Privacy Policy

Kumry is provided by PMOAid Pty Ltd (ABN 88 654 942 757) trading as Kumry ("Kumry", "we", "our" or "us"), of Level 7, 90 Phillip Street, Parramatta NSW 2150, Australia. This policy explains how we collect, use, disclose and protect personal information. We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Much of the information in Kumry is put there by our customers, the businesses that use Kumry, about their own staff, customers and suppliers. We hold that information on the business's behalf, under our Data Processing Agreement. If you are one of those people, the business is your first point of contact, and you can also contact us. Questions about this policy can be sent to support@kumry.com (attention: Privacy Officer).

The information we hold depends on how you use Kumry. It can include: Account details: your name, email address, phone number, business name, ABN or ACN, business address and password (stored only as a one-way hash). Sign-in and security records: your sign-in history (the time, IP address, device or browser, and whether the sign-in succeeded), the devices registered to your account, your two-factor methods (such as an authenticator app) and your recovery codes (stored only in a form that cannot be read back). Business records: transactions, invoices, bills, expenses, receipts, journals, chart of accounts, GST and BAS figures, and the records of who created or approved them. Customers' and suppliers' details: the names, email addresses, phone numbers, addresses, ABNs and bank details for payment that a business records for its contacts. Employees' payroll records: if a business records or imports payroll information, this can include employees' names, contact details, pay, superannuation details, bank details and tax file numbers. We handle tax file numbers as set out in section 5. Customer portal users: if a business invites its customer to the customer portal, we hold that person's name and email address, the invoices and statements the business shares with them, and records of their sign-in links and sessions. Our customer portal privacy notice has more detail. Uploaded documents: receipts, invoices and other files you upload. Uploads are checked for viruses. Imported records: when you move your books from Xero or QuickBooks Online, we receive the records you choose to bring across, either through a connection you authorise or in export files you upload. These can include contacts, employees and transactions. Bank statements: the bank account details and transactions contained in statement files (CSV, OFX or QIF) that you upload. Billing details: your plan, billing contact and payment history. Card details are entered on our payment provider's pages and are not stored by Kumry. Support and feedback: what you tell us when you contact support or send feedback. Usage information: the pages and features you use, actions you take in the Service, and technical information such as your browser type and operating system, used to run, secure and fix the Service. Kumry does not collect data under the Consumer Data Right. If we later offer bank feeds under the Consumer Data Right, we will publish a separate CDR policy before collecting any CDR data.

We collect personal information: - From you, when you register, use the Service, upload files or contact us - From the business you work for or deal with, when it records your details in Kumry or invites you to it - From services you choose to connect, such as Xero or QuickBooks Online - From our payment provider, about the status of payments - Automatically, when you sign in and use the Service If you do not give us information we need, such as an email address, we may not be able to provide the Service to you.

We use personal information to: - Provide and run the Service, including reports, GST and BAS figures, imports and the customer portal - Create and manage accounts, process payments and give support - Keep the Service and your account secure, including detecting fraud and unusual sign-ins - Fix problems and improve the Service - Send you service, security and billing messages - Send marketing emails, only if you have agreed to receive them (see section 6) - Meet our legal obligations, including tax record-keeping, and respond to lawful requests from authorities We do not sell personal information. We use it only for the purposes in this policy, related purposes you would reasonably expect, or purposes you have agreed to.

If a business records or imports its employees' tax file numbers, we collect, store, use and disclose them only as allowed by tax law and the Privacy (Tax File Number) Rule 2015. That means only for the business's tax, payroll and superannuation obligations. We do not use tax file numbers to identify people for any other purpose or to match records, and access to them is limited to people who need it for those purposes. When a tax file number is no longer needed for those purposes, it is destroyed or de-identified.

We send marketing emails, such as product news and offers, only if you have agreed to receive them. You can give that consent when you sign up, and you can change your mind at any time. Every marketing email has an unsubscribe link. You can also change your email preferences in your account settings. Service, security and billing messages are not marketing. We send them while you have an account because you need them to use the Service safely.

We share personal information only: - With our service providers, who handle it for us and only on our instructions (see section 8 and our sub-processors list at /legal/subprocessors) - With people you or your business give access to, such as other team members, your accountant or bookkeeper, or a customer you invite to the customer portal - With a service you choose to connect, such as Xero or QuickBooks Online, as needed for that connection - Where the law requires or allows it, for example to the Australian Taxation Office or under a court order - To a buyer of all or part of our business, in which case we will tell you before your information becomes subject to a different privacy policy - With your consent We may share de-identified, aggregated information that cannot reasonably be used to identify anyone.

