Privacy Policy

Effective date: 22 October 2026  |  Report Craft is operated by DT Corp Pty Ltd (ABN available on request), Australia.

DT Corp Pty Ltd ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and disclose personal information when you use Report Craft ("the Service"). We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Information We Collect

We collect the following types of information:

• Account information - your name, email address, password (stored only as a one-way hash), an optional profile picture, and, if you turn on two-factor authentication, its secret and recovery codes (both encrypted). If you sign up or sign in with Xero or Intuit, we receive your name and email address from that platform.
• Firm information - your firm's name, ABN, ACN, addresses, director, tax agent number and tax file number, and any logo, signature or cover image you upload.
• Client details - for each client ledger, details such as the entity name, ABN, ACN, address, contact email and phone, and director or trustee names. Some of these are read from the connected accounting package; others you enter yourself.
• Trust beneficiaries - when you prepare trust resolutions, the beneficiaries' names, dates of birth, other details you enter and, if you choose to record them, their tax file numbers. See section 14.
• OAuth tokens - access and refresh tokens issued by QuickBooks Online, Xero or MYOB when you connect a client. We never receive or store your clients' accounting package passwords.
• Financial data - account names, codes, types and period balances fetched from the connected accounting package, or from a spreadsheet you import, and cached locally to generate reports. For QuickBooks Online and MYOB ledgers we also fetch the journal transactions for the reporting period, which include dates, descriptions and memos, and for QuickBooks Online the customer or supplier named on each entry and the QuickBooks user who created it.
• Content you create - notes, comments, report text, report packs, client plans, meeting notes, roadmap votes and suggestions, and any pictures you add to them.
• Client portal information - if you invite a client to the portal, their email address, the password they choose (stored only as a one-way hash), when they last visited, and any comments they leave. See section 13.
• Other people's email addresses you give us - colleagues you invite, recipients of scheduled report packs, and friends you refer.
• Billing information - your subscription plan and the identifiers Stripe gives us. Card details are entered directly with Stripe and never reach us.
• Usage and security data - IP addresses, browser type, pages visited, and actions taken within the Service, used for security and performance monitoring. Significant actions, such as signing in, connecting a ledger or changing a setting, are recorded in a security audit log with the user's email address and IP address.
• Website analytics - when you visit our public website without being signed in, Google Analytics records the pages you view. See section 7.
• Feedback - if you complete our feedback form when leaving, the name, email address, phone number and comments you give.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service.
• Generate financial reports on your behalf.
• Authenticate users and maintain account security, including two-factor authentication and checking that passwords have not appeared in a known data breach.
• Write changes you make in Report Craft back to the connected accounting package, when you ask us to.
• Verify ABNs and place your clients on a map, when you use those features.
• Send transactional emails (e.g. password resets, account notifications, client portal invitations, and report packs you have scheduled).
• Send occasional product news, which you can unsubscribe from at any time.
• Process subscription payments.
• Respond to support requests.
• Comply with legal obligations.

We do not use your clients' financial data for any purpose other than generating reports for you.

3. Disclosure of Information

We do not sell, rent, or trade your personal information. We may disclose information to:

• Service providers - third parties who assist us in operating the Service, bound by confidentiality obligations:
  • Stripe - processes subscription payments. We give Stripe your firm's name and an administrator's email address.
  • Fastmail - delivers the emails the Service sends.
  • Google Analytics - measures visits to our public website. It is not used once you are signed in.
  • Google Fonts - serves the typeface used inside the Service, so your browser sends Google your IP address when it loads a page.
  • Have I Been Pwned - checks whether a password has appeared in a known data breach. Only the first five characters of a one-way hash of the password are sent, never the password itself.
  • ipapi.co - gives us the approximate location of the IP address used to create a new account, for our internal sign-up alerts.
  • Australian Business Register - when we look up an ABN.
  • OpenStreetMap - converts client addresses into map positions and supplies the map pictures for the client map.
• Google reCAPTCHA - if a form is submitted faster or more often than a person usually would, or after repeated failed sign-ins, we ask you to complete a Google reCAPTCHA check before it is saved. Your browser then sends Google information such as your IP address and details of your browser and device, which Google uses under its Privacy Policy and Terms of Service. Nothing is sent to Google unless the check is shown.
• Third-party accounting platforms - QuickBooks Online, Xero and MYOB, to the extent necessary to fetch data on your behalf via OAuth and, for QuickBooks Online and Xero, to write back changes you ask us to make.
• People you choose - clients you invite to the portal, and anyone you send a report pack to.
• AI providers you have chosen and licensed - where you have switched on AI Analysis by entering your own OpenAI or Anthropic API key, report figures are sent to that provider under your own account. See section 15.
• Law enforcement or regulators - where required by law or to protect the rights, property, or safety of DT Corp Pty Ltd, our users, or others.

