Privacy Policy

Version 2.1 — Last updated: 15 October 2026 | Jurisdiction: Victoria, Australia

1. Introduction (APP 1 — Open and Transparent Management)

Anum Pty Ltd (ABN 80 697 129 525, ACN 697 129 525) ("Summed", "we", "us", "our") is committed to handling your personal information to the standard set by the thirteen Australian Privacy Principles ("APPs") in the Privacy Act 1988 (Cth) ("Privacy Act"). This Privacy Policy explains how we collect, use, disclose, and store your personal information when you use our cloud-based bookkeeping platform at summed.com.au ("Service").

Anum Pty Ltd is a small business operator under section 6D of the Privacy Act. At present, that means the Privacy Act does not require us to follow the APPs. We have chosen to apply them to your information anyway. The commitments in this policy form part of our agreement with you under clause 23 of our Terms of Service. If our legal position changes, we will update this policy. We keep this policy freely available, in line with APP 1, and update it whenever our information handling practices change.

Important — Financial Data: Summed holds financial records, business transaction data, staff wage information, and business identifiers such as ABNs. We treat all financial data entered into the Service as sensitive business information and apply additional safeguards to it.

2. Anonymity and Pseudonymity (APP 2)

Where practicable, we will give you the option of not identifying yourself, or of using a pseudonym, when dealing with us. However, due to the nature of the Service (financial record-keeping requiring accurate business and identity information), it is generally not practicable to use the Service anonymously or under a pseudonym. We require your real identity for account registration, payment processing, and to comply with our legal obligations, including those under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth).

You may contact us with general enquiries without identifying yourself.

3. Information We Collect (APP 3 — Collection of Solicited Personal Information)

We only collect personal information that is reasonably necessary for, or directly related to, one or more of our functions or activities — namely, providing the Service to you and operating our business (including understanding how customers find us). We collect personal information by lawful and fair means, and directly from you wherever possible.

3.1 Information You Provide

Data Type	Examples	Purpose
Account information	Name, email address, password	Account creation and authentication
Business information	Business name, ABN, GST registration status	Configuring your bookkeeping environment and reports
Financial records	Transactions, categories, amounts, dates	Core bookkeeping functionality
Staff information	Staff names, hourly rates, shift records	Wage management and reporting
Subscription payment information	Subscription plan selection (card details processed by Stripe)	Billing and subscription management
Bank details for your invoices	Bank account name, BSB, account number, PayID, and bank name that you enter so your own clients can pay you	Printing the "How to Pay" block on the invoices you create — these details appear on every invoice you send or share with a client
Uploaded files	Receipt images	Record-keeping and transaction documentation
Bank transaction data	Transaction dates, descriptions, amounts, and account references imported from bank-exported CSV files	Transaction import and bookkeeping — see Section 3.3
Marketing attribution	Your optional answer to "How did you hear about us?" at signup	Internal measurement of which marketing channels work — see Section 6

3.2 Information Collected Automatically

• Usage data: Pages visited, features used, and actions taken within the Service
• Technical data: IP address, browser type, device type, operating system
• Cookies: Session cookies for authentication and security (see Section 7)

3.3 Bank Transaction Data (CSV Import)

You may voluntarily upload bank transaction data in CSV format that you have exported from your own banking institution (such as CBA, ANZ, Westpac, NAB, Bendigo Bank, St George, ING, or Macquarie). When you use this feature, we collect transaction dates, descriptions, amounts, and account references contained in the uploaded CSV file.

Important — What we do NOT do:

• Summed does not access, connect to, or interface with any banking institution, payment system, or financial data aggregator directly
• Summed does not use Open Banking, the Consumer Data Right (CDR) under the Competition and Consumer (Consumer Data Right) Rules 2020, or any screen-scraping, credential-sharing, or automated data retrieval technology
• Summed does not request, store, or process your bank login credentials at any time
• The upload is initiated entirely by you, using a file you have already downloaded from your banking institution

How bank CSV data is processed: Uploaded CSV files are parsed in memory during the upload process for the purpose of extracting transaction records. The raw CSV files are not retained on our systems after processing is complete. Only the extracted transaction records (dates, descriptions, amounts, and account references) are stored and associated with your account. These records are held on AWS infrastructure in Sydney, Australia, which is encrypted at rest using AES-256 encryption managed through AWS Key Management Service (KMS). All data is encrypted in transit using TLS. Access to stored records is restricted by authenticated, role-scoped access controls.

