Privacy Policy – Fetch Workpapers

Last Updated: 25 February 2026

Fetch Workpapers ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, store, and safeguard personal information when you visit our website (https://app.fetchhq.net/), use our Excel add-in, or use our Software-as-a-Service (SaaS) platform (collectively, the "Service").

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By using the Service, you acknowledge this Privacy Policy.

1. Introduction (Our Commitment to Privacy)

We take privacy seriously and aim to be transparent about how we handle information, particularly because our users are accountants and our Service may process financial data synced from accounting systems (such as Xero) and structured into Excel workpapers.

Where we handle information that identifies an individual, or could reasonably identify an individual, we treat it as personal information and handle it in line with this Privacy Policy and applicable law.

2. Information We Collect

We collect personal information that is reasonably necessary for our functions and activities, including to provide and improve the Service.

2.1 Personal Information (Account and Contact Details):

Name, professional title, and firm name.
Contact details, such as email address and phone number.
User credentials and authentication information (for example, password hashes and account access tokens).
Billing and payment-related information (processed via secure third-party payment providers; we do not store full payment card details).

2.2 Account, Workpaper and Integration Data (Including Xero Sync Data):
Depending on how you use the Service and what you authorise, we may collect or receive:

Data retrieved from your Xero organisation(s), including (where authorised) trial balances, chart of accounts, account balances, and other ledger-related data required for syncing and traceability.
User activity relating to sync events, refresh actions.

2.3 Technical, Device and Usage Information:

IP address, approximate location (derived from IP), browser type, device identifiers, operating system, and language settings.
Logs and diagnostic data relating to your use of the Service (including performance logs, error reports, crash logs, and feature usage analytics for the Excel add-in and the web platform).

2.4 Cookies and Similar Technologies:
We may use cookies and similar technologies (for example, local storage and pixels) on our website and within the Service to:

keep you signed in (where applicable);
remember preferences;
understand usage and improve performance; and
measure marketing and website effectiveness (where used).

3. How We Collect Information

We collect information through the following methods:

Direct Interaction: when you create an account, subscribe to a plan, configure settings, import content, or contact support.
Third-Party Integrations (e.g., Xero): when you authorise Fetch Workpapers to connect to third-party services (such as Xero) via OAuth or similar mechanisms. We only access the data scopes you authorise and which are required to provide the integration functions.
Automated Technologies: through cookies, server logs, and similar tracking technologies that collect technical and usage information as you interact with our website, add-in and platform.

4. Why We Collect, Hold, Use and Disclose Information (Purposes)

We collect, hold, use and disclose personal information for purposes including:

Service delivery and operations: to provide, operate, maintain and support the Service, including syncing Xero trial balances and other authorised data into Excel, creating and updating workpapers, and maintaining traceability links between source data and workpapers.
Account management and administration: to manage accounts, user access, subscriptions, billing, payments, and customer support requests.
Communication: to send service-related communications (for example, onboarding, feature changes, security notices, downtime notifications, and administrative messages).
Product improvement and analytics: to monitor performance, troubleshoot issues, improve reliability, develop new features, and understand user workflows.
Security, fraud prevention and risk management: to protect the Service, our users, and Fetch Workpapers, including detecting suspicious activity and enforcing our terms.
Direct marketing: to tell you about features, updates, or services that may be relevant to you. You can opt out at any time (see Section 9). We comply with the Spam Act 2003 (Cth).

5. Disclosure of Information (Who We Share Information With)

We do not sell your personal information. We may disclose personal information to:

Third-party service providers (processors): providers who help us run our business and deliver the Service, such as:
- cloud hosting and infrastructure providers;
- payment processors (e.g., Stripe);
- email and communications tools;
- customer support tools; and
- analytics and monitoring services.
  These providers may process information on our behalf under contractual arrangements requiring appropriate privacy and security controls.
Integration partners you authorise: such as Xero, where you enable and use the integration. Any data shared with or accessed from these services is also subject to their own terms and privacy policies.
Professional advisers: such as our lawyers, accountants, auditors, insurers and bankers, where reasonably necessary.
Legal and regulatory disclosures: where we are required or authorised to do so by law, court order, subpoena, or to respond to a regulator or law enforcement request.
Business transfers: in connection with a proposed or actual merger, acquisition, financing, restructure, sale of business/assets, or insolvency transaction (subject to confidentiality protections where appropriate).

Overseas disclosures: Some of our third-party providers may store or process information outside Australia. Where this occurs, we take reasonable steps to ensure overseas recipients handle personal information in a manner consistent with the Privacy Act 1988 (Cth) (including APP 8), such as via contractual protections and vendor due diligence.

6. Data Storage and Security

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.

Security measures may include:

encryption in transit (for example, SSL/TLS);
encryption at rest (where supported/implemented for relevant systems);
secure cloud storage and hardened infrastructure;
access controls based on least privilege;
logging and monitoring to detect and respond to incidents; and
processes for vulnerability management and risk mitigation.

No method of transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your login details and for securing your own devices and networks.

7. Access and Control (Your Rights)

Under the Australian Privacy Principles, you may request:

Access: access to the personal information we hold about you.
Correction: correction of inaccurate, out-of-date, incomplete, irrelevant or misleading personal information.
Deletion: deletion of your account and associated personal information, subject to our legal and regulatory retention obligations and legitimate business needs (for example, billing, dispute resolution, and security logs).

To make a request, contact us using the details in Section 10. We may need to verify your identity before responding. We will respond within a reasonable time and in accordance with the Privacy Act 1988 (Cth).

8. Xero Data and API Usage

Fetch Workpapers may connect to Xero to sync authorised data into Excel workpapers and maintain traceability.

We do not store your Xero login credentials.
Access to Xero is maintained through secure authorisation tokens.
We only request and access the data scopes required for the sync and traceability functions you enable.
You can revoke our access to Xero at any time through your Xero account settings and/or by disconnecting the integration within the Service.

9. Cookies, Tracking and Direct Marketing

Cookies and tracking: Our website and Service may use cookies and similar technologies to enhance user experience, improve performance, and understand how features are used. You can control cookies through your browser settings. If you disable cookies, some parts of the Service may not function properly.

Direct marketing: Where permitted, we may send you product updates, newsletters and other marketing communications. All marketing messages will include a way to unsubscribe. We comply with the Spam Act 2003 (Cth) and will stop sending marketing messages when you opt out.

10. Australian Privacy Principles (APPs) and Compliance

This Privacy Policy is intended to reflect our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), including how we:

manage personal information transparently (APP 1);
collect personal information only where reasonably necessary (APP 3);
handle personal information for its primary purpose (and related secondary purposes where permitted) (APP 6);
take reasonable steps to keep personal information accurate, up to date and secure (APPs 10 and 11);
provide access and correction rights (APPs 12 and 13); and
manage overseas disclosures where applicable (APP 8).

11. Contact (Privacy Officer) and Complaints

If you have questions about this Privacy Policy, want to access/correct your personal information, or wish to make a privacy complaint, please contact our Privacy Officer:

Fetch Workpapers
Email: support@fetchhq.net
Website: https://app.fetchhq.net/

Please include enough detail for us to understand your request or complaint. We will respond within a reasonable timeframe (generally within 30 days).

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.a