddy for iPhone notifications where they are turned on (section 14), and Google provides analytics for our public website (section 15). Access is limited by the purpose of each service.
We disclose personal information to service providers only for the purposes in this policy. We use providers whose terms require them to keep the information secure and to use it to provide their services to us, subject to the retention and legal exceptions in their own terms, described in section 7 and at ledgerbuddy.com.au/providers. We do not sell personal information or share it with data brokers.
Others where required.
We may disclose information where required or authorised by law, or to protect against fraud or serious threats.
7. Overseas disclosure
Cloudflare hosts application records and uploaded documents; Australia-only storage or processing is not guaranteed. AWS document scanning and backup workloads run in Sydney. HighLevel handles onboarding and enabled SMS/email communications, including contact details, message content and upload links, with overseas processing including the United States. Where enabled, Anthropic receives full documents and context for AI analysis, with overseas processing including the United States. Xero receives authorised accounting data and attachments. Apple Push Notification service, which delivers app notifications, and Google Analytics, which measures use of our public website, process information overseas, including in the United States. Provider subprocessors and support may operate in additional countries; provider location information is available at ledgerbuddy.com.au/providers or from our privacy contact.
For current provider roles and links to provider privacy and subprocessor information, see ledgerbuddy.com.au/providers. Contact us for more information about a particular data flow.
8. Keeping it secure
Controls include encryption in transit and provider encryption at rest, tenant access restrictions, MFA for application access, access logging, document screening, backups and monitored operational alerts. Upload links are bearer links: anyone possessing a valid link may use it. Links normally expire after 30 days and can be revoked earlier. Do not forward them.
LedgerBuddy for iPhone adds on-device protections, described in section 14.
No system is perfectly secure. If a data breach involving your information is likely to result in serious harm, we and your practice will notify you and the Office of the Australian Information Commissioner as required by the Privacy Act.
9. How long we keep it
Information is retained while needed to provide the service, meet legal obligations, resolve disputes and investigate incidents. On an authorised closure or deletion request, we coordinate export and deletion with the practice, subject to legal holds and applicable agreement terms. Provider copies and backups follow their own retention cycles. Daily AWS backups have a 30-day current-snapshot lifecycle; older versions become eligible for expiry seven days after becoming noncurrent. Lifecycle deletion is not instantaneous. Deletion from Ledger Buddy does not remove records retained independently by the practice or in Xero.
Your practice has its own record-keeping obligations under tax law and keeps its own copies. Deleting information from our platform does not delete it from your practice's records.
When an accounting connection ends.
A practice can disconnect a Xero organisation from Ledger Buddy at any time, and a Xero user can remove Ledger Buddy from Xero’s connected apps. When a practice disconnects, we ask Xero to end the connection and we delete our stored access keys immediately, so we can no longer read from or write to that file. Document requests in progress are cancelled and their upload links stop working. Information we already collected from the file, documents uploaded for it and the activity record are kept in the practice’s account so its records remain complete and the file can be reconnected. We keep that information until the practice asks us to delete it or closes its account, subject to the retention terms above. Disconnecting does not change or remove anything in the accounting file itself.
Archived clients.
A practice can archive a client file when it stops acting for that client. Archiving stops chasing straight away, cancels open document requests so their upload links stop working, and ends our access to that client’s Xero file. The file’s history, including documents, transaction records and the activity record, is kept so the practice’s records stay complete, and the practice can restore the file later. A practice can also ask for an archived client file to be permanently deleted. The file is then frozen, with no further processing, and deleted from Ledger Buddy after a retention check, subject to legal holds. Provider copies and backups follow the retention described above.
10. Accessing and correcting your information
You can ask us for access to the personal information we hold about you, and ask us to correct it. Contact us using the details in section 13. We will respond within 30 days. If we refuse, we will tell you why in writing and how to complain.
In most cases it will be faster to contact your practice, because they hold the fuller record.
11. Direct marketing
Administrative reminders are sent for the practice’s document collection purposes. Reply STOP to an SMS or contact your practice to stop automated reminders. The platform records suppression for subsequent automated reminders; messages already handed to a provider may still arrive. Voice is disabled during initial beta.
12. Complaints
If you think we have mishandled your information, email admin@ledgerbuddy.com.au. Explain what happened and the outcome you seek. We aim to respond substantively within 30 days and will explain any delay.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, by phone on 1300 363 992, or by post to GPO Box 5218, Sydney NSW 2001.
13. Contact us
Privacy contact: JR Digital Services for Ledger Buddy. Email: admin@ledgerbuddy.com.au. Operational incidents: admin@jrdigitalservices.com.au. Post: JR Photo and Video Pty Ltd, 32B Western Parade, Brooklyn Park, South Australia, Australia.