Some of these providers store or process information outside Australia, including in the United States and Europe.

Our own staff can access your firm's data where that is needed to provide support or keep the Service running. That access is recorded in the security audit log.

4. Data Storage and Security

Your data is stored on servers located in Australia. We use industry-standard security measures including encryption in transit (TLS) and at rest, access controls, and regular security reviews to protect your information from unauthorised access, disclosure, alteration, or destruction. OAuth tokens, tax file numbers, two-factor secrets and AI API keys are additionally encrypted field by field.

Every file you upload is scanned for viruses on our own servers before it is stored; uploads are not sent to an outside scanning service. Spreadsheets you import are read to build the ledger and are not kept.

Despite these measures, no method of transmission or storage is completely secure. We cannot guarantee absolute security.

5. Data Retention

We retain your account and financial data for as long as your account is active or as needed to provide the Service.

• Removing a client ledger deletes its cached financial data, its client portal and its client plans straight away. A ledger whose connection drops at the accounting package's end is kept, marked as disconnected, until you remove it or reconnect it.
• Closing your account permanently deletes your firm, its client ledgers, its reports and its user logins from the Service at midnight (Melbourne time) on the day you close it.
• Backups - copies held in our encrypted backups age out within 90 days.
• Security audit log - entries are kept after an account is closed, so that we can investigate security incidents and meet our compliance obligations. They hold the user's email address, IP address and the action taken, not financial data.

We retain information beyond this only where we are required to for legal or compliance purposes.

6. Your Rights

Under the Australian Privacy Principles you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or out-of-date information.
• Request deletion of your personal information, subject to legal obligations.
• Complain about a breach of the APPs.

To exercise any of these rights, contact us at support@reportcraft.com.au.

7. Cookies

The Service uses session cookies necessary for authentication and secure operation.

On our public website, visitors who are not signed in also receive Google Analytics cookies, which tell us how many people visit and which pages they read. They are not set once you are signed in, and they are not used for advertising. You can block them in your browser's settings or with Google's opt-out add-on.

We do not use advertising cookies.

8. Third-Party Links

The Service may contain links to third-party websites (e.g. QuickBooks, Xero, MYOB, Google Maps). We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

9. Children's Privacy

The Service is intended for use by accounting professionals and is not directed at children under 18. We do not knowingly collect personal information from children.

10. Changes to this Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via the Service. The effective date at the top of this page will be updated accordingly.

11. Complaints

If you believe we have breached the Australian Privacy Principles, please contact us first at support@reportcraft.com.au. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

12. Connected Accounting Platforms (QuickBooks Online, Xero & MYOB)

When you connect a client's accounting package, Report Craft acts on your behalf to read the financial data needed to generate reports. This section explains how we handle data accessed through Intuit QuickBooks Online, Xero and MYOB (MYOB Business and AccountRight).

