Privacy Policy

Kumry Finance AI Pty Ltd ("Kumry", "we", "our", or "us") is committed to protecting your privacy and the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our accounting and financial management platform ("the Service"). We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you have questions about this policy, you can contact our Privacy Officer at support@kumry.com.

Depending on the features and integrations enabled for your organisation, we may collect and process the following categories of information: Account Information: When you register, we collect your name, email address, phone number, business name, ABN/ACN, business address, and account credentials. Financial Data: Financial transactions, bank-account details supplied by an enabled feed, invoices, receipts, expenses, tax information and chart-of-accounts data. Usage Data: We automatically collect information about how you interact with the Service, including pages visited, features used, actions taken, timestamps, IP addresses, browser type, device information, and operating system. AI Processing Data: Transaction descriptions, categorisation decisions and correction patterns used by AI features you choose to enable. Communication Data: We collect information you provide when contacting our support team, submitting feedback, or participating in surveys. Third-Party Data: Data received from a service that an authorised user explicitly connects to the Service, such as a bank-data feed or another accounting system you import from. Bank data received through the Consumer Data Right is collected only with the consent you give for that connection and is used only for the purposes you consented to.

We use the information we collect for the following purposes: Service Delivery: To provide, operate, and maintain the accounting platform, including processing transactions, generating reports, preparing tax documents, and delivering AI-powered categorisation. Account Management: To create and manage your account, process subscription payments, communicate about your account status, and provide customer support. Security and Integrity: To verify ledger integrity through integrity verification, generate digital signatures, maintain audit capsules, detect and prevent fraud, and protect against unauthorised access. Service Improvement: To analyse usage patterns, improve AI categorisation accuracy, develop new features, optimise performance, and fix issues. Legal Obligations: To meet legal obligations that apply to Kumry, including record-keeping obligations under Australian tax law, and to respond to lawful requests from authorities. Communication: To send you service notifications, security alerts, billing information, product updates, and marketing communications (with your consent). We do not sell your personal information. We use your information only for the purposes described in this policy, purposes related to them that you would reasonably expect, or purposes you have consented to.

We may share your information in the following circumstances: Service Providers: We use trusted service providers to help us operate the Service (for example, hosting, payment processing, email delivery and bank-data connections). They may process only the information required for the service they provide to us, and only on our instructions. Legal Requirements: We may disclose your information if required by law, regulation, legal process, or governmental request, including responses to subpoenas, court orders, or requests from the Australian Taxation Office (ATO). Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. We will notify you of any such change and any choices you may have regarding your information. With Your Consent: We may share your information with third parties when you explicitly authorise us to do so, such as when you grant access to your accountant or tax agent through the Service. Aggregated Data: We may share aggregated, de-identified data that cannot reasonably be used to identify you for research, industry benchmarking, or statistical purposes.

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Our measures include: Encryption in Transit: Connections between your browser and the Service use encrypted transport (HTTPS). Integrity Records: Certificates and audit capsules can bind specific records and reports to signed commitments. Each certificate or capsule covers only the records and scope it states. Authentication: Sign-in is protected by passwords and supports multi-factor authentication, which organisation owners can require for their team. Tenant Isolation and Access Controls: Each organisation's data is kept separate from other organisations' data, and role-based permissions control what each user within an organisation can see and do. Audit Logging: We record defined security and product events, such as sign-ins and changes to important records, for operational and investigation purposes. No method of transmission or storage is completely secure. If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

We keep personal information only for as long as it is needed for the purposes described in this policy and to meet our legal obligations, including record-keeping obligations under Australian tax law. When information is no longer needed, we take reasonable steps to delete or de-identify it. Copies held in backups are removed as those backups expire. Different categories of information may be kept for different periods depending on why they were collected and the obligations that apply to them.

Under the Australian Privacy Act and the Australian Privacy Principles, you have the following rights regarding your personal information: Access: You may request access to the personal information we hold about you. We will verify your identity before responding and will respond within a reasonable period. Correction: You have the right to request correction of inaccurate, incomplete, or outdated personal information. You can update most information directly through your account settings. Deletion: You may request deletion of your personal information, subject to our legal retention obligations. Financial records required by Australian tax law may not be deleted during the mandatory retention period. Data Export: You can export your organisation's data from the Service while your account is active. Opt-Out: You can opt out of marketing communications at any time by clicking the unsubscribe link in our emails or adjusting your notification preferences in account settings. Complaint: If you believe we have breached your privacy rights, you may lodge a complaint with us or with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au. To exercise any of these rights, please contact our Privacy Officer at support@kumry.com.

We use cookies and similar tracking technologies to enhance your experience with the Service: Essential Cookies: Required for the Service to function, including authentication tokens, session management, and security features. These cannot be disabled. Functional Cookies: Remember your preferences, such as language settings, theme selection (dark/light mode), and dashboard configurations. Analytics Cookies: Help us understand how you use the Service, which features are most popular, and where users encounter issues. We use privacy-respecting analytics that do not share data with advertising networks. We do not use advertising cookies or tracking pixels. We do not participate in cross-site tracking or interest-based advertising. You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent the Service from functioning correctly.

Some of our service providers may store or process information outside Australia. Circumstances in which personal information may be disclosed overseas include: - Where a third-party service provider operates infrastructure in another country - Where required by international legal obligations - Where you explicitly authorise the transfer (e.g., sharing data with an overseas accountant) Where we disclose personal information to an overseas recipient, we take reasonable steps, as required by APP 8, to ensure the recipient handles it in a manner consistent with the Australian Privacy Principles.

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you are a parent or guardian and believe that your child has provided personal information to us, please contact our Privacy Officer at support@kumry.com.

The Service may contain links to third-party websites, applications, or services that are not operated by us. This Privacy Policy does not apply to those third-party services. When you connect third-party services (such as bank feeds or payment processors), the data shared with those services is also governed by their respective privacy policies. We encourage you to review the privacy policies of any third-party services you connect to your account. We are not responsible for the privacy practices of third-party services and make no representations about their data handling practices.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated to you via: - Email notification to the address associated with your account - A prominent notice within the Service at least 30 days before the changes take effect - An updated "Last Updated" date at the top of this Privacy Policy Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated Privacy Policy. If you do not agree with the changes, you should stop using the Service and close your account. We encourage you to periodically review this Privacy Policy to stay informed about how we protect your information.

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us: Privacy Officer Kumry Finance AI Pty Ltd Sydney, NSW, Australia Email: support@kumry.com General enquiries: support@kumry.com Website: https://kumry.com For complaints, you may also contact the Office of the Australian Information Commissioner (OAIC): Website: www.oaic.gov.au Phone: 1300 363 992 Email: enquiries@oaic.gov.au