Privacy Policy

Last updated: 19 September 2026 · Applies to the Tax-M8 mobile app and website

This is a plain-English draft prepared as a starting point. It has not yet been reviewed by a lawyer. Please have it reviewed by an Australian legal professional before you publish or rely on it.

Tax-M8 ("Tax-M8", "we", "us" or "our") respects your privacy. This Policy explains how we collect, use, store, disclose and protect your personal information when you use the Tax-M8 app and website (together, the "Service"), and how we comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who we are

Tax-M8 is an Australian-based provider of educational and organisational tools for individuals managing income, expenses and end-of-financial-year (EOFY) preparation. Contact details for privacy matters are in section 12.

2. Information we collect

Information you give us

Account information — your email address and password (passwords are stored in hashed form by our authentication provider, never in plain text).
Financial and tax information you enter — income entries, expenses, GST/BAS details, gifts and PR records, tax settings and notes. You choose what to add.
Receipt images and documents you upload.
Bank statement data you choose to import — the date, description and amount of each transaction row in a CSV file you select. We do not connect to your bank and never receive your banking credentials.
Vehicle trip records — the date and total kilometres of work trips you log, so they can be claimed at tax time.
Support and feedback — messages you send us, including via the website contact form.
Creator program details — if you join as a creator, your name, platform, payout details and referral code.

Location information (drive tracking)

Tax-M8 includes an optional vehicle logbook for claiming work-related travel. If you use it, the app reads your device location only between the moment you tap "Start Drive" and the moment that trip is finished, and uses it solely to calculate the distance of that trip.

We store only the date and total kilometres of the trip. We do not store your route or location history.
Location is never sold, never shared with advertisers, and never sent to our AI provider.
On iOS you may grant "Always" access so measurement continues with the screen off while you drive. If you grant "While Using the App" instead, the feature still works whenever Tax-M8 is open.
Location access is entirely optional — the rest of the app works fully without it, and you can revoke it at any time in your device settings.

Information collected automatically

Device and usage data — app version, device type, operating system and basic usage events, used to keep the app working and improve it.
Crash and diagnostic data — collected to detect and fix bugs.
Subscription status — whether you hold a free, trial or Tax-M8+ entitlement.

3. How we use your information

To provide and operate the Service, including saving your records and generating estimates and summaries.
To provide AI-assisted features, such as reading receipts, categorising imported bank transactions and answering plain-English questions.
To calculate the distance of work drives you choose to track, for your vehicle logbook.
To manage subscriptions, trials and entitlements.
To provide support and respond to your enquiries.
To improve, secure and troubleshoot the Service.
To run the creator program, where applicable.
To meet our legal obligations.

We do not sell your personal information.

4. Service providers and disclosure

We share information only as needed to run the Service, with providers bound to protect it. These currently include:

Supabase — secure database, authentication and file storage.
RevenueCat, Apple App Store and Google Play — subscription management and billing. Payment card details are handled by Apple/Google, not by us.
OpenAI — processing for AI features: reading receipt images, categorising the bank transaction rows you import, and answering plain-English questions. Data sent for processing is limited to what the feature needs, is sent from our secure backend rather than your device, never includes your credentials, and never includes location data.
Firebase (Crashlytics) — crash and diagnostic reporting.
Web3Forms — delivery of website contact-form messages.

We may also disclose information where required by law, to protect our rights or users' safety, or in connection with a business transfer.

5. Overseas disclosure

Some of our providers store or process data outside Australia (for example, in the United States). Where this occurs, we take reasonable steps to ensure your information is handled consistently with the APPs. By using the Service, you acknowledge this overseas processing.

6. How we store and protect your information

Your records are stored on managed cloud infrastructure with access controls, including row-level security that restricts each account to its own data, and encryption in transit. Receipt and document files are kept in private storage scoped to your account. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information from misuse, loss and unauthorised access.

7. How long we keep it

We keep your information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or de-identify your personal information within a reasonable period, except where we are required to retain certain records by law.

8. Your choices and rights

Access and correction — you can view and edit your records in the app, and request a copy of your data.
Export — you can export your data from within the app.
Deletion — you can delete your account and associated data from the app's settings.
Complaints — if you have a privacy concern, contact us first (section 12). If unresolved, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. Children

Tax-M8 is intended for adults (18+) managing their own financial records. It is not directed at children, and we do not knowingly collect personal information from children.

10. Cookies and the website

Our website uses minimal cookies or similar technologies necessary for basic functionality and to handle contact-form submissions. We do not use the website to build advertising profiles of you.

11. Changes to this Policy

We may update this Policy from time to time. We'll post the updated version here and change the "Last updated" date. Significant changes may be notified in the app.

12. Contact us

For privacy questions or requests, email hello@tax-m8.com or use our contact page.

Reminder: Tax-M8 provides educational guidance and organisational tools only. It does not provide tax or financial advice and does not lodge tax returns.