Legal

Privacy policy

Version 1.0 · Effective 21 August 2026

Pacioli Bear Pty Ltd trading as Genvice (ACN 642 692 475) (Genvice, we, us, our) respects your privacy. This policy explains what personal information we collect, how we use and protect it, and how you can access, correct or complain about it.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Privacy contact: privacy@genvice.com Postal address: 80/42 Paul Coe Crescent, Ngunnawal ACT 2913

1. Who this policy is for, and an important distinction

Genvice is an advisory analytics platform used by Australian bookkeeping and BAS agent practices. That creates two different relationships, and this policy treats them differently.

(a) Practices and their staff — you are our customer. If you work at a practice that uses Genvice, we handle your personal information directly: your name, work contact details, login credentials and, where applicable, billing information. For this information we are the entity responsible under the Privacy Act.

(b) Your end clients — we act on your practice's instructions. When a practice connects a client's Xero or QuickBooks Online organisation, Genvice accesses that client's accounting data. We access, store and process that data under the practice's authorisation and on the practice's instructions. We do not use it for our own purposes, and we have no direct relationship with the end client.

The practice is responsible for having the necessary authority. Under clause 6(h) of our Terms, each practice warrants that it holds all necessary authority, consents and authorisations from every end client whose data it connects, that its engagement terms with that client permit disclosure to third-party software providers, and that it has made any disclosures and obtained any consents required under the Privacy Act.

If you are an end client of a bookkeeping practice and have a question about how your data is handled, please contact your bookkeeper in the first instance. You may also contact us at privacy@genvice.com and we will work with your practice to assist.

2. Personal information we collect

2.1 Practice account information

Name and job title
Business email address and phone number
Practice name, ABN and business address
Login credentials and authentication data (managed by our authentication provider)
Billing and payment details, where a paid subscription applies (processed by a third-party payment provider; we do not store full card numbers)
Records of your communications with us, including support enquiries and feedback

2.2 End-client accounting data

Accessed from connected Xero or QuickBooks Online organisations under the practice's authorisation. This is financial and business data and may include personal information about individuals — for example, the names of sole traders, individual customers or suppliers appearing in a ledger.

2.3 Technical and usage information

IP address, browser type, device type and operating system
Pages accessed, features used and timestamps
Server logs and error reports

2.4 Feedback

Ratings, flags, comments, survey responses, edits you make to draft reports, and notes from feedback calls.

2.5 Sensitive information

We do not seek sensitive information as defined in the Privacy Act — information about health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, or biometric data. Please do not upload it. If it reaches us incidentally within accounting data, we handle it in accordance with this policy and the APPs.

3. What we request from Xero and QuickBooks Online

We connect to accounting platforms using OAuth 2.0. You authorise the connection, and you can revoke it at any time from within Xero or QuickBooks Online, or by disconnecting the client in Genvice.

We request read-only access to accounting data. We do not request any payroll scope.

This means we do not ask for access to employee records, wages, superannuation or leave data. Genvice cannot write to, alter or delete anything in your clients' accounting files.

The scopes we request are limited to what is needed to produce advisory analysis — financial reports, invoices, bank transactions and accounts. The full list is available on request.

4. How we collect personal information

Almost always directly from you: when you apply for access, create an account, connect a client, use the platform, or contact us.

We also collect:

Accounting data from Xero or QuickBooks Online, after you authorise the connection
Authentication data through our identity provider when you sign in
Technical information automatically through server logs and essential cookies

We do not buy personal information, and we do not collect it from credit reporting bodies, sanctions screening providers, or data brokers.

5. Why we use personal information

What we use it for	Why
Providing the Services — syncing data, generating advisory analysis and draft reports	To perform our contract with your practice
Creating and managing your account, and authenticating you	To perform our contract with your practice
Support, troubleshooting and responding to enquiries	To perform our contract; our legitimate business interests
Security, fraud prevention, and protecting the integrity of the platform	Our legitimate business interests; legal obligations
Billing and collecting fees, where a paid subscription applies	To perform our contract
Improving the Services — see section 7	Our legitimate business interests, subject to the limits in section 7
Sending service messages about outages, changes and security	To perform our contract; legal obligations
Marketing our own services to practices, with an unsubscribe option	Our legitimate business interests, subject to the Spam Act 2003 (Cth)
Meeting legal, regulatory and record-keeping obligations	Legal obligations

We do not use end-client accounting data for any purpose other than providing the Services to the practice that connected it, except as described in section 7.

6. Automated processing and AI-generated output

Genvice uses artificial intelligence to generate draft insights, reports and analysis from accounting data.

