Privacy Policy
Effective 11 September 2026
1. Introduction
1.1 This Privacy Policy explains how XBIT Corp Pty Ltd (ACN 682 428 128, ABN 20 682 428 128) of 39 John Street, Salisbury SA 5108 ("we", "us", "our"), which operates BASTrack, collects, holds, uses and discloses personal information.
1.2 It applies to the BASTrack application and to bastrack.com. BASTrack is provided for businesses carrying on an enterprise in Australia.
1.3 "Personal information" has the meaning given in the Privacy Act 1988 (Cth).
1.4 This Policy forms part of our Terms of Service. By using BASTrack you acknowledge that you have read it.
1.5 This Policy sets out:
(a) the kinds of personal information we collect and hold;
(b) how and when we collect it, and what happens if you do not provide it;
(c) the purposes for which we collect, hold, use and disclose it;
(d) the circumstances in which we are likely to disclose personal information to recipients outside Australia, and the countries in which those recipients are located;
(e) how you may access or correct the personal information we hold about you; and
(f) how you may complain about a breach of the Australian Privacy Principles, and how we will deal with that complaint.
2. Our approach
2.1 We handle personal information in accordance with the Australian Privacy Principles set out in the Privacy Act 1988 (Cth).
3. Information we collect
| Category | Information |
|---|---|
| Account information | Name, email address and profile photograph, obtained from your Google account |
| Entity information | Business name, ABN, GST registration status, reporting frequency, accounting basis, company tax rate and PAYG instalment amounts |
| Bank account information | Bank name, BSB, account number, account type and currency |
| Transaction records | Transaction dates, descriptions, amounts, currencies, GST status and amounts, categories, tags, line items and links between records |
| Attachments | Receipts and other documents you upload, and their contents |
| Your customers' information | Names, contact details, pricing, invoices and invoice line items relating to your own customers |
| Lodgment records | Period totals, due dates and lodgment status |
| Activity records | An append-only audit log recording the email address, name and role of the person taking each action, the action taken, the outcome, the IP address, the browser user agent, and a redacted record of the information submitted |
| Authentication information | Google account identifiers, authentication tokens and session records |
| Billing information | Name, email address, subscription status and payment history |
| Support communications | The content of messages you send us through in-application chat or by email |
3.2 Some of this information relates to you. Some relates to other individuals whose records you keep in BASTrack. Section 8 applies to the latter.
3.3 We do not seek sensitive information as defined in the Privacy Act 1988 (Cth). Please do not upload it. Where such information appears within an attachment you upload, we hold it as part of that attachment and handle it in accordance with this Policy.
4. Information we do not collect
4.1 Tax file numbers. BASTrack does not request a tax file number and provides no field in which to record one. Please do not send us a tax file number. If you do so inadvertently, notify us and we will delete it.
4.2 Payment card details. Card details are entered on pages hosted by our payment processor. We do not receive or store them.
4.3 Bank credentials. BASTrack does not connect to any financial institution. We do not request, receive or hold bank login credentials, and we cannot access your bank accounts.
4.4 Analytics and tracking information. We do not operate analytics, advertising or tracking technologies in the application or on our website.
5. If you do not provide information
5.1 You are not obliged to provide personal information to us. If you do not, we may be unable to provide BASTrack to you, administer your subscription, or respond to your enquiries, and the records BASTrack produces may be incomplete or inaccurate.
6. How we collect information
6.1 Directly from you, when you create an account, configure an entity or bank account, enter records, or contact us for support.
6.2 From files you upload, including CSV transaction files exported from your bank and documents you attach.
6.3 From Google, when you sign in. We receive your name, email address and profile photograph. Your name and photograph are synchronised from Google each time you sign in. We do not receive your Google password and cannot access other Google services on your account.
6.4 From our payment processor, which provides subscription and payment status.
6.5 Automatically, including your IP address, browser user agent and the actions you take, recorded in the audit log and in server logs.
6.6 From other members of your organisation, including your email address where you are invited to join an organisation before you hold an account.
6.7 Through connections you establish, as described in section 14.
7. Purposes of collection, use and disclosure
7.1 We collect, hold, use and disclose personal information to:
(a) provide the BASTrack service and perform our agreement with you;
(b) authenticate users and maintain the security of accounts;
(c) produce the calculations, reports and documents the service generates;
(d) administer subscriptions, process payments and maintain billing records;
(e) respond to support requests;
(f) diagnose faults, and maintain and improve the service;
(g) send transactional messages relating to your account;
(h) comply with our legal obligations and establish or defend legal claims.
7.2 We do not sell personal information. We do not disclose it to data brokers, advertising networks or list brokers, and we do not use it for advertising.
7.3 We do not use personal information to train artificial intelligence or machine learning models, and we do not provide it to others for that purpose.