Bank transaction data is collected and used for the primary purpose of providing the Service to you — specifically, to populate your transaction ledger and assist with bookkeeping and financial record-keeping.

We do not sell this data. We do not use it for credit assessment. We do not disclose it to any third party for that party's own purposes. The only third parties who handle it are the service providers listed in clause 8, who process it on our instructions and only to deliver the Service to you.

We also use it in two further ways, both of which you control:

• We use the dates on which you enter transactions to decide when to send you a summary of your own account.
• We include in those summaries totals calculated from your own records — for example, the amounts you have recorded as money in and money out over a period.

These summaries are described in clause 6. Every one of them carries a link that lets you change how often you receive them, or stop them. Apart from this, we do not build a profile of you, we do not use your transaction data for advertising, and we do not use it to decide what price or offers to show you.

4. Unsolicited Personal Information (APP 4)

If we receive personal information that we did not solicit, we will determine within a reasonable period whether we could have collected the information under APP 3. If we determine that we could not have collected the information, and the information is not contained in a Commonwealth record, we will destroy or de-identify the information as soon as practicable, provided it is lawful and reasonable to do so.

5. Notification of Collection (APP 5)

At or before the time we collect your personal information (or as soon as practicable afterwards), we will take reasonable steps to notify you of the matters required under APP 5, including: the identity and contact details of the organisation collecting the information; the purposes of collection; the consequences if information is not collected; the entities to which we usually disclose information; and information about this Privacy Policy.

6. How We Use Your Information (APP 6 — Use or Disclosure)

We use your personal information only for the primary purpose for which it was collected, or for a secondary purpose that is directly related to the primary purpose and which you would reasonably expect. We use your information for the following purposes:

• Providing and maintaining the Service
• Processing your subscription payments via Stripe
• Generating financial reports and data exports
• Sending transactional emails (account confirmation, password resets, subscription and billing notices)
• Sending you summaries of your own account activity, including totals calculated from your own transaction records
• Using the timing of your own transaction entries to decide when to send you those summaries, and when to remind you that you have entries or uncategorised items waiting
• Improving the Service and developing new features (using aggregated, de-identified data where possible)
• Complying with legal obligations, including taxation record-keeping requirements
• Protecting the security of the Service and our users
• Giving read-only access to an accountant or adviser you invite.
• Responding to lawful requests from regulatory authorities, courts, or law enforcement
• Understanding which marketing channels bring customers to Summed, using the optional "How did you hear about us?" answer you give at signup. This is used internally only, in aggregate, and is never used to target you with marketing or to vary the price or offers you are shown.

You can set how often you receive the summaries and reminders, or stop them entirely, using the link in any such email.

7. Direct Marketing (APP 7)

We will not use your personal information for direct marketing unless you have provided explicit opt-in consent. If you do consent to receiving marketing communications, every communication will include a simple and free unsubscribe mechanism in accordance with the Spam Act 2003 (Cth). You may opt out of direct marketing at any time by clicking the unsubscribe link in any marketing email or by contacting us at support@summed.com.au.

Summaries and reminders about your own account activity are not marketing. They contain only information drawn from your own records. They do not promote any product, service, upgrade, price or third-party offer. We send them because you hold an account with us and the records are yours. They are described in clause 6, and every one carries a one-click control to change how often you receive them or to stop them altogether.

Other than the summaries and reminders described in clause 6, we will not use or disclose your financial records or business transaction data to promote any product, service or offer — ours or anyone else's. We will never sell that data. We will never disclose it to a third party for that party's own marketing. And we will never use it to decide what price or what offers to show you.

