1. Who we are
APBuddy is operated by Willow Park Ventures Pty Ltd, a company registered in Australia. We are the data controller (or, where applicable, the data processor acting on your instructions) for personal information handled through the APBuddy service. Contact: privacy@apbuddy.io.
2. Data we collect
- Account data — name, email, role, organisation, invitation status.
- Invoice & vendor data — files you upload or forward by email, extracted fields, vendor records, approval history, comments.
- Xero-synced data — contacts, chart of accounts, tracking categories, tax rates, and posted invoice metadata retrieved via your authorised Xero connection.
- Usage & logs — timestamps, IP addresses, browser/user-agent, error and processing logs used for security and diagnostics.
3. How we use your data
- To provide, secure, and support the Service;
- To extract fields from invoices using AI, and to power the in-app assistant;
- To send transactional and lifecycle emails (approvals, invitations, billing, trial reminders);
- To detect abuse, fraud, and quota breaches;
- To comply with legal obligations.
4. Legal bases
Where the EU/UK GDPR applies, we rely on: (i) performance of a contract (to deliver the Service you subscribed to), (ii) legitimate interests (security, product improvement, support), (iii) consent (where required, e.g. optional marketing), and (iv) legal obligation. Australian handling is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
5. AI processing
Invoice documents and related metadata are sent to the Lovable AI Gateway (which currently routes to Google Gemini models) to perform extraction and to answer assistant queries. These providers process data solely to return results to us; we do not permit them to use Customer Data to train their foundation models.
6. Subprocessors
We use the following subprocessors to deliver the Service:
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Database, auth, storage, edge functions | AWS (region set for the project) |
| Lovable AI Gateway | AI model routing (Gemini) | Global |
| Xero | Accounting integration (customer-authorised) | Global |
| Resend | Transactional & inbound email | EU/US |
| Stripe | Subscription billing & payments | Global |
| Vercel / Lovable | Frontend hosting & delivery | Global |
7. Data location and transfers
Customer Data is primarily stored in our Supabase project. Some subprocessors (AI, email, payments) operate globally, which may involve transfers outside Australia or the EEA. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.
8. Retention
We retain Customer Data for the life of your account and delete it from active systems within 30 days of account closure. Backups roll off on their normal cycle (typically 30 days). Processing logs and audit records may be retained longer where required for security or legal reasons.
9. Security
- Row-level security isolates each organisation’s data by
org_id. - Data is encrypted in transit (TLS) and at rest by our hosting providers.
- Xero OAuth tokens are encrypted at the application layer using AES-256-GCM.
- Service-role credentials are restricted to backend edge functions; no admin dashboard is exposed to customers.
10. Your rights
Depending on your jurisdiction, you may have rights to access, correct, delete, port, or object to processing of your personal information. To exercise these rights, email privacy@apbuddy.io. Australian users may also complain to the Office of the Australian Information Commissioner.
12. Children
APBuddy is a business product and is not directed at anyone under 16.
13. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified by email or in-app at least 30 days before they take effect.
14. Contact
Willow Park Ventures Pty Ltd, Australia. Privacy enquiries: privacy@apbuddy.io.