Privacy Policy
1. Who We Are
Corbi (the Service) is provided by DHD Group Pty Ltd (ABN 92 608 566 150) trading as Nivens Tech, Brisbane, Queensland (we, us, our). This policy explains how we handle personal information in connection with the Service, our website https://corbi.com.au and our support.
We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
2. The Information We Hold
Corbi is in a free pilot. Billing arrangements and the unfinished features described in this draft are proposed and under legal review.
About you and your users
- Account details from Xero. When you "Sign in with Xero", Xero gives us your name, email address and Xero user identifier.
- Under legal review: Billing details. Your billing contact and business details. Card payments are handled by our payment provider, Stripe. We do not see or store your full card number.
- Support and contact. What you send us when you ask for help or contact us.
- Under legal review: Usage and security records. Sign-in times, IP address, browser details and an audit log of actions in the Service, kept to secure the Service and investigate problems.
From your Xero organisation
With your permission, the Service reads, read-only, your organisation’s details, chart of accounts, profit and loss, balance sheet, trial balance and any existing Xero budget, for up to the last 24 months, and refreshes them nightly. This is mostly business information. It can include personal information, for example where a business is run by a sole trader, or where an account name identifies a person.
That you enter
The budget questions ask about staffing (role, salary, superannuation rate, start and end month). We suggest you describe roles, not name individuals. If you do enter names, that is personal information about your staff and we handle it under this policy.
On this website
This website, corbi.com.au, uses Cloudflare Web Analytics to count visits. It sets no cookies, stores nothing on your device and does not follow you across other websites. It records the page you viewed, the page that linked you here, your browser type, your country and how quickly the page loaded. It does not use your IP address to identify you.
What we do not collect
We do not collect sensitive information (such as health information), tax file numbers or bank account login details, and the Service never writes to Xero.
3. How We Collect It
- from you, when you sign up, use the Service or contact us;
- from Xero, when you connect an organisation, and every night while it stays connected;
- automatically, when you visit this website, through Cloudflare Web Analytics (see section 2);
- Under legal review: from Stripe, about the status of your payments; and
- Under legal review: automatically, through security logs and the essential cookies that keep you signed in.
4. Why We Use It
- Under legal review: to provide the Service: build your budget, keep your forecast current and send your monthly summary email;
- Under legal review: to manage your account and subscription, and bill you;
- to give support and tell you about changes to the Service or these policies;
- to secure the Service, prevent misuse and investigate incidents; and
- to meet our legal obligations.
We do not use your information, or any data from Xero, to train artificial intelligence or machine learning models. The Service’s forecasts are produced by fixed rules that you set.
Under legal review: We do not make automated decisions about you that have a legal or similarly significant effect.
Under legal review: We will only send marketing emails if you agree, and every marketing email has an unsubscribe link. Marketing email plans are to be confirmed.
5. Who We Share It With
We do not sell personal information. We share it only with:
| Recipient | What and why | Where |
|---|---|---|
| Amazon Web Services | Hosts the Service, its database and backups | Australia (Sydney region) |
| Stripe | Under legal review: Processes subscription payments and issues receipts | Under legal review: Australia and the United States, to confirm |
| Under legal review: Email provider to be confirmed | Under legal review: Sends sign-up, monthly summary and account emails | Under legal review: to confirm |
| Cloudflare | Counts visits to this website, without cookies | Cloudflare’s global network, which may be outside Australia |
| Xero | Only what the connection needs (for example disconnecting); Xero already holds your data | Per Xero’s own policy |
| Our staff and contractors | Only those who need it to run and support the Service, under confidentiality obligations | Australia |
| Authorities | Where the law requires or permits, for example a court order | Australia |
Overseas disclosure
Under legal review: Your Xero data and account data are stored in Australia. Some service providers may process limited information outside Australia: Stripe (United States) for payments; email provider to confirm. We take reasonable steps to make sure they protect it in line with the Australian Privacy Principles.
Cloudflare may process the website visit counts described in section 2 outside Australia.
6. How We Keep It Secure
- All data is hosted in Amazon Web Services’ Sydney region.
- Under legal review: The hosting account is used only for this product.
- Data is encrypted in transit and at rest.
- Under legal review: Xero access tokens are separately encrypted with managed encryption keys.
- Under legal review: Each customer’s data is kept separate in the database, so one customer cannot see another’s.
- Under legal review: Our administrators use multi-factor authentication, and access is limited to what each person needs.
- Under legal review: We keep audit logs of access and changes, and test our security before launch and regularly after it.
7. How Long We Keep It
| Information | Kept for |
|---|---|
| Xero data, budgets and forecasts | Under legal review: While your account is open. If you disconnect an organisation we stop reading its data; we delete that organisation’s data after 30 days, or on request. |
| All account data after you close your account | Under legal review: Deleted within 30 days, then removed from backups within 35 days. |
| Billing records and tax invoices | As long as tax law requires (generally 5 years). |
| Security and audit logs | Under legal review: 12 months, longer if needed for an investigation. |
| Support emails | Under legal review: 2 years. |
8. Accessing And Correcting Your Information
You can see and update most of your information in the Service. You can also ask us for a copy of the personal information we hold about you, or ask us to correct it, by emailing support@nivens.tech. We will respond within 30 days. We may need to confirm your identity first. If we refuse a request, we will tell you why and how to complain.
9. Data Breaches
If we suspect a data breach, we act straight away to contain it and assess it. If it is likely to result in serious harm to anyone (an "eligible data breach" under the Notifiable Data Breaches scheme), we notify the Office of the Australian Information Commissioner and the people affected as soon as practicable.
Under legal review: We complete our assessment within 30 days.
Under legal review: We also notify Xero within 24 hours of becoming aware of a breach affecting Xero data, as Xero’s terms require, and tell affected customers promptly.
10. Complaints
Under legal review: If you have a concern about how we handle your personal information, email support@nivens.tech. We will acknowledge your complaint within 5 business days and respond within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.
11. Changes To This Policy
We may update this policy. The current version is always on our website, with the date it was last changed. If a change materially affects how we handle your information, we will tell you by email before it takes effect.
12. Contact Us
DHD Group Pty Ltd (ABN 92 608 566 150) trading as Nivens Tech, Brisbane, Queensland.
Privacy and general enquiries: support@nivens.tech. Website https://corbi.com.au.
Under legal review: Last updated: publication date to be confirmed.