8. Disclosure of Information (APP 6)

We may disclose your personal information to the following service providers ("data processors") who help us operate the Service:

• Amazon Web Services (Amazon Web Services Australia Pty Ltd — AWS Sydney region, ap-southeast-2): Cloud hosting, database, and object-storage infrastructure. Your personal information, business data, and uploaded receipts and invoices are stored on AWS infrastructure physically located in Australia (Sydney region), with Multi-Availability-Zone redundancy and encryption at rest managed via AWS Key Management Service. As this data remains onshore in Australia, disclosure to AWS for hosting purposes is not a cross-border disclosure under APP 8. AWS is engaged under contractual terms that require it to handle personal information consistently with the Australian Privacy Principles.
• Stripe (Stripe Inc, USA): For payment processing, subscription billing, and card data handling. We do not store full card numbers on our servers — payment data is handled directly by Stripe. Stripe's privacy policy applies to payment data they process.
• OpenAI (OpenAI Inc, USA): When you use the AI receipt or invoice scanning feature, uploaded images are sent to OpenAI's GPT-4o API for automated data extraction (amounts, dates, vendor names, line items). OpenAI processes this data in the United States. We send only the image data necessary for extraction; no other account information is transmitted. OpenAI's data usage policies apply to this processing — see openai.com/policies/privacy-policy.
• Resend (Resend Inc, USA): For sending transactional and notification emails (welcome emails, password resets, trial reminders, invoice deliveries, support ticket acknowledgements, and summaries of your own account activity). Only the recipient email address, sender details, and email content are transmitted to Resend. Where an email contains a summary of your account activity, the totals in that email form part of that email content — your underlying transaction records are never sent to Resend. Resend processes email on our instructions and does not use it for its own purposes.
• Third-party integrations: If you connect third-party services (e.g., Square POS), data is shared as necessary to provide the integration.
• Your accountant, if you invite one: if you invite an accountant, bookkeeper or adviser, we give that person read-only access to your records in Summed. That covers your transactions, GST and BAS figures, reports, receipt images and staff wage records. They can also download a copy of your transactions. They keep access until you revoke it, which you can do at any time in Settings. We give access only to someone you invite, and only to your business's records. Once they have seen or downloaded your information, what they do with it is between you and them.
• Legal authorities: Where required by law, court order, or regulatory request.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

9. Cross-Border Disclosure (APP 8)

Your core account, business, and uploaded file data is hosted within Australia on AWS Sydney infrastructure (see section 8) and is not disclosed overseas for hosting purposes. However, a small number of third-party processors we rely on for specific functions — payments, AI-assisted receipt extraction, and transactional email delivery — process limited personal information outside of Australia, including in the United States. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to the information (the standard set by APP 8.1). The overseas recipients currently engaged by Summed, and the countries where they process personal information, are:

• Stripe Inc (United States): Payment processing and subscription billing.
• OpenAI Inc (United States): AI receipt and invoice scanning via GPT-4o API.
• Resend Inc (United States): Transactional and notification email delivery.

Under APP 8, if we disclose your personal information to an overseas recipient and the recipient breaches the APPs, we may be accountable for that breach. We mitigate this risk through contractual arrangements with our service providers that require them to handle personal information in accordance with Australian privacy standards.

10. Government Related Identifiers (APP 9)

We collect government-related identifiers such as Australian Business Numbers (ABNs) only where it is reasonably necessary for our functions (configuring your bookkeeping environment and generating accurate business reports). We will not use or disclose government-related identifiers as our own identifier for you, and we will only use or disclose them in the circumstances permitted by APP 9 — including where required by law, or where reasonably necessary to verify your identity for the purposes of the Service.

We do not collect Tax File Numbers (TFNs). If a TFN is inadvertently entered into the Service, we strongly recommend it be removed immediately.

11. Quality of Personal Information (APP 10)

We take reasonable steps to ensure that the personal information we collect, use, and disclose is accurate, up-to-date, complete, and relevant. As a bookkeeping platform, the accuracy of financial data depends primarily on user input. We encourage you to review and update your account and business information regularly, and to contact us if any information we hold about you is inaccurate or out of date.