Every output is reviewed by a qualified human before it goes anywhere. Draft reports are produced for the practice, and the practice reviews, edits and approves them before they are delivered to any end client. Outputs are not financial product advice, tax advice or legal advice, and are not a substitute for professional judgement.

We do not make automated decisions that produce legal effects for individuals. Genvice does not assess creditworthiness, does not score individuals, and does not make decisions about anyone.

7. Using data to improve the Services

This section sets out exactly what we do and do not do with data to improve the Services.

(a) We do not use raw Xero or QuickBooks Online API data to train models. This reflects clause 19(d) of our Terms and our obligations to those platforms.

(b) We may use:

Processed-form outputs — the analytical work product Genvice itself produces
Feedback from bookkeepers — ratings, flags, corrections and suggestions, which are professional judgement rather than client data
De-identified, aggregated benchmarks — statistical patterns such as industry margin ranges, stripped of information identifying any practice or end client

(c) We do not sell personal information. We have never sold personal information and we do not disclose it to third parties for their own marketing purposes.

8. Third parties who help us run the Services

We use a small number of third-party providers in the following categories:

Cloud hosting and data storage
Authentication and identity management
AI processing (see section 9)
Payment processing
Email delivery
DNS and content delivery

We only allow a provider to handle personal information where we are satisfied it takes appropriate protective measures, and we impose contractual obligations restricting them to providing services to us.

If you have questions about how we handle your information, contact privacy@genvice.com.

We may also disclose personal information:

To law enforcement or regulators, where required or authorised by law
To professional advisers, under confidentiality
To a purchaser in connection with a sale or restructure of our business, under confidentiality

9. Where your information is stored, and what leaves Australia

9.1 Primary storage and processing

All Customer Data is stored and processed in Australia. Our production infrastructure runs in Google Cloud's Sydney region — compute, database and backups.

9.2 AI processing and the data that reaches it

Genvice's analysis runs in stages. Raw accounting data is processed within our Australian infrastructure. Only a deliberately narrow, derived set of information is passed to the AI provider that generates report narratives, enforced by a whitelist in our code:

What is passed: derived metrics and ratios, identifier-free descriptions of findings, benchmark bands, and opaque internal row identifiers.

What is never passed: entity names, ABNs, contact names, transaction memo or narration text, or raw ledger rows.

The narrative-generation step therefore does not receive information that identifies any practice, any end client, or any individual.

9.3 Information that is handled outside Australia

Some of the services supporting Genvice are operated by providers based outside Australia. The table below sets out what information this affects and where it goes.

Information	Purpose	Countries
Practice account and login information — your name, work email address and authentication records	Account creation, sign-in and identity management	United States
Contact details and email content — name, email address, and the messages we send you	Sending transactional and marketing email	United States
Website visitor information — IP address, browser and device type, pages viewed	Website analytics and advertising measurement (see section 15)	United States

Where we disclose personal information to an overseas recipient, we take reasonable steps under APP 8 to ensure the recipient handles it consistently with the Australian Privacy Principles, including through contractual obligations in our agreements with those providers.

9.4 The AI provider, and why it does not receive your data

The AI service that currently generates report narratives is operated by a provider located in China.

No personal information, and no end-client accounting data, is sent to that provider. As described in section 9.2, the only information passed to the narrative-generation step is derived and identifier-free: metrics, ratios, benchmark bands, opaque internal row identifiers, and descriptions of findings that contain no names, ABNs, contact details, memo or narration text, or ledger rows. This boundary is enforced by a whitelist in our code, not by policy alone.

Because no personal information is disclosed, this is not a cross-border disclosure of personal information for the purposes of APP 8. We describe it here exclusively for transparency reasons.

End-client accounting data is not disclosed overseas. Ledger data, contact records, entity names, ABNs and transaction detail are stored and processed exclusively in Australia.

9.5 This arrangement is interim

The current provider was selected for our early build and pilot phase. We intend to move narrative generation to an open-source model hosted on dedicated infrastructure we control in Australia, so that this step sits entirely within the same Australian boundary that already applies to the rest of the platform.

We are not setting a date for that change, and this policy describes how the platform works today rather than how we intend it to work in future. When the arrangement changes, we will update this section and notify registered users.

10. How long we keep information

We keep personal information while your practice holds an account and we are providing the Services.

After termination, Customer Data is retained for 30 days, during which you may export it in standard formats including CSV, Excel and PDF at no additional cost. After that period we securely and permanently delete it, unless we are legally required to retain it.

If you disconnect a client, we cease syncing that client's data. Data already held is deleted or de-identified in accordance with the above.

