Twine Tax Widget Privacy Policy

Twine Apps Pty Ltd · ABN 99 690 317 483 · Townsville, Queensland, Australia

Effective date: 16 October 2026 · Last updated: 16 October 2026

The short version

• Twine Tax Widget helps accounting and bookkeeping firms show their clients how much tax the business has paid to the ATO this financial year, compared with the same time last year.
• A firm connects a client's QuickBooks Online or Xero file. We only read data. We never create, change or delete anything in the client's books.
• We work out the totals and keep those totals, plus the accounts the firm has confirmed. We don't keep transaction lines.
• Connection tokens are encrypted, and everything we store is held in Australia (AWS Sydney).
• A firm can disconnect a file at any time. When it does, we revoke our access and delete the stored tokens straight away.
• We never sell data, we never use it for advertising, and we never use it to train AI.
• Questions? Email support@twineapps.co. We're happy to help.

1. Who we are

Twine Tax Widget (the Service) is a web app at https://taxwidget.twineapps.co, made by Twine Apps Pty Ltd ABN 99 690 317 483 (Twine, we, us, our), a small Australian software company based in Townsville, Queensland. Our website is twineapps.co.

This policy explains what personal information we collect through the Service, why, how we look after it, and the choices you have. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Because we also work with firms in New Zealand, the United Kingdom, the European Union and the United States, sections 15 to 17 explain the extra rights people in those places have.

This policy is about Twine Tax Widget. Other Twine products, such as Twine Biller, have their own privacy information. Where you use one Twine account across products, the general Twine Apps Privacy Policy also applies to that account.

2. Who this policy is about, and who is in charge of the data

Three groups of people deal with the Service:

• Firms: the accounting and bookkeeping firms that subscribe, and the staff who log in for them (firm users).
• Clients: the businesses whose QuickBooks Online or Xero files a firm connects, and any client staff the firm invites to view their card (client users).
• Visitors: anyone who visits our pages or contacts us.

About the accounting data. The firm decides which client files to connect and who can see the results. For that data, we act on the firm's behalf and under its instructions. In GDPR terms the firm is the controller and Twine is the processor. The firm is responsible for having its clients' permission to connect their files (see our Terms of Use). If you are a client and have a question about your data, you can ask your firm or ask us directly, and we'll help either way.

About account, billing and support data. For information about firm users, client users and visitors that we need to run our business (logins, billing, support emails), Twine makes the decisions and is responsible (the controller).

3. What we collect

3.1 Account information

3.2 Accounting data from QuickBooks Online and Xero

When a firm connects a client's file, we read the data needed to work out tax paid to the Australian Taxation Office (ATO): GST (net of refunds), PAYG withholding, PAYG instalments and payments through an ATO clearing account.

What we read (held in memory only while a refresh runs):

• QuickBooks Online (scope com.intuit.quickbooks.accounting, read-only use): company information and preferences (such as home currency), the chart of accounts, tax payments, and journal entries, purchases, bill payments, linked bills and General Ledger report lines for the relevant accounts.
• Xero (read-only scopes): organisation settings, bank transactions, payments, bank transfers, manual journals, contacts (to recognise payments to the ATO) and the bank summary report.

What we store:

• the client business name, the platform (QuickBooks Online or Xero), the platform's organisation or company ID, and the connection status
• the encrypted access and refresh tokens that let us read the file
• the accounts the firm has confirmed for GST, PAYGW, PAYGI and the ATO clearing account
• the calculated totals for this financial year and the same period last year, and when they were last refreshed.

What we don't store: individual transactions, invoices, bank lines, contact records, payroll details or employee information. We read them to calculate the totals and then discard them.

Accounting data is mostly about businesses, but it can include personal information. For example, a sole trader's business name may be their own name.

3.3 Billing information

When paid plans are live, we use Stripe to take payments. We keep your plan, invoices, payment history and billing contact. Stripe handles your card details; we never see or store full card numbers. We also record whether your firm is a Twine Biller customer, so we can apply the 50% discount.

3.4 Support and communications

If you email us or use our support page, we keep your name, email address, what you tell us and our replies.

3.5 Technical and security information

When you use the Service, our servers record technical details such as your IP address, browser type, the pages and actions requested, timestamps and error messages. We also keep an audit log of important actions: sign-ins, connecting and disconnecting files, changes to account mappings and changes to branding. Passwords, tokens and other secrets are never written to our logs.

Our sign-in page uses Cloudflare Turnstile to check you're a person and not a bot. Turnstile collects limited device and browser signals and your IP address for that check (see section 18).

3.6 Information we don't want

We don't ask for, and the Service doesn't need, tax file numbers, government identifiers for individuals, bank or card numbers, or sensitive information (such as health information). Please don't put these into free-text fields or support emails.

4. How we collect information

We collect information:

• from you: when you sign up, sign in, set up your firm, invite users, contact us, or pay us
• from your firm: when a firm invites you as a firm user or client user
• from QuickBooks Online and Xero: only after a person with the right access to that file approves the connection on Intuit's or Xero's own consent screen
• automatically: through server logs, security tools and essential cookies.