14. LedgerBuddy for iPhone
LedgerBuddy for iPhone is for staff of practices that already have a Ledger Buddy account; clients of practices do not use it. It shows the same practice information as the web app and lets staff review and approve receipts, start document requests and upload receipts. Information the app displays is downloaded from our servers and is covered by the rest of this policy. The app itself collects:
your name, email address and Ledger Buddy user ID, to sign you in and record who did what
device information: the name you have given your device (for example “Sam’s iPhone”), the app version and, if you allow notifications, an Apple push notification token, so you can see and sign out your devices and receive the notifications you turn on
receipt photos and files you choose to take or upload for a client, and what you enter, such as approval details (supplier, date, amount, account, GST treatment and splits), notes and reasons, notification preferences and quiet hours
the financial details in an approval, which are written to the client’s Xero file when you approve
a record of the actions you take, such as approving a receipt or starting a document request, kept as part of the practice’s audit trail, and when each device was last used
We use this information only to provide the app and keep it secure. The app contains no advertising and no third-party analytics, crash-reporting or advertising tools, and it does not track you: we do not link app information with other companies’ data for advertising or share it with data brokers.
Camera and photos: the app uses the camera only when you choose to photograph a receipt, and the photo picker shares only the photos you select. Photos are re-encoded before upload, which removes location and other embedded metadata. Uploaded receipts are then handled as described in sections 2 to 9, including optional AI reading where your practice has turned it on.
Face ID: if you turn on Face ID lock, iOS checks your face and tells the app only whether the check succeeded. Face ID data stays in iOS on your device and is never sent to us.
On your phone: your sign-in token is kept in the iOS Keychain on that device only, and our servers store only a one-way hash of it. The app keeps a read-only copy of your dashboard and client list, protected by iOS data protection, so it can open without a connection. Signing out deletes the token and that copy from the phone and tells our servers to end the session and stop notifications to the device.
Notifications: if you allow notifications, alerts are delivered through Apple Push Notification service. They name the client organisation and give counts only, never a person’s name, contact details, amounts or receipt details. You can turn notification types off in the app’s settings, or all notifications off in iOS Settings. Notifications are being introduced in stages and may not yet be active for your practice.
Sessions and devices: an app session ends after 30 days without use, when you sign out or remove the device, and when your password, multi-factor authentication or email address changes or your account or practice is disabled or suspended. A device’s push token is deleted when its session ends, and ended session records are deleted 90 days later.
Demo mode: Demo mode uses only fictional data stored inside the app. It does not connect to our servers or Xero, and it contacts no one.
15. Website analytics and cookies
Our public website, ledgerbuddy.com.au, uses Google Tag Manager and Google Analytics, provided by Google LLC, to understand how the website is used. They are not used in the Ledger Buddy web app (app.ledgerbuddy.com.au), on the upload pages sent to clients, or in LedgerBuddy for iPhone.
Google Analytics collects the pages you visit, how you arrived (for example from a search engine), your device and browser type, an approximate location derived from your IP address, and actions such as registering for the pilot, submitting an application or selecting an App Store or Xero sign-up link. We do not send form contents, such as your name, email address or phone number, to Google Analytics. We use this information to understand and improve the website.
Google Analytics sets first-party cookies named _ga and _ga_ followed by an identifier, which last up to two years by default. Google processes this information, including in the United States, under its own privacy policy. Our pilot registration form also sets one security cookie for up to two hours to stop forged submissions, and the web app uses essential sign-in cookies; neither is used for analytics.
You can block or delete cookies in your browser settings, or install Google’s Analytics opt-out browser add-on. The website works without analytics cookies. More detail is at ledgerbuddy.com.au/cookies.
16. Your choices and deleting your account
You can withdraw a permission or authority at any time:
clients of a practice: reply STOP to an SMS or ask your practice to stop reminders (section 11), and ask your practice to withdraw its authority for optional AI reading of your documents
practices: disconnect a Xero organisation (section 9), switch off chasing for a client, or archive a client file
LedgerBuddy for iPhone users: turn off camera, notification or Face ID access in iOS Settings, remove a device from your account in the app, or sign out (section 14)
website visitors: block or delete analytics cookies (section 15)
To delete your own Ledger Buddy user account, email admin@ledgerbuddy.com.au from the address on the account, or ask your practice’s account owner to request it. We will confirm the request, stop sign-in to the account, end all its app sessions and then delete or de-identify your account details; we aim to complete this within 30 days. To close a practice’s account, the practice owner can email the same address and we will coordinate export and deletion as described in section 9. Records that form part of a practice’s audit trail, such as who approved a receipt, may be kept with the practice’s records where we or the practice are required to keep them.
Accounts are not created in LedgerBuddy for iPhone, so deletion requests are made by email rather than in the app. Clients of a practice can ask the practice, or us, to delete their information as described in sections 9 and 10.
17. Changes
We may update this policy. The current version is always at ledgerbuddy.com.au/privacy and the date at the top shows when it last changed. We will notify practices of material changes.
Version history: 1.2 (11 October 2026) added LedgerBuddy for iPhone (section 14), website analytics and cookies (section 15) and your choices and account deletion (section 16); described Sign up and Sign in with Xero, information from Xero, archived clients and retention after an accounting connection ends; and corrected the description of information taken from accounting files. 1.1 (14 September 2026).