You are responsible for meeting your own practice and end-client record-keeping obligations before deletion. Australian practices typically carry multi-year record-keeping requirements, and a 30-day export window will not satisfy them on its own. Export what you need.

We retain account records, billing records and security logs for longer where required by law.

11. Keeping information secure

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Our measures include:

Encryption in transit using TLS, with HTTP Strict Transport Security enforced
Encryption of stored accounting-platform credentials
A database with no public network access
Access restricted to those with a genuine need, under confidentiality obligations
Logging and monitoring of system activity
Secrets held in a managed secrets service, pinned to Australian storage

No system is perfectly secure, and we cannot guarantee the security of information transmitted over the internet.

Support access to your account

We may occasionally need to access your account directly to diagnose a technical issue. We will seek your agreement before doing so, except where you have asked us to investigate something urgently. Any such access is logged, we access only what is necessary, and we do not use it to review your client work. You may ask us for a record of when we accessed your account and why.

12. Data breaches

We have procedures for identifying, containing and assessing suspected data breaches.

If a breach occurs that is likely to result in serious harm to any individual whose information we hold, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth).

Where a breach affects end-client data, we will notify the practice that connected it, so the practice can meet its own obligations to its clients.

13. Accessing and correcting your information

Under APP 12 you may request access to the personal information we hold about you, and under APP 13 you may ask us to correct it.

Email privacy@genvice.com. We will:

Respond within a reasonable period, ordinarily 30 days
Provide access in a usable format, at no charge (we may charge a reasonable fee for a substantial request, and will tell you before proceeding)
Explain our reasons in writing if we refuse, and tell you how to complain

Verifying your identity. We will ask enough to be reasonably satisfied you are who you say you are — ordinarily confirming from your registered account email is sufficient. We will not ask for identity documents unless the request genuinely warrants it, and we will not retain them for any other purpose.

Requests about end-client data. Where the request concerns data belonging to a practice's client, we will refer it to that practice, which holds the client relationship and is responsible for responding.

14. Marketing and electronic messages

We may send you information about our services. Every commercial electronic message we send identifies us and includes a working unsubscribe facility, as required by the Spam Act 2003 (Cth).

You can unsubscribe using the link in any message, or by emailing privacy@genvice.com. Service messages — outages, security notices, changes to terms — are not marketing and will continue.

We never sell or rent your contact details, and we do not send marketing on behalf of third parties.

15. Cookies and similar technologies

Essential cookies

We use cookies that are strictly necessary for the platform to work: keeping you signed in, maintaining your session, and security. You can block cookies in your browser, but parts of the platform will stop working.

Analytics and advertising technologies

On our public marketing website we also use the following third-party technologies, which set cookies and collect information about your visit:

Technology	Provider	What it does
Google Analytics 4	Google LLC	Measures how visitors find and use our website — pages viewed, time on page, referral source, approximate location
Google Ads tags	Google LLC	Measures the effectiveness of our advertising, and allows us to show ads to people who have visited our website
Meta Pixel	Meta Platforms, Inc.	Measures the effectiveness of our advertising on Facebook and Instagram, and allows us to show ads to people who have visited our website

These technologies collect your IP address, browser and device type, pages viewed and actions taken on our website. Google and Meta may combine this information with data they already hold about you.

Google and Meta are based in the United States, and information collected by these technologies is processed overseas. See section 9.3.

Your choices

You can:

Block or delete cookies in your browser settings
Opt out of Google Analytics using Google's browser add-on at tools.google.com/dlpage/gaoptout
Adjust your Google advertising settings at myadcenter.google.com
Adjust your Meta advertising settings in your Facebook or Instagram account

Blocking these technologies does not affect your ability to use Genvice.

16. Anonymity

You may deal with us anonymously or under a pseudonym for general enquiries. You cannot use the Genvice platform anonymously, because we need to identify practice users to secure accounts and meet our obligations.

17. Complaints

If you think we have mishandled your personal information or breached the APPs, please tell us first at privacy@genvice.com. We will acknowledge your complaint promptly and respond within 30 days.

If you are not satisfied with our response, you may complain to the:

Office of the Australian Information Commissioner Website: oaic.gov.au Phone: 1300 363 992 Post: GPO Box 5218, Sydney NSW 2001

18. Changes to this policy

We may update this policy. The version number and effective date at the top show when it last changed.

Where changes are material, we will notify registered users by email before they take effect, and post the updated version here.

19. Contact us

Privacy enquiries: privacy@genvice.com General enquiries: genvice.com/contact

Pacioli Bear Pty Ltd t/as Genvice ACN 642 692 475 Canberra, Australian Capital Territory, Australia

If you would like this policy in another format, contact us and we will help.