You can deal with us without giving your name when you're just asking a general question. To use the Service, though, we need to know who you are, so we can keep accounts secure.

5. How we use information

We use information to:

1. provide the Service: connect files, calculate and display the tax-paid totals, show the firm dashboard and client cards, and apply the firm's branding
2. keep the Service and your data secure: verify sign-ins, run MFA and CAPTCHA, limit sign-in attempts, investigate misuse and keep audit records
3. support you: answer questions, fix problems and tell you when a file needs reconnecting
4. run our business: billing, applying discounts, record-keeping and meeting legal obligations, including tax records
5. improve the Service: for example, fixing bugs and seeing which features are used, using our own logs and account information (never the clients' accounting data)
6. tell you about Twine: occasional product updates and offers to firm users. You can unsubscribe at any time, and we'll still send you important service and account messages.

We only use personal information for the purpose we collected it for, for a related purpose you'd reasonably expect, with your consent, or where the law requires or allows it.

6. What we never do

• We never sell personal information or accounting data, and we never rent or trade it.
• We never use it for advertising, and we don't share it with advertising networks or data brokers.
• We never use it to train AI or machine-learning models. Xero's and Intuit's terms prohibit this too.
• We never write to a client's QuickBooks Online or Xero file.
• We never combine one firm's client data with another firm's. Each firm's data is kept separate and is visible only to that firm's users and to the client users it invites.

7. Connecting QuickBooks Online and Xero

• Permission first. A connection only happens after someone with the right access to the file signs in on Intuit's or Xero's own consent screen and approves it. We never see their QuickBooks Online or Xero password.
• Read-only. For QuickBooks Online we request only the com.intuit.quickbooks.accounting scope, and we use it only to read. For Xero we request read-only scopes.
• Encrypted tokens. Access and refresh tokens are encrypted at rest with AES-256-GCM, using a key kept separately from the database in AWS Secrets Manager. Tokens are used only on our servers and never reach your browser.
• Refreshing. We refresh each connected file on a schedule (about once a day) and when a user presses refresh.
• Disconnecting. A firm can disconnect a file at any time from the Service. A client can also remove our access from inside QuickBooks Online (Apps) or Xero (Connected apps). When a file is disconnected in the Service, we revoke the tokens with Intuit or Xero and delete the stored tokens immediately. If we're told a file was disconnected from the QuickBooks Online or Xero side, we delete the stored tokens as soon as we learn of it. What happens to the stored totals is set out in section 11.

8. Who we share information with

We share information only with the service providers who help us run the Service (our subprocessors), and only as much as they need. Each one is bound by contract or by its published terms to protect the information.

We may also share information:

• with your own firm: client data is visible to the firm that connected it, and a client user sees only the card the firm shares with them
• with our professional advisers (such as lawyers and auditors), under confidentiality
• when the law requires it, or to protect people's safety or our legal rights. Where we're allowed to, we'll tell the firm first.
• with a buyer or successor if Twine's business is sold or restructured. The information would stay protected under this policy, and we'd tell you.

We'll update this list before we add a new subprocessor that handles client accounting data, and we'll tell firm account owners by email at least 30 days beforehand.

9. Where your information is stored

Everything the Service stores (accounts, encrypted tokens, account mappings, totals, audit logs and backups) is held in Australia, in AWS's Sydney region.

Some providers in section 8 handle limited information outside Australia: Cloudflare (the sign-in check), Intuit and Xero (which already hold the client's data and process our requests in their own systems), Stripe (payments) and our email provider. That means personal information may be disclosed in the United States, New Zealand and other countries where these providers operate. We choose established providers with strong security and privacy commitments, and we take reasonable steps under APP 8 to make sure they handle the information consistently with the APPs.

10. How we protect information

We take security seriously. Here's what we do:

• Encryption: traffic is encrypted in transit with HTTPS (TLS). The database, its backups and its storage are encrypted at rest. OAuth tokens get an extra layer of AES-256-GCM encryption with a separately held key.
• Secrets management: keys and secrets are held in AWS Secrets Manager. They're never stored in code and never logged.
• Private network: the database can't be reached from the internet, only by our application server. Server access is through AWS Systems Manager, with no open SSH port.
• Sign-in protection: passwords are hashed with scrypt. Sign-in has a Cloudflare Turnstile CAPTCHA and limits on repeated failed attempts. Sessions expire after 12 hours.
• Multi-factor authentication: firm users can turn on MFA with an authenticator app (Settings → Security). It's optional, but we strongly recommend it, especially for firm owners and admins.
• Separation: every request is checked against the firm it belongs to, so one firm can never see another firm's data.
• Least access: only the people who need it to run and support the Service can access production systems, and access is logged.
• Backups: the database is backed up automatically and backups are kept for 7 days.

No system is perfectly secure, but we work hard to keep your information safe and we'll be upfront with you if something goes wrong (see section 13).

11. How long we keep information

We keep information only as long as we need it for the purposes in this policy, or as the law requires. After that we delete it or de-identify it.