8. Information about other individuals
8.1 BASTrack holds information about individuals who are not our users, including your customers, individuals identified in documents you upload, and the businesses whose records you maintain.
8.2 That information is held as your records. You determine what is collected, the purposes for which it is used, and how long it is retained. We store and process it on your behalf in accordance with our Terms of Service.
8.3 Under clause 22 of our Terms of Service, you warrant that you are entitled to provide that information to us, and you remain responsible for your own privacy obligations to the individuals concerned.
8.4 If you are an individual whose information is held in BASTrack by one of our customers, please direct any request for access, correction or deletion to that customer. They control those records. We are generally unable to identify which organisation holds information about a particular individual and do not search customer accounts on request.
8.5 If you are unable to resolve a request with that customer, you may contact us at support@bastrack.com and we will assist where we reasonably can, which may be limited to referring the request.
9. Aggregated information
9.1 Aggregated information is information about groups of users that does not identify any individual. We may use aggregated information to understand how BASTrack is used and to improve it.
9.2 Where aggregated information is combined with other information such that an individual can be identified, we treat it as personal information under this Policy.
10. Disclosure to service providers
10.1 We disclose personal information to service providers engaged to perform functions on our behalf, including application hosting and file storage, database services, payment processing, authentication, support chat and internal operational alerting. Each receives only the information required to perform its function.
10.2 We also disclose personal information:
(a) where you direct or authorise us to do so;
(b) to our professional advisers, insurers and auditors, in confidence;
(c) where required by law, or in response to a valid request from a regulator, court or law enforcement agency;
(d) where necessary to prevent a serious threat to life, health or safety, or to investigate suspected unlawful activity;
(e) in connection with a sale or transfer of our business, as described in section 23.
10.3 Some of these service providers are located outside Australia, including in the United States and France. Those recipients may not be subject to Australian privacy law. We take such steps as are reasonable in the circumstances to ensure that they handle personal information consistently with this Policy.
10.4 Where a change to our service providers materially affects the handling of personal information, we will notify you by email or within the application.
11. Where information is stored
11.1 Your records are stored in Australia.
11.2 Information held by service providers engaged by us is stored in the locations referred to in clause 10.3.
12. Security
12.1 We maintain safeguards appropriate to the nature of the information we hold, including:
(a) authentication through Google, so that we do not store account passwords;
(b) session expiry after three days of inactivity;
(c) role based access control within each organisation;
(d) encryption in transit, and encryption at rest provided by our hosting and database providers;
(e) capture of payment card details on our payment processor's hosted pages, so that card details do not reach our systems;
(f) an append-only audit log of actions that alter data.
12.2 No method of transmission or storage is entirely secure. We recommend that you secure your Google account with two-step verification and remove members from your organisation when they no longer require access.
13. Access by our personnel
13.1 Our personnel may access customer data only to diagnose or resolve a fault, to respond to a support request where access is necessary, to investigate a suspected security incident or breach of our Terms of Service, or where required by law.
13.2 Such access is recorded in our logs.
13.3 Our personnel will not ask you for your password. Please do not provide account credentials to us, or to any person claiming to represent us. Where you have shared credentials with any third party, change them.
14. Connected tools and AI assistants
14.1 We do not use artificial intelligence, machine learning or automated decision-making within BASTrack. Categorisation rules are created by you and applied as written. We do not use your data to train models, and we do not transmit your data to any AI service on our own initiative.
14.2 BASTrack provides interfaces, including a Model Context Protocol interface, that allow software you select to read and modify your data at your direction. No connection is active unless you establish it.
14.3 Where you establish a connection, you are disclosing your data to the software you have connected. That software is governed by its own terms and privacy policy, and not by this Policy. We do not control, and cannot observe, how it handles your data, including whether it retains that data or uses it to train models.
14.4 You are responsible for connections you establish, including where your records contain information about your clients or your customers. You may terminate a connection at any time.
14.5 If our own use of artificial intelligence changes, we will update this Policy and notify you before the change takes effect.
15. Third party websites
15.1 BASTrack and our website may contain links to websites operated by others. We do not control those websites and are not responsible for their content or for their handling of personal information. A link does not constitute an endorsement.
15.2 Those websites are governed by their own privacy policies. This Policy does not apply to them.
16. Cookies
16.1 We use cookies and browser storage only for:
(a) session cookies, which maintain your signed-in session and expire after three days of inactivity; and
(b) storage set by our support chat provider, so that a conversation persists between page loads.
16.2 We do not use advertising cookies, tracking pixels or third-party analytics.
16.3 As the only cookies we set are necessary to provide a service you have requested, we do not display a cookie consent banner. If we introduce analytics or advertising technologies, we will update this Policy.
16.4 You may block or delete cookies through your browser. If you block our session cookies you will be unable to remain signed in.
