Privacy Policy

WYHEN Pty Ltd (ABN 57 688 078 999) trading as SyncMate ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy outlines how we collect, use, store, disclose, and safeguard your personal and financial information when you interact with the SyncMate application (the "Platform" or "App").

This policy is compliant with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

To provide automated accounting and expense synchronization workflows, we collect the following categories of information:

• Account Credentials: Name, business name, corporate email address, phone number, billing details, and the identity details returned by Xero when you sign in via OAuth 2.0. SyncMate does not issue or store passwords.
• Source Financial Documentation: Uploaded financial records, including invoices, corporate receipts, purchase orders, statements, supplier information, and line-item tax details.
• System Integration Metadata: Synchronized metadata from your integrated third-party accounting ecosystem (e.g., Xero Chart of Accounts, tracking categories, and tax rates).

• Direct User Input: Information explicitly provided by you when creating an account, adjusting settings, configuring user seats, or uploading image/PDF receipts.
• API Ingestion: Data securely pulled from connected accounting platforms (such as Xero) via OAuth 2.0 protocols.

We process and use your information for the following primary operational and product development tasks:

• To execute core software functionalities (AI-driven OCR text extraction, automated category matching, and data pushing to Xero).
• To manage active subscriptions, track extraction usage ceilings, process billing, and offer technical support.
• To monitor system health, audit security logs, and prevent fraudulent activity within the platform infrastructure.
• SyncMate does not build, train, or maintain any proprietary AI model. Your uploaded documents and the extracted financial data are not used to train any AI model, are not shared with other SyncMate users, and are not sold to third parties. See our Trust & Security page for full details.

We do not sell, rent, or trade your personal or financial data to third-party marketers. To deliver a fully automated SaaS experience, your data is securely shared with and processed by the following essential infrastructure partners:

• Stripe: Payments for subscriptions and top-up packages are processed by Stripe Payments Australia Pty Ltd ("Stripe"), covering card payments and Australian BECS Direct Debit. Your card and bank account details are collected directly by Stripe under Stripe's own privacy policy and are never stored by SyncMate. We share only the data needed to raise and manage your subscription (account identifier, business email, plan and invoice details).
• Paddle (legacy subscriptions only): Subscriptions created before our move to Stripe were sold through Paddle.com Market Ltd as Merchant of Record and are still billed by Paddle until cancelled or migrated. For those customers, payment details are held by Paddle under Paddle's own privacy policy, and subscription status is exchanged securely between Paddle and SyncMate.
• AI/OCR Subprocessors: Enterprise API endpoints from OpenAI and Google (Gemini API, Paid tier) used to perform OCR and data extraction on your uploaded documents. Both providers contractually do not use API submissions to train or improve their models. SyncMate does not build or train its own AI models.
• Cloud Hosting (Supabase / Cloudflare): Database, authentication, storage, and edge compute are hosted on Supabase (Postgres) and Cloudflare in the AWS Asia-Pacific region. All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).

5.1 Right to Erasure: You may request the absolute erasure of your stored historical invoices and user profile from our servers at any time by contacting support. This is subject to any overarching anti-money laundering (AML) laws or financial statutory record-keeping regulations that may compel a temporary preservation period.

We implement industry-standard cryptographic practices to protect your records. All data transmitted between your device, SyncMate, and Xero is encrypted using Transport Layer Security (TLS) in transit and Advanced Encryption Standard (AES-256) at rest.

If you have any questions regarding this Privacy Policy, or if you wish to lodge a query regarding how your financial information is managed under WYHEN Pty Ltd's trading structure, please contact us at contact@wyhen.com.au

WYHEN Pty Ltd