12. Data Security (APP 11)

We implement reasonable security measures to protect your personal information, including:

• Encrypted connections (HTTPS/TLS) for all data transmission
• Secure password hashing (bcrypt with salt rounds)
• JWT-based authentication with expiring access tokens and secure refresh tokens
• Rate limiting on authentication endpoints
• Regular database backups
• Audit logging of data modifications
• All stored data, including imported bank transaction records, is held on AWS infrastructure in Sydney, Australia (Amazon RDS and Amazon S3) encrypted at rest with AES-256 encryption managed through AWS Key Management Service (KMS)
• Additional application-level AES-256-GCM field encryption applies to high-sensitivity credentials, including business ABNs and third-party integration tokens
• Bank CSV files processed in memory only — raw files are not retained after transaction extraction

No method of electronic storage or transmission is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

13. Cookies and Tracking Technologies

We use the following cookies:

• bc_access: Authentication token (24 hours). HttpOnly, Secure in production.
• bc_refresh: Refresh token (14 days). Signing you out, or changing your password, invalidates it immediately. HttpOnly, Secure in production.

These cookies are essential for the Service to function and cannot be disabled while using the platform. We do not use tracking or advertising cookies.

14. Data Retention

We retain your personal information for as long as your account is active, or for as long as we need it to provide the Service or to meet a legal obligation.

If you close your account:

• Your profile information is anonymised 30 days after closure. During those 30 days you can email support to restore your account, and you can export your data at any time.
• Records of a kind used for taxation and employment record-keeping are retained for the periods set out in our Retention Policy — generally 5 years, and 7 years for employee-related records. You can ask us to delete them sooner by emailing support@summed.com.au.

Our full retention schedule, including the reminder emails we send before any record reaches the end of its retention period, is published at summed.com.au/retention-policy.html.

Bank transaction data: Imported bank transaction data is retained for as long as your account is active, or for as long as we need it to provide the Service. You can delete an imported transaction at any time from within the application.

If you close your account, your profile details are anonymised 30 days later, as set out above. Your transaction records themselves are not deleted at that point. They are retained for the periods set out in our Retention Policy, and are held without your name, email address or business name attached to them. We do not use them to contact you and we do not use them for any other purpose.

If you would rather your transaction records were erased permanently instead of retained, email us at support@summed.com.au and we will delete them.

Please keep your own copies of your bank transaction records. The obligation to keep business records for taxation purposes — generally 5 years, under s 382-5 of Schedule 1 of the Taxation Administration Act 1953 (Cth) — rests with you as the taxpayer, not with us. You can export your full records from within the application at any time.

15. Access to Personal Information (APP 12)

You have the right to request access to the personal information we hold about you. Upon receiving a request, we will respond within 30 days. We will provide access in the manner you request (where reasonable and practicable), such as by email or through the Service's data export features.

We may refuse access in limited circumstances permitted by APP 12.3, such as where access would be unlawful, where it would have an unreasonable impact on the privacy of others, or where the request is frivolous or vexatious. If we refuse access, we will provide written reasons and inform you of the mechanisms available to complain about the refusal.

16. Correction of Personal Information (APP 13)

You have the right to request correction of any personal information we hold about you that is inaccurate, out-of-date, incomplete, irrelevant, or misleading. We will respond to correction requests within 30 days. If we correct information that has previously been disclosed to a third party, we will take reasonable steps to notify the third party of the correction (unless it is impracticable or unlawful to do so).

For imported bank transaction data, you may directly edit, re-categorise, or delete individual transaction records through the application interface at any time without needing to submit a formal correction request.

If we refuse to correct information, we will provide written reasons and inform you of the mechanisms available to complain. You may also request that we associate a statement with the information that you believe is inaccurate, out-of-date, incomplete, irrelevant, or misleading.

17. Your Additional Rights

In addition to access and correction rights under APPs 12 and 13, you may also:

• Export your data: Download your financial records via the CSV export feature at any time
• Delete imported bank data: Delete individual imported bank transactions or all imported bank transaction data at any time through the application interface
• Delete your account: Request deletion of your account and all associated data — including imported bank transactions — by contacting support (subject to any legal retention obligations)

To exercise any of these rights, contact us at support@summed.com.au.

Statutory right to sue for serious invasions of privacy

Since 10 June 2025, Australian law gives individuals a direct right to sue for a serious invasion of privacy. This right was created by the Privacy and Other Legislation Amendment Act 2024 (Cth). It applies where someone intrudes on your seclusion or misuses your private information, you had a reasonable expectation of privacy, and the invasion was serious and either intentional or reckless. It is not limited to businesses covered by the Privacy Act 1988 (Cth), and it applies to anyone who seriously invades your privacy, including Summed. We mention it here so you know about this legal protection.