Your data is stored on infrastructure we operate in Australia. Suggested categories and Kumry's in-app assistant also run on that infrastructure. Some providers receive limited information and may handle it outside Australia: - Stripe (payments and billing): your billing name, email address and payment details. United States and other countries where Stripe operates. - Anthropic (learning the layout of a new import file): column headings, Xero's own wording and the shape of rows with every value masked. Never amounts, names in rows or bank details. United States. - Receipt scanning (not switched on today): if you use receipt scanning, the image is sent to OpenAI or Anthropic in the United States to read it. - Xero (New Zealand) and Intuit (United States): only when you connect them. They receive your authorisation and our requests for your records. Emails from Kumry are sent from our own mail servers in Australia. When we disclose personal information overseas, we take the steps required by Australian Privacy Principle 8 to make sure the recipient handles it in line with the APPs. The current list, with what each provider receives and where, is at /legal/subprocessors.

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. These include: - Encrypted connections (HTTPS) between your browser and the Service - Passwords stored only as one-way hashes, and multi-factor authentication, which organisation owners can require for their team - Keeping each organisation's data separate, with role-based permissions inside each organisation - Logging of sign-ins and other security events, and a notice when a new device signs in to your account - Restricted staff access, and secrets held in a dedicated secrets-management system No system is completely secure. If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires. Our Security Policy has more detail.

We keep personal information only as long as we need it for the purposes in this policy or to meet the law. Then we delete or de-identify it. - Your account details: while your account exists. If you delete your account, there is a 7-day cooling-off period in which you can cancel. After that, your sign-in details, registered devices, two-factor methods and contact details are destroyed, and your name and email address are removed. An anonymous user ID stays on the business records you created, because they belong to the business. - Sign-in history (time, IP address, device and result): while your account exists, then 12 months after you delete it. During those 12 months it is used only for security and fraud checks, and then it is deleted automatically. - Business records, including invoices, transactions and payroll records: at least 5 years, and longer where tax law requires. - Import files you upload, and the raw data received from Xero or QuickBooks Online during an import: 90 days, then deleted. The records created from them are kept as business records. - After a business's subscription ends: its data stays readable and exportable for 7 years, then is deleted from live systems. The business can ask us to delete it sooner. - Billing records: as long as tax law requires, at least 5 years. - Backups: copies in backups are removed as those backups expire, after 35 days.

We set only strictly necessary cookies, to sign you in and keep you signed in. We do not load analytics, and we do not use advertising cookies, tracking pixels or cross-site tracking. Some preferences, such as light or dark appearance, are kept in your own browser's storage. Our Cookie Policy at /legal/cookies lists every cookie and stored item.

You can ask for access to the personal information we hold about you, and ask us to correct it if it is wrong, out of date or incomplete. You can update most account details yourself in your account settings. We will check your identity before we respond, and we will respond within 30 days. We do not charge for a request. If we refuse a request, we will tell you why in writing and how to complain. If the information is held for a business that uses Kumry (for example, you are its employee or customer), we may pass your request to that business, or ask you to contact it, because it controls those records. You can also ask us to delete personal information. We will do so unless we, or the business that holds it, must keep it by law.

If you think we have mishandled your personal information, please email support@kumry.com (attention: Privacy Officer) and tell us what happened. We will acknowledge your complaint within 5 business days and give you a response within 30 days. If we need longer, we will tell you why and when to expect it. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC): Website: www.oaic.gov.au Phone: 1300 363 992

The Service is not intended for people under 18, and we do not knowingly collect personal information from them for their own accounts. If we learn that we have, we will delete it. If you are a parent or guardian and believe your child has given us personal information, contact support@kumry.com (attention: Privacy Officer).

When you connect a third-party service, such as Xero or QuickBooks Online, or pay through Stripe, that service's own privacy policy also applies to what it does with your information. Please read their policies. Links to other websites are provided for convenience. This policy does not apply to those websites.

We may update this policy when our practices or the law change. For important changes, we will email account owners at least 30 days before the change takes effect and show a notice in the Service. We will always update the date at the top of this page.

Privacy Officer PMOAid Pty Ltd (ABN 88 654 942 757) trading as Kumry Level 7, 90 Phillip Street, Parramatta NSW 2150, Australia Email: support@kumry.com (attention: Privacy Officer) Website: https://kumry.com Office of the Australian Information Commissioner (OAIC): Website: www.oaic.gov.au Phone: 1300 363 992