• What we access - via OAuth 2.0 we read the chart of accounts (account names, codes, types and classifications), period balances (including debits, credits and totals), and the business's own details (name, ABN, address and contact details). For QuickBooks Online and MYOB we also read the period's journal transactions, so that reports can show the entries behind a balance. We request only the scopes required to provide the Service.
• What we change - when you edit an account or a client's details in Report Craft and choose to save the change to QuickBooks Online or Xero, we write that change back to the ledger. We do not write to a ledger for any other reason, and we never write to MYOB.
• What we never receive - we never receive or store your or your clients' QuickBooks Online, Xero or MYOB login credentials, including MYOB company file passwords. Authorisation is handled entirely by the platform through OAuth, and we hold only the access and refresh tokens issued to us.
• How it is stored - fetched financial data and OAuth tokens are cached on our servers in Australia, encrypted in transit (TLS) and at rest, and are accessible only to your authorised firm users and to the operations required to run the Service.
• How we use it - connected-platform data is used solely to generate the financial reports you request. We do not use it for advertising, we do not sell or rent it, and we do not share it with third parties except the service providers strictly necessary to operate the Service and, if you have switched on AI Analysis, the AI provider you have chosen and licensed (see section 15).
• Refresh and revocation - you may disconnect a client at any time, and you or your client may revoke Report Craft's access from within QuickBooks Online, Xero or MYOB (in my.MYOB, under Connected apps). Once access is revoked we can no longer fetch new data for that entity.
• Deletion - when you remove a client ledger, its cached financial data and its tokens are deleted straight away. For QuickBooks Online and Xero we also revoke the grant with the platform. MYOB provides no way for an app to revoke its own access, so for a MYOB ledger we delete our tokens and you should also remove Report Craft under Connected apps in my.MYOB. When you close your account, the same happens for every connected client at midnight (Melbourne time) that day. Copies held in our encrypted backups age out within 90 days, and we retain records beyond this only where we are required to for legal or compliance purposes.

Our use of information received from Intuit APIs adheres to the Intuit Developer platform requirements, our use of information received from Xero APIs adheres to the Xero Developer platform requirements, and our use of information received from MYOB APIs adheres to the MYOB Developer platform requirements.

13. Client Portal

You can invite a client to view their finalised reports through the client portal. The client receives a private link by email and may set a password of their own.

• What the client sees - only the years you have finalised for their own ledger, read-only, and the client plan you share with them.
• What we store about them - their email address, their password as a one-way hash, when the link was sent and last used, and any comments they leave on their client plan.
• Your controls - you can close the portal, issue a new link (which stops the old one working), or remove the portal altogether at any time.

You are responsible for making sure the email address you enter belongs to the client, and that the client is entitled to see the reports you share.

14. Tax File Numbers

The Service lets you record your firm's tax file number and the tax file numbers of trust beneficiaries. We handle them in line with the Privacy (Tax File Number) Rule 2015:

• Recording a tax file number is optional, and you should only record one where you are authorised to collect it for a taxation purpose.
• Tax file numbers are encrypted individually, are not printed on reports, and are not used or disclosed for any other purpose.
• They are deleted with the ledger or firm they belong to, as described in section 5.

15. AI Analysis (OpenAI & Anthropic)

Report Craft offers an optional AI Analysis feature that produces a written commentary on a client's figures. It is off unless you turn it on, and it runs on your own AI account, not ours - the request goes to your OpenAI or Anthropic account, and the commentary it returns is generated in that account, over a secure (encrypted, HTTPS) connection. Report Craft holds no AI provider account of its own, and nothing in this feature passes through one.

• You bring your own key - AI Analysis does nothing until an administrator of your firm enters an API key for their own licensed OpenAI or Anthropic account in Firm Settings. We do not provide, resell, or subsidise access to either provider, and firms that never enter a key never send anything to them.
• Your agreement, your controls - because the request is made with your key, it is governed by your own agreement with OpenAI or Anthropic. Whatever data-handling, retention and training terms you have negotiated or accepted with that provider are the terms that apply, which keeps the decision - and the privacy posture - in your hands rather than ours.
• What is sent, and how - when you generate an AI Analysis for a client, the account balances and totals for that client's reporting period are sent - over a secure, encrypted (HTTPS) connection, to your own provider account - so it can write the commentary. We send only what the commentary needs. We do not send your login credentials, your OAuth tokens, tax file numbers, or any other client's data.
• Which providers and models - OpenAI (GPT models) and Anthropic (Claude models). You choose which provider to use, and may set a preferred one; if both keys are present and your preferred provider is unavailable, the request falls back to the other.
• Your key - API keys you enter are encrypted at rest and are used only to make AI Analysis requests on your instruction. They are never shown back to other firms and are never used for any other purpose.
• Switching it off - remove the API key from Firm Settings and the feature stops immediately. No further data is sent to any AI provider.

Generated commentary is a drafting aid, not financial advice, and should be reviewed by a qualified accountant before it is relied on or given to a client.

16. Contact

Privacy enquiries can be directed to:
DT Corp Pty Ltd
support@reportcraft.com.au