Privacy Policy

XIntelliSync AI Pty Ltd ("we," "our," or "us") collects information you provide directly to us when you create an account, use our Business Operating System, or contact us for support. We are committed to handling your personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

• Account information (name, email address, company details)
• Business data you upload for AI-powered analysis and automation
• Payment and billing information (processed securely through Stripe — we do not store card details)
• Usage data and analytics to improve our services
• Communication records when you contact our support team
• Technical data such as IP address, browser type, and device information

We use the information we collect for the following purposes, in accordance with the Australian Privacy Principles:

• Provide, maintain, and improve our Business Operating System services
• Process your business data through our proprietary AI-powered workforce to deliver insights and automation
• Process payments and manage your subscription through our secure payment processor (Stripe)
• Send you important technical notices, service updates, and security alerts
• Provide customer support and respond to your enquiries
• Comply with our legal obligations under Australian law
• Detect, prevent, and address technical issues or security threats

We do not sell, trade, or otherwise transfer your personal information to third parties except in the following circumstances:

• With your explicit consent
• To trusted service providers who assist in operating our platform under strict data processing agreements
• To comply with legal obligations, court orders, or regulatory requirements under Australian law
• To protect our rights, property, or safety, or that of our users or the public
• In connection with a business transfer, merger, or acquisition (with prior notice to affected users)

We implement industry-standard security measures to protect your information, including encryption in transit (TLS 1.3) and at rest (AES-256), secure access controls, regular security assessments, and comprehensive monitoring. We follow security best practices aligned with the Australian Cyber Security Centre (ACSC) Essential Eight framework.

We retain your personal information only as long as reasonably necessary to provide our services and fulfil the purposes outlined in this policy, or as required by Australian law. Business data is retained according to your subscription plan. Upon account termination, your data will be securely deleted within 90 days, unless retention is required for legal or regulatory compliance.

When your account is closed, we apply the following retention rules. Records retained beyond 90 days are kept solely to satisfy specific Australian legal obligations and are not used for any other purpose:

• Personal information under your user account (profile, invoices, expenses, customers, contacts, employees) — deleted within 90 days of account closure (APP 11.2(b)).
• Tax File Number-bearing payroll records — retained 7 years from last entry (Tax Administration Act 1953 Schedule 1 §382-5).
• Employment records — retained 7 years from the end of employment (Fair Work Act 2009 §535).
• Financial and audit records — retained 7 years from creation (Corporations Act 2001 §286).
• Records in organisations where other team members remain — user-identifying columns are de-identified; organisation rows are retained for those remaining members (APP 11.2(a) — reasonable steps for shared data).
• Files in cloud storage (documents, exports, receipts, avatars) — deleted within 90 days of account closure.
• Stripe billing history — Stripe retains records per their PCI DSS audit retention obligations; XIntelliSync removes its Stripe customer record on account deletion.
• IntelliX operational state (kernel, doctrine, internal telemetry) — not personal information about you; retained for platform integrity (APP 11.1 — outside the scope of personal-information retention).

Under the Australian Privacy Act 1988, you have the right to:

• Access the personal information we hold about you (APP 12)
• Receive one free copy of your personal information per quarter via Settings → Privacy → Export My Data (APP 12.6 — fee not excessive)
• Request correction of inaccurate or outdated personal information (APP 13)
• Opt out of direct marketing communications at any time
• Lodge a complaint with us or the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached
• Request deletion of your data (subject to the retention schedule in section 5b above)
• Export your business data in standard formats

XIntelliSync integrates with third-party services to enhance your experience. When you choose to connect these integrations, we access only the data necessary to provide the specific feature:

• Google Drive (auth/drive.file scope): When you connect Google Drive, XIntelliSync creates, reads, updates, and deletes only the files that this application itself creates in your Google Drive. We do not access any pre-existing files or folders. This data is used solely to save and retrieve your exported business reports and documents within XIntelliSync. We do not share this data with any third parties.
• Microsoft Outlook Calendar (optional): When connected, we create and manage calendar events for confirmed appointments only. No other calendar data is read.
• Google user data obtained via OAuth is never used for advertising, is never sold or shared with third parties, and is only used to provide the specific functionality you have requested within XIntelliSync.
• You may revoke any third-party integration at any time from the Integrations page within your XIntelliSync account. Revoking access immediately deactivates the connection.