Privacy policy

1. What we collect

Cosmic Bills collects the minimum amount of personal data needed to provide document processing services to you.

• Your username and password.
• Your name and email address, provided at registration.
• A phone number, if you choose to provide one. This is optional.
• The invoices, bills, receipts and other documents you submit for processing.

2. What we read from your accounting system

Cosmic Bills periodically obtains data from the accounting system you have authorised it to connect to. Only data relevant to invoice processing is obtained, and only for the purpose of performing document processing for you.

• Your contact list, used to find the matching supplier for your invoices.
• Settings data, used to determine the most suitable general ledger account, invoice numbers, terms and similar values.
• Your organisation's own details, including your company's ABN, so that your own company is not treated as a supplier on its own bills.

3. How we use it

Your data is used to process your documents and to improve the accuracy of that processing. Cosmic Bills may monitor your invoice data processing for that purpose alone.

Your email address is used to communicate with you. It is not distributed or used in any other way. It may be added to a newsletter list, which you can leave at any time.

Cosmic Bills keeps a copy of every document you submit for processing, for tax office record keeping and for Cosmic Bills' internal record keeping.

4. Disclosure

Cosmic Bills will not disclose your personal information, documents or accounting information to a third party unless you have given explicit consent, or unless compelled by a court order.

Cosmic Bills does not store your payment card information. Card payments are processed by Stripe.

5. Where your data is hosted

TODO: VERIFY — this is the most important unresolved item in this document. The privacy policy currently published on the site names a third-party hosting provider with servers in the United States and Singapore. A blog article on the same site claimed that customer data is kept in Australia. Both cannot be true, and the difference is material for Australian Privacy Principle 8 (cross-border disclosure) and for UK and EU customers.

Once confirmed, this section must name the hosting provider, the countries data is stored in, and the safeguards applied to any cross-border transfer.

6. Retention

Invoice documents are retained for a minimum of seven years, consistent with the data back-up regime and record-keeping practice used in the accounting industry.

If an account is not paid for more than a year, its data may be deleted without notice.

7. Your rights

Cosmic Bills users with a valid subscription have unrestricted access to their own data, including their email address and stored document copies, through the Cosmic Bills portal at any time.

• Erasure — your email address, invoice documents and the data drawn from your accounting system can be deleted on request. Erasure ends the seven-year retention commitment described above.
• Restriction of processing — you can choose not to use certain services in Settings, which restricts the processing of the relevant data.
• Portability — past document data can be obtained in a commonly used, machine-readable format, which you are free to transmit to another controller.
• Objection — you may object to the use of your data. The consequences will be explained to you.

TODO: VERIFY — the current policy also describes rights framed around the EU General Data Protection Regulation. Cosmic Bills serves Australia, the United Kingdom and the United States. Confirm which regimes actually apply — the Australian Privacy Act and Australian Privacy Principles, the UK GDPR, and any applicable US state privacy laws — and state them accurately rather than referring to GDPR generically.

8. Breach notification

Where a data breach is likely to result in a risk to the rights and freedoms of individuals, notification will be sent within 72 hours of Cosmic Bills becoming aware of it.

TODO: VERIFY — Australia's Notifiable Data Breaches scheme has its own assessment and notification obligations, including notifying the Office of the Australian Information Commissioner. This section should reflect the Australian obligations as well as the 72-hour standard quoted from GDPR.

9. Google Drive access

If you connect Google Drive, Cosmic Bills reads only from a dedicated folder you create named "Cosmic BillsUpload". Once a file has been placed in that folder, it is processed and moved to a folder named "Cosmic BillsDone", which Cosmic Bills creates if it does not already exist.

Cosmic Bills does not delete any files in your Google Drive, and does not access anything outside those folders. Extracted invoice data is exported to the accounting package you have authorised.

TODO: VERIFY — Google Drive upload is described in the current privacy policy but appears nowhere in the current user guides or product pages. Confirm whether it is still offered before publishing this section, and confirm compliance with Google's API Services User Data Policy if it is.