Privacy

Divergence Holdings Pty Ltd (ABN 14 670 554 748), trading as Small Biz Systems, at steve@smallbizsystems.com.au. Cashboard is an Australian service and we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

• Your account: email address, the display name you choose, and the secret behind your two-factor codes.
• Your books: the transactions extracted from statements you upload (date, description, amount, GST), the categories, rules and tags you create, and any balances you enter under Wealth.
• Operational records: which files you imported and when, so an import can be undone.

We do not ask for, and have no use for, your bank login, your address, your date of birth or your tax file number. Do not put them in.

When you upload a CSV or PDF it is parsed in memory and discarded. The file itself is never written to storage. Only the extracted transactions are saved.

Card numbers are removed before anything is stored. Any run of 13 to 19 digits that passes a Luhn check is masked to its last four digits, and if a full card number somehow survives that pass the upload is rejected outright rather than saved.

Cashboard recognises some bank formats on its own. Those uploads never leave our systems. For anything it does not recognise, it asks Anthropic’s Claude API for help, and the amount sent differs by file type:

• An unfamiliar CSV: the first 12 lines only, enough to work out which column is the date, the description and the amount. The layout is then remembered, so the same bank is never sent again.
• A PDF: the full text of the statement, because a PDF has no fixed layout to learn. Each PDF is processed fresh.

Card numbers are masked before either call. Anthropic processes the text to return the transactions and does not use API content to train its models. If you would rather no statement text left our systems at all, send CSVs from a bank we already recognise, or ask us and we will tell you whether yours is supported.

We use a small number of providers to run the service. None of them receive your data for their own purposes, and we do not sell or share it with anyone for advertising.

The application runs in Vercel’s Sydney region. The database is hosted by Supabase in Sydney. Some providers may process data outside Australia.

Where an account is on a paid plan, payment is collected by a third-party payment provider (Stripe). You enter your card or bank details with them, not with us, and we never see or store full card or bank account numbers. We hold only what we need to know whether an account is paid up.

Accounts with no fee involve no payment information at all.

Access is enforced by the database itself, not just by the application: you can read a set of books only if you are a member of that workspace. Two-factor authentication is required on every account, so a stolen password is not enough on its own.

There are no analytics, advertising or tracking services in Cashboard. The only cookies are the ones that keep you signed in. Your theme choice and a few dismissed prompts are stored in your browser, not on our servers.

Both are self-service and immediate, under Settings:

• Export: your transactions as CSV, or the complete contents of a workspace as JSON.
• Delete: closing your account removes your login, your two-factor enrolment and every workspace in it, unless somebody else is still a member of that account, in which case their books remain and only your access is removed.

Deletion is immediate and cannot be undone, so export first if you want a copy. Backups held by our hosting providers may retain residual copies for a short period before they age out. Otherwise we keep your data for as long as your account exists.

If a breach occurs that is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

You can ask for a copy of what we hold, ask us to correct it, or complain about how we have handled it, by emailing steve@smallbizsystems.com.au. If we cannot resolve it, you can escalate to the OAIC.