Privacy policy

Recount helps bookkeeping firms and businesses in Australia handle the accounting work that arrives by email and WhatsApp: supplier bills, receipts, timesheets, remittances and related correspondence. This policy explains what information we handle, why, where it is kept, who we share it with, and the choices you have.

1. Who this applies to

• Customers — firms and businesses that use Recount, and the people they invite to it.
• People whose information reaches us through a customer — for example the sender of an email in a connected mailbox, or a person named on a bill. We handle that information on the customer’s behalf, as their service provider.

2. What we collect

• Account details: your name, email address and sign-in identifiers from the provider you sign in with (Microsoft, Google or Xero). We do not store passwords.
• Connected mailboxes: when you connect a mailbox (Microsoft 365 or Gmail), its email address, and the emails and attachments in it that Recount reads to do its work.
• Connected ledgers: when you connect Xero, the organisation and accounting records Recount needs to prepare and post the work you approve, including your organisation’s name, your contacts and suppliers, your payroll employees, pay runs and pay rates, your chart of accounts and tax rates, your invoices and bills, your bank accounts, the payments recorded against your invoices and bills, and your reports.
• WhatsApp: if your organisation invites you to send receipts by WhatsApp, the name and mobile number your organisation entered, the date you connected, and the messages, photos and documents you send to Recount’s WhatsApp number. If someone whose number is not connected messages that number, we keep the message for up to 7 days, without downloading any file attached to it, and then delete it.
• Documents you submit, such as timesheets, bills and receipts.
• Operational records: what Recount did and when (for example that a message was read, filed or sent), kept as an audit trail. These records do not contain the content of emails or messages.

3. How we use it

• To read, classify and extract the accounting documents in your connected mailbox, and show them to you for review.
• To work out who and what an email is about, suggest account codes for bill lines, word the coding rules you confirm, and answer your questions about your books, using the records from your connected Xero organisation.
• If you switch on filing: to organise mail in your mailbox (in Gmail, by adding labels under “Recount” and removing the Inbox label; in Outlook, by moving mail into a “Recount” folder), and to mark it done once processed. We never delete mail, mark it read, or star or flag it.
• To send email from your connected mailbox when your workflow in Recount does so — for example a question to your client about a document, or your own invoice to your customer — only after your organisation is activated.
• For receipts you send by WhatsApp: to read each one, ask you which of your organisations it belongs to (or whether it is personal), file it there as a bill, and reply to you. If you approve bills, to send you an approval request in WhatsApp carrying the bill and its supplier, amount, organisation and account.
• To post the work you approve to your Xero organisation.
• To keep the service secure and working, and to meet our legal obligations.

4. Information from Google

Recount’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Gmail data only to provide the features described in section 3 to you.
• We do not use Gmail data to train or improve AI models, and Gmail-sourced email is excluded from any set of examples we use to test or tune our systems.
• People read Gmail data only when you have appointed them to work on your mail (your own team, or the firm you engage through Recount), for security or abuse investigation, or where the law requires it.
• We do not sell Gmail data or use it for advertising.

5. Artificial intelligence

Email, message and document content is processed by AI models to classify and read it. The records from your connected Xero organisation are processed by AI models to work out who an email concerns, suggest coding and answer your questions about your books: people’s, suppliers’ and contacts’ names, your organisation’s name and the names of the other organisations the same firm or client serves through Recount, your chart of accounts and tax codes, and, when you ask about your books, report figures and payments.

That processing runs on Amazon Bedrock in Australia. The model providers do not receive your data, and it is not used to train models. The models are Anthropic’s Claude and, as additional comparison readers, Qwen (Alibaba) and Nemotron (NVIDIA), all hosted by Amazon Bedrock inside Australia.

6. Where your information is kept

In Australia. Our database and document storage are with Amazon Web Services in Sydney; our application runs on Fly.io in Sydney; our workflow service, Temporal Cloud, runs in Sydney and receives only encrypted data; AI processing runs on Amazon Bedrock in Melbourne and Sydney. Information is encrypted in transit and at rest, and connection credentials (such as your mailbox’s access token) are encrypted with keys held in AWS Key Management Service.

WhatsApp messages and disclosure overseas

WhatsApp messages are carried by Meta’s WhatsApp Business Platform, provided by Meta Platforms, Inc. We have set Recount’s WhatsApp number to store message data at rest in Australia. To deliver messages, Meta may process them outside Australia, including in the United States. This covers the messages, photos and documents you send to Recount’s number and the replies, questions, reminders and approval requests we send you, including the bill details an approval request carries. We remain responsible for how this information is handled under the Australian Privacy Principles. If you would rather not use WhatsApp, your organisation can receive your receipts by email instead.

7. Who we share it with

With the service providers named in sections 5 and 6 (Amazon Web Services, Fly.io, Temporal and Meta), who process it for us under contract; with the services you connect (your mailbox provider and Xero), at your instruction; and where the law requires. We will give you our current list of service providers on request.

Within Recount, your organisation’s admins see whether you have WhatsApp switched on and the date you connected. They never see your mobile number.

8. How long we keep it

• We keep your information while you use Recount and, as a service provider to accounting practices, for up to seven years afterwards so that the records behind posted work remain available, unless you ask us to erase it sooner and the law allows.
• Disconnecting a mailbox stops all access to it straight away: we revoke our permission with the mail provider and destroy our stored access credential. Mail already processed stays under the retention rule above unless you ask us to erase it.
• A receipt you send by WhatsApp is held until you choose where it goes. Once it is filed as a bill, our held copy is deleted and the bill is kept under the retention rule above. A receipt you mark Personal is kept for you, and for no organisation, until you delete it.

9. Your choices

• Disconnect a mailbox or Xero organisation at any time from Settings → Connections. You can also remove Recount from your Google account at myaccount.google.com → Security → Third-party connections.
• Remove your WhatsApp number at any time by sending “Remove my number” to Recount’s WhatsApp number. Your number is disconnected straight away, and messages from it are then treated as coming from an unconnected number.
• Access, correction and erasure: see below.
• Complaints: contact us first; you can also complain to the Office of the Australian Information Commissioner (oaic.gov.au).

10. Asking us to access or delete your information

Email security@recount.au from the address you use with Recount, or say which mobile number you used with WhatsApp, and tell us what you would like: a copy of your information, a correction, or deletion. This includes the receipts you have marked Personal. We confirm we have received your request, check that it is you, and respond within 30 days. Where the information belongs to a customer’s accounting records, we may need to involve that customer, and some records may have to be kept for legal reasons; if so, we tell you which and why.

11. Changes

We will post changes here and, for material changes, tell customers in advance.

Double Digit Pty Ltd, security@recount.au. Effective 27 October 2026. Reporting a security problem: security.

← Back to Recount