18. Personal Information About Other People

If you use the Service to record information about your employees, contractors, clients, or other third parties (such as staff names, hourly rates, and shift records, the client names and contact details on your invoices, and anything you type into an invoice's client details field, such as a participant's name or NDIS number), you are responsible for ensuring that those individuals are aware that their personal information is being stored in Summed. You should notify affected individuals of:

• The fact that their personal information is being recorded in the Service
• The types of information stored (e.g., name, pay rate, hours worked; or for a client, name, contact details and invoice details)
• How their information is used (internal record-keeping and reporting, and for a client, the invoices you send them)
• How they can request access to or correction of their information (by contacting you, the account holder)

Summed does not have a direct relationship with the individuals whose information you enter. We rely on you, the account holder, to comply with your notification obligations under the APPs in respect of any third-party personal information you input into the Service.

If you invite an accountant, they will also be able to see the information in this clause about your staff and clients.

19. Data Breaches

The Notifiable Data Breaches scheme in Part IIIC of the Privacy Act does not currently apply to us, because we are a small business operator (see clause 1). We follow its process anyway, as a commitment to you. If we have reasonable grounds to suspect a data breach involving personal information we hold, we will:

• Assess the breach within 30 days of becoming aware of those grounds. This matches the timeframe that s 26WH of the Privacy Act sets for entities the scheme covers.
• Notify the OAIC as soon as practicable after completing our assessment, if we believe the breach is likely to result in serious harm to anyone. Our statement will include a description of the breach, the kinds of information involved, and recommendations about the steps individuals should take.
• Notify affected individuals as soon as practicable after completing that assessment, with the same information given to the OAIC, as well as our contact details and the contact details of the OAIC.

Financial data heightened risk: Summed holds financial records, business transaction data, and business identifiers such as ABNs. Breaches involving this data carry a higher risk of serious harm. We assess serious harm using the factors set out in s 26WG of the Privacy Act. These include the kind and sensitivity of the information, whether security measures protect it, and the nature of the harm that could result. We assess financial data breaches on an expedited basis.

20. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a person under 18 without appropriate consent, we will take steps to delete that information as soon as practicable.

21. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The "Last updated" date at the top of this page indicates when the policy was last revised.

Version history: Version 2.1 (15 October 2026) added a description of the accountant access you can choose to give. Nothing changes unless you invite someone. Version 2.0 (3 October 2026) added a row to the collection table in clause 3 describing the bank details you enter so your own clients can pay you, and renamed the existing "Payment information" row to "Subscription payment information" so the two cannot be confused. It also retitled clause 18 "Personal Information About Other People" and widened it to cover your clients as well as your staff, so its existing warning now reaches people other than staff. No new information is collected and nothing about how we handle your information changed. Version 1.9 (14 September 2026) corrected clauses 1, 19 and 22 to describe our legal status accurately: we are a small business operator and apply the APPs and the Notifiable Data Breaches process by choice. Our commitments to you did not change. Version 1.8 (6 September 2026) covered account summary and reminder emails that include figures from your own records.

22. Complaints

If you believe we have breached the APPs or otherwise mishandled your personal information, you may lodge a complaint with us using the contact details below. Our complaint handling process is as follows:

1. Lodge your complaint by emailing support@summed.com.au with the subject line "Privacy Complaint". Please include details of the breach you believe has occurred.
2. Acknowledgement: We will acknowledge receipt of your complaint within 5 business days.
3. Investigation: We will investigate and provide a written response within 30 days of receiving your complaint.
4. Escalation: If you are not satisfied with our response, or if we do not respond within 30 days, you can contact the Office of the Australian Information Commissioner (OAIC). Because we are a small business operator, the OAIC may not be able to investigate a complaint about us under the Privacy Act. You may also contact Consumer Affairs Victoria.

OAIC Contact Details:

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Email: enquiries@oaic.gov.au
• Post: Office of the Australian Information Commissioner, GPO Box 5218, Sydney NSW 2001

23. Contact

For any questions about this Privacy Policy, or to exercise your rights under the APPs, please contact us:

Anum Pty Ltd (ABN 80 697 129 525, ACN 697 129 525)
Privacy Officer
Email: support@summed.com.au
Jurisdiction: Victoria, Australia