12. Deleting your information

• Disconnect a file: a firm can disconnect any client file at any time. Tokens are revoked and deleted immediately, and the stored totals and mappings follow the timing in section 11.
• Close your account: a firm owner can close the firm's account from settings or by emailing us. We'll disconnect every file, revoke and delete all tokens, and delete the firm's data within the period in section 11. We only keep what the law requires us to keep (such as invoices).
• Ask us: anyone can ask us to delete their personal information by emailing support@twineapps.co. If you're a client and your firm connected your file, we'll work with the firm, and we can always disconnect your file and delete the data we hold about it. We'll confirm when the deletion is done.

13. If there's a data breach

If we suspect a data breach, we'll act quickly to contain it, assess it and reduce any harm.

• Australia (Notifiable Data Breaches scheme): if a breach is likely to cause serious harm to anyone, we'll notify the people affected and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, as Part IIIC of the Privacy Act requires. If we only suspect a breach, we'll finish our assessment within 30 days, and aim to finish it much sooner.
• Firms: we'll tell affected firms without undue delay, and aim to do so within 72 hours of becoming aware of a breach affecting their data. We'll explain what happened, what information was involved, what we're doing about it and what they can do. That way firms can meet their own obligations to their clients.
• Overseas: where the GDPR, the UK GDPR or the NZ Privacy Act applies, we'll help firms meet their notification duties, and we'll notify regulators and individuals where we're responsible for doing so.
• Intuit and Xero: we'll notify Intuit and Xero of any incident involving their customers' data, as their developer terms require.

14. Your rights (Australia)

You can:

• access the personal information we hold about you
• correct it if it's wrong, out of date, incomplete or misleading. Firm users can update most details themselves in settings.
• opt out of marketing emails at any time using the unsubscribe link or by emailing us
• ask us to delete your information (see section 12)
• complain if you think we've mishandled your information (see section 22).

Email support@twineapps.co. We'll need to confirm who you are, and we'll respond within 30 days. We don't charge for requests. If we can't do what you ask (for example, because the law requires us to keep something), we'll explain why in writing and tell you how to complain.

15. If you're in the European Union or the United Kingdom

If the GDPR or the UK GDPR applies to you:

• Our roles: as explained in section 2, Twine is a processor for client accounting data (the firm is the controller) and a controller for account, billing, support and security data.
• Legal bases for the data we control:
• contract: to provide the Service to the firm and its users
• legitimate interests: to keep the Service secure, prevent fraud, improve the Service and send business-to-business updates. You can object to any of these.
• legal obligation: for tax and accounting records
• consent: where we ask for it. You can withdraw consent at any time.
• Your rights: access, rectification, erasure, restriction, data portability, objection (including to direct marketing at any time), and withdrawing consent. For client accounting data, we'll pass your request to the firm that controls it and help them answer it.
• International transfers: we store data in Australia. The European Commission and the UK haven't recognised Australia as giving "adequate" protection, so we rely on the EU Standard Contractual Clauses or the UK International Data Transfer Addendum (or another lawful mechanism) for these transfers.
• Complaints: you can complain to your local data protection authority, for example the UK Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to sort things out with you first.

16. If you're in New Zealand

We'll handle personal information about New Zealanders in line with the Privacy Act 2020 (NZ), including its Information Privacy Principles. You can ask to access or correct your information as set out in section 14, and you can complain to the Office of the Privacy Commissioner (privacy.org.nz). We'll notify serious privacy breaches as that Act requires.

17. If you're in the United States

• We don't sell personal information and we don't share it for cross-context behavioural advertising, as those terms are used in US state privacy laws such as the California Consumer Privacy Act.
• We collect the categories of information in section 3 (identifiers, commercial and billing information, internet activity on our Service, and business accounting information) for the purposes in section 5, and we disclose them only to the providers in section 8.
• Depending on where you live, you may have the right to know, access, correct or delete your personal information, and to not be treated differently for using these rights. Email us to make a request. An authorised agent can make it for you, with proof of authorisation.
• We honour Global Privacy Control signals as an opt-out where the law requires. We don't track you across other websites.

18. Cookies

We use only the cookies the Service needs to work:

We don't use advertising or third-party analytics cookies in the Service.

19. Children

The Service is for businesses and is not meant for anyone under 18. We don't knowingly collect information from children.

20. Automated decisions

The Service calculates totals from accounting data so firms and their clients can see them. It doesn't make decisions about individuals that have legal or similarly significant effects. Firms decide which accounts count towards each total, and they can review and change those choices.

21. Changes to this policy

We may update this policy as the Service, the law or our providers change. We'll post the new version here with a new "Last updated" date. If the change is significant, we'll also email firm account owners at least 30 days before it takes effect, unless we need to make it sooner for legal or security reasons.

22. Contact us and complaints

We're a small team, and we read every message ourselves.

Privacy contact: Trent Yesberg, Twine Apps Pty Ltd
Email: support@twineapps.co
Post: Townsville QLD, Australia
Website: twineapps.co

If you have a complaint, please tell us what happened and how you'd like it resolved. We'll acknowledge it within 5 business days and aim to resolve it within 30 days.

If you're not happy with our response, you can contact the Office of the Australian Information Commissioner: oaic.gov.au, phone 1300 363 992. People outside Australia can contact the regulators listed in sections 15 to 17.