What we collect
- About you: name, email, mobile, ABN and the business details on the Australian Business Register, your bank account name, BSB and account number (encrypted), your logo, and which kinds of support you provide.
- About participants you support: name, NDIS number, date of birth if you add it, who pays their invoices and that payer's email, your agreed rates, service agreements, and shift notes you choose to write. NDIS numbers and support notes are health-adjacent information; we treat them as sensitive.
- About your work: shifts, invoices, payments, and the emails we send on your behalf (to whom, when, delivered or bounced).
- Voice: if you log a shift by voice, the audio is processed by your browser's speech service or, where that isn't available, by our transcription provider. The audio leaves your device for that purpose only and is not kept.
- Technical: sign-in sessions, device type for the Face ID / fingerprint label, and the pages you open, kept in server logs for a short time.
Why
To build and send your invoices, match payments, remind payers, keep the records a sole trader needs, and sign you in without a password. We don't sell information or use it for advertising.
Who sees it
- The payer named on an invoice receives that invoice by email.
- If you connect Xero, the invoices and payments you approve are copied to your own account there.
- Service providers we use to run InvoiceRight: Australian hosting, an email delivery service and Stripe for card billing (we never see your card). Also the Australian Business Register for ABN checks, and a transcription service for voice when the browser can't do it. Each sees only what it needs.
- Nobody else, unless the law requires it.
Where it lives
In Australia. Bank account numbers are encrypted at rest and shown masked after you save them. Sign-in uses one-time codes or passkeys; we never store passwords.
How long
While you have an account. If you delete your account, we remove everything except the invoices you've sent, which are business records kept for 7 years under your email address and nothing else, then deleted.
Your choices
- Download everything as CSV and PDFs from Settings → Your data.
- Delete your account from the same place, any time.
- Ask us anything at [email protected]. If we can't resolve a complaint, you can contact the Office of the Australian Information Commissioner.
Last updated 10 Nov 2026. We'll email you about changes that matter.