Privacy Policy

Overview

Focus on Cash is run by Focus First Pty Ltd (ABN 51 619 930 282), a company in New South Wales, Australia ("we", "us", "our"). This policy explains what information Focus on Cash collects, why, where it is kept, who can see it, and how you can get it changed or deleted. We follow the Australian Privacy Principles in the Privacy Act 1988.

Your financial data is yours. We use it only to give you Focus on Cash. We do not sell it, we do not use it to train AI models, and we do not combine it with other businesses' data for benchmarking without your permission.

What we collect

Your account

• your name and email address
• the company names you set up
• your role (business owner, advisor or invited user)
• that you have set up two-step sign-in
• when you sign in, and security events on your account
• your IP address, used to protect sign-in and passed to our error report supplier (see below)

Financial data you upload or type in

Profit and loss statements and balance sheets you upload, and figures you type in, such as team numbers, budgets, goals and settings.

Data from Xero

When you connect Xero, we read:

• your Xero sign-in name and Xero user id, which Xero sends when you connect. We keep the user id with the connection, so we can tell which connections use the same Xero login. We do not keep your name.
• the organisation's name and basic details
• profit and loss and balance sheet reports, and the account list
• tracking categories, if you choose to use them
• the headers of sales invoices, bills and credit notes: the customer or supplier name, dates, status, amounts and what is still owed. We use these for customer and supplier figures, such as how much of your sales comes from your largest customers and how quickly customers pay.

Connecting also gives Focus on Cash permission to stay connected between your visits (Xero calls this offline access). We use this permission to refresh your figures without you signing in to Xero each time. Disconnecting ends this access. We only read from Xero and never change anything in it.

We do not keep invoice line items, contact details such as addresses or phone numbers, bank transactions, payments, payroll, payslips or tax returns.

Customer and supplier names belong to the people and businesses you deal with. We hold them on your behalf, only to calculate your figures. Telling them how their details are used is covered by your own privacy policy.

Data from QuickBooks Online

When you connect QuickBooks Online, we read the company's name and basic details, the account list, and profit and loss and balance sheet reports.

Visit counts

Focus on Cash does not record which pages or features you use. Cloudflare counts visits to our website and sign-in page, without cookies.

Logos you upload

If you upload a logo, it is scanned for viruses by Cloudmersive before it is stored. Cloudmersive sees the logo picture only, never your figures, and says it keeps nothing after the scan.

Error reports

When something breaks, an error report goes to Sentry so we can fix it. It can include your IP address, your browser and device type, and the address of the page you were on. We do not send the contents of requests, and we take sign-in codes out of page addresses.

When you order or email us

Your name, business name, ABN, email address, phone number and anything you write. We use it to send your invoice and answer you.

If we need to confirm who you are

Sometimes we need to check who you are, for example before we help you with two-step sign-in or when we see unusual activity on an account. We use the details you give us for that check only. A person makes the decision, not an automated system.

How we use it

• to provide Focus on Cash and calculate your analysis
• to bring in and refresh data from your accounting system
• to send emails you need, such as invitations and sign-in emails
• to invoice you and manage your subscription
• to answer support requests
• to keep accounts secure and to find and fix faults

We send service emails, not marketing, from Focus on Cash.

Who can see your data

• you, and the people you invite into your account
• your advisor, if you use Focus on Cash through one. They see the companies you share with them, through the permissions in Focus on Cash.
• us, only when you ask for help, or to keep the service secure or fix a fault
• the suppliers listed below, only as far as each needs to do its job
• anyone the law requires us to share it with
• a new owner of Focus on Cash, if the business is sold. This policy would keep applying to your data, and we would tell you.

Some advisors show Focus on Cash under their own name and logo. This policy still applies, and your data is handled the same way.

Where your data is kept, and our suppliers

Your account and financial data are stored in a database in Sydney, Australia, with Supabase (database, sign-in and server functions). An encrypted backup is taken each night and held by Cloudflare in its Oceania region.

Some of our suppliers are overseas:

• Cloudflare: hosts the app and protects it from attack. Traffic passes through its worldwide network. Cloudflare also counts visits to our website and sign-in page, without cookies. It stores two things for us: the nightly backup of the database, which is encrypted before it leaves the database, and a locked copy of our security records (security events and the record of who opened or downloaded data), with names and email addresses taken out and no financial figures.
• Cloudmersive (United States): scans each uploaded logo for viruses. Logo pictures only. Cloudmersive says it keeps nothing after the scan.
• Sentry (United States): error reports.
• Resend (United States): sends our emails, so it handles email addresses and email content.
• Xero and Intuit (QuickBooks): the accounting systems you choose to connect, under their own privacy policies (Xero, Intuit).

By using Focus on Cash, you agree to this information going to these countries for these purposes.

Keeping it secure

• all data travels over encrypted connections
• the keys that keep your accounting connection open are stored encrypted, and we never see your Xero or QuickBooks password
• database rules let each person see only the companies they have been given access to
• two-step sign-in is required for every account, and downloads of your data are logged

No system is perfectly secure. If a data breach is likely to cause serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Disconnecting Xero or QuickBooks

You can disconnect at any time in Focus on Cash, or in Xero or QuickBooks. When you do, we ask Xero or QuickBooks to cancel our access, so the stored keys stop working, and we can no longer read anything new. Data already brought in stays in Focus on Cash, so your history remains, until you delete the company or close your account.

How long we keep it, and deleting it

• We keep your data while your account is active.
• Deleting a company deletes all its data. An account holder can close the account in Settings, which deletes their companies and login straight away. Copies in our encrypted backups go within 30 days.
• If you do not close your account, we may delete your data at any time after your subscription ends.
• The record of who downloaded data is deleted after 12 months.
• Copies held by our suppliers (error reports and email logs) are deleted under their own retention periods. Ask us if you want them removed sooner.
• Each nightly backup is kept for 30 days. The copy of the security records is locked, so it cannot be deleted for a year.
• We keep invoices and business records for as long as Australian tax law requires.

Cookies and browser storage

Focus on Cash does not use advertising cookies or tracking pixels. It keeps a small amount of information in your browser's own storage:

• Needed to work: your sign-in session, so you stay signed in. This is always on, because Focus on Cash cannot work without it.
• Preferences: the company you last looked at, the screen you were on, and display settings, so Focus on Cash opens where you left it.
• Security: the time you were last active, so Focus on Cash can sign you out after 30 minutes without activity.
• While you connect: the state of a Xero or QuickBooks connection in progress, which goes when you close the tab.

Our hosting provider, Cloudflare, may set a cookie that is needed to protect the site from attack.

You can clear this storage in your browser settings at any time. Clearing it signs you out.

Your rights

You can ask us to:

• give you a copy of the information we hold about you
• correct information that is wrong
• delete your account and data

Email mandywalker9@icloud.com. We will reply within 30 days. If you are not happy with our reply, you can complain to the Office of the Australian Information Commissioner.

Changes to this policy

We may update this policy. We will tell you about important changes by email or in Focus on Cash. The date at the top shows the latest version.

Law

This policy is governed by the law of New South Wales, Australia, including the Privacy Act 1988 and the Australian Privacy Principles.

Contact

Questions about privacy or your data: mandywalker9@icloud.com.