17. Electronic messages
17.1 Transactional messages relate to your account and are sent because you hold one. They include organisation invitations, security notices, receipts and tax invoices, renewal and failed payment notices, and notices of changes to this Policy or our Terms of Service. These messages are not marketing and cannot be unsubscribed from while you hold an account.
17.2 Marketing messages are sent only where you have separately consented to receive them. Consent to our Terms of Service is not consent to receive marketing.
17.3 Each marketing message identifies us, includes our contact details and contains a functional unsubscribe facility. Unsubscribe requests are actioned within five business days, in accordance with the Spam Act 2003 (Cth).
17.4 To change your marketing preferences, use the unsubscribe facility or contact support@bastrack.com.
18. Retention
18.1 Active accounts. We retain your records until you delete them or request their deletion.
18.2 Cancelled or lapsed subscriptions. Your organisation enters read-only mode. Records are retained and full export remains available for at least 12 months. After that period the organisation becomes dormant and access requires resubscription.
18.3 Dormant organisations. Records are retained for five years from the end of the last paid period and are then deleted. We will give at least 30 days' notice by email before deletion.
18.4 Audit logs. Retained for the life of the organisation, including records of members who have since been removed.
18.5 Backups. Recovery snapshots are retained for a short period and are then overwritten. We hold no longer-term backup.
18.6 Support communications. Retained until deleted. You may request deletion of a conversation.
18.7 Technical logs. Retained for a short period and not separately archived.
18.8 Billing records. Retained for at least five years, and for as long as required by taxation and corporations legislation.
19. Access and correction
19.1 A full export of your organisation's data is available at any time within the application, including while a subscription is lapsed. This is the primary means of obtaining the information we hold about your organisation.
19.2 Most information may be corrected by editing the relevant record. Your name and profile photograph are synchronised from Google and should be corrected there.
19.3 For information not available through export, or corrections you cannot make yourself, contact support@bastrack.com. We will respond as soon as reasonably practicable, and in any event within 30 days. We do not charge for making a request. Where a request requires substantial work, we may charge a reasonable fee for providing access and will advise you of that fee before proceeding.
19.4 We may require verification of your identity before acting on a request, and may decline a request where permitted by law, including where compliance would unreasonably affect the privacy of another person. Where we decline a request we will provide written reasons and information about how to complain.
19.5 We do not amend or delete audit log entries, including entries recording the email address, name and role of a person who has taken an action. Where you consider an entry to be inaccurate, we will record a statement to that effect alongside it.
20. Deletion
20.1 To request deletion of your organisation and its records, contact support@bastrack.com from an email address registered as an owner of that organisation.
20.2 We will confirm the request before acting on it, as deletion cannot be reversed, and will complete deletion within 30 days of confirmation. Export your data before requesting deletion.
20.3 The following are retained following deletion:
(a) records contained in recovery snapshots, until those snapshots are overwritten;
(b) audit log entries, as described in clause 19.5;
(c) billing records, as described in clause 18.8.
21. Data breaches
21.1 Where we become aware of unauthorised access to, unauthorised disclosure of, or loss of personal information we hold, we will promptly assess whether the incident is likely to result in serious harm.
21.2 Where we determine that it is, we will notify affected individuals and the Office of the Australian Information Commissioner as soon as reasonably practicable, and will advise what information was involved and what steps should be taken.
21.3 We follow the approach set out in the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth).
22. Complaints
22.1 Complaints concerning our handling of personal information should be directed to support@bastrack.com, or by post to 39 John Street, Salisbury SA 5108.
22.2 We will investigate your complaint and provide a written response as quickly as possible, usually within 30 days. Where an investigation requires longer, we will advise you of its progress.
22.3 If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:
- oaic.gov.au
- 1300 363 992
- GPO Box 5218, Sydney NSW 2001
22.4 Nothing in this Policy limits any right you have to bring proceedings for a serious invasion of privacy under the Privacy Act 1988 (Cth).
23. Sale or transfer of our business
23.1 Where we sell or transfer our business, or the BASTrack product, personal information may be transferred as part of that transaction. We will notify you before the transfer takes effect, and the acquirer will be required to handle personal information under a privacy policy no less protective than this one.
23.2 You may export your data and request deletion of your organisation before the transfer takes effect.
23.3 Information may be disclosed to a prospective acquirer in the course of due diligence, in confidence and limited to what is necessary.
24. Changes to this Policy
24.1 We may update this Policy from time to time. Each version carries an effective date, and earlier versions are available on request.
24.2 We will notify you by email or within the application before a change that materially affects our handling of personal information takes effect.
25. Contact
The Privacy Officer
XBIT Corp Pty Ltd
ACN 682 428 128 | ABN 20 682 428 128
39 John Street, Salisbury SA 5108
support@bastrack.com