Effective date: 2 November 2026
This Privacy Policy explains how Ezyiah collects, uses, stores, discloses and protects personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We are committed to managing personal information openly and transparently.
7.1 Information we collect
We may collect personal details (name, email, business name); account credentials; Team Member invitation, role and access information; financial and transactional data uploaded by users, including Client Data; Bank Feed Data accessed through Fiskil; AI Memory data; depreciation and fixed asset data; Business Records; details of Your Customers and Your Suppliers and their contacts, such as names, business names, email addresses, phone numbers, postal addresses, ABNs and transaction amounts; receipts, bills and invoices you upload; details of Business Owners and Invited Advisers connected to an account; product, service and inventory data; information used to generate Business Dashboard metrics and AI Insights; and usage data and technical logs, including IP addresses and timestamps. We do not sell personal information.
7.2 How we collect information
We collect information directly from you, your authorised Team Members and other users of your account, as you use the Services, from information you upload, create or import in Business Records, and, for Bank Feed Data, through Fiskil with the relevant consent under applicable banking data-sharing arrangements, including the Consumer Data Right. When Business Owners, Team Members or Invited Advisers add details of Your Customers, Your Suppliers or other people, including by bulk upload, we collect that information indirectly from them rather than from the individual concerned.
7.2A Personal information of our users' customers and suppliers
Where a Business Owner, accounting firm or other user adds personal information about its own customers, suppliers or clients to the Services, we handle that information on the user's behalf to provide the Services, as described in the Data Processing Addendum. The user is responsible for having collected it lawfully and for giving any notices required by the APPs (to the extent the Privacy Act applies to the user). If you are a customer or supplier of an Ezyiah user and have a question about your information, please contact that business first. If you contact us, we will, where appropriate, refer your request to the relevant user and assist them as reasonably required.
7.3 How we use information
We use information to provide, maintain, secure and improve the Services; to process reconciliations, bank feeds and reports, including BAS, profit and loss and depreciation schedules; to provide business-management functions such as quotes, invoices, bills, credit notes, purchase orders, customer and supplier records, products and services, inventory and Team Member access; to create, store and send Quotes and Invoices, from an Ezyiah email address on your behalf, to the recipients you nominate; to read receipts, bills and invoices and match them to transactions; to enable Business Owners, Team Members and Invited Advisers to work from the same records within the access granted; to generate Business Dashboard metrics, AI Insights, Cash Trends, Revenue Pipeline, Tax Position estimates, Profitability Charts and the Business Health Score; to improve categorisation through AI Memory, including firm-wide AI Memory that learns categorisation and coding patterns from the files of a firm's business clients to assist that firm; to communicate service and account updates; and to meet legal obligations. Some of these features may be released progressively, and this policy applies to each feature once it is made available. We use personal information for the primary purpose for which it was collected and for related purposes you would reasonably expect.
7.4 AI processing and automated handling
Uploaded, imported and generated data may be processed by AI systems and other computer programs to produce Output, including bank feed categorisation, AI Memory adjustments, automated reporting, AI Insights and dashboard indicators. AI processing may use Business Records, inventory information, bank data and other Customer Data available to the relevant account or workspace, subject to access controls. Output is generated programmatically and is not routinely reviewed by Ezyiah staff except where needed for support, security or legal reasons.
Ezyiah uses automated systems to assist with categorisation, reconciliation, calculations, reporting, summaries, anomaly detection, insights and indicators. Ezyiah does not intend those systems to independently approve lending, determine creditworthiness, make employment or insurance decisions, determine eligibility for a legal entitlement, lodge tax obligations, or otherwise make decisions intended to produce legal or similarly significant effects on an individual. Relevant professional, tax, commercial and business decisions remain subject to user review and responsibility. Where an automated feature is introduced that makes, or substantially and directly informs, a decision that could reasonably be expected to significantly affect an individual's rights or interests and uses personal information about that individual, Ezyiah will provide the transparency required by applicable privacy law. We do not use your Customer Data or Client Data to train generalised or foundational AI models.
Where an accounting firm uses firm-wide AI Memory, AI Memory learns patterns, such as categorisation and coding preferences and the accounts particular payees are usually coded to, from the files of that firm's business clients. These patterns may include payee names or transaction description text, and are used only to assist that firm across its own client files. They are not shared with other firms or businesses. The firm is responsible for having the authority and any consent required from its clients for this use. A business can stop its file contributing to a firm's AI Memory by revoking that firm's access in the Services, as described in section 4.5 of the AI Use and Disclosure Policy.
7.5 Disclosure
We may disclose personal information to service providers and infrastructure partners, including cloud hosting, Fiskil for bank feeds, AI infrastructure, email delivery and analytics providers, engaged under confidentiality and security obligations; to professional advisers; and to regulators, courts or authorities where required or authorised by law. We also disclose information as directed by users of the Services, for example to the recipients of Quotes and Invoices you send through the Services, and between a Business Owner, its Team Members and its Invited Advisers in accordance with the access the account administrator grants. We do not sell personal information.
7.6 Overseas disclosure
Some service providers may store or process information outside Australia, including in countries where our cloud and infrastructure providers operate. Where this occurs, we take reasonable steps to ensure recipients handle information consistently with the APPs.
7.7 Data security
We encrypt personal information in transit and at rest, apply role-based access controls and other technical and organisational measures, and follow industry-standard practices, as described in the Data Security and Information Handling Policy. Team Member access is governed by the roles and permissions available in the Services, but account administrators remain responsible for assigning and removing access appropriately. Despite these safeguards, no system is completely secure.
7.8 Data retention
We retain personal information only as long as needed to provide the Services or meet legal obligations, and then take reasonable steps to destroy or de-identify it, as described in the Record Retention and Deletion Policy. This includes Bank Feed Data, AI Memory data, depreciation records, Business Records, customer and supplier information, inventory records, dashboard-related data and Team Member access records.
7.9 Access and correction
You may request access to, or correction of, your personal information by contacting us. We will respond within a reasonable time, generally within 30 days, and may need to verify your identity. Some requests may be subject to exceptions permitted by law.
7.10 Direct marketing
Where we send marketing communications, you can opt out at any time using the unsubscribe function or by contacting us. Quotes, Invoices and other messages that users send to their own customers through the Services are sent on that user's behalf from an Ezyiah email address. They are the user's communications, not marketing from Ezyiah, and the user is responsible for their content and recipients.
7.11 Cookies and analytics
We use cookies and similar technologies as described in the Cookie Policy.
7.12 Complaints
If you have a privacy concern, contact us at support@ezyiah.com.au, marked for the attention of the Privacy Officer. We will acknowledge and investigate. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
7.13 Changes
We may update this Privacy Policy from time to time. Section 1.16 applies, and continued use of the Services constitutes acceptance of updates.
7.14 Contact
For privacy enquiries, contact support@ezyiah.com.au.