Privacy Policy

Our role when practices use Gatherify

We handle personal information in two different capacities.

• On our own behalf. When you visit this website, apply for the beta, contact us, or use Gatherify as a member of a practice’s team, we decide how your information is handled, and this policy applies directly.
• On behalf of an accounting practice. When a practice uses Gatherify to work with its clients, we handle those clients’ information as the practice’s service provider, under our agreement with that practice. The practice decides what is collected and why, and is responsible for telling its clients how their information is handled.

If you are a client of an accounting practice that uses Gatherify, please contact your practice first about your information. We will work with the practice to help it respond.

Information we collect

Beta applicants and enquiries

• Your name, work email address, practice name and role.
• Optional details about your practice that you choose to share, such as lodgement volumes, team size, the software you use, your biggest bottlenecks and any notes.
• The content of emails, calls and other messages you send us.

Practice team members who use Gatherify

• Your name, work email address, role and the practice you belong to.
• Sign-in and account details, and a record of the actions you take in the app, such as approvals.

Clients of practices (handled on the practice’s behalf)

• Names, contact details and details of related entities, such as companies, trusts and SMSFs.
• Prior-year returns, financial and tax information, and documents added to the client’s file or uploaded through the client portal.
• Emails, call and meeting records, and other correspondence the practice chooses to make available to Gatherify.
• Responses to information requests.

This information can include tax file numbers (TFNs) and other government identifiers. TFNs are handled in line with the Privacy (Tax File Number) Rule 2015. We don’t ask for sensitive information, such as health information, but it can appear in documents a client provides (for example, medical expenses supporting a claim). When it does, we protect it in the same way as all other client information.

Technical information

When you use our website or the Gatherify service, our systems record technical information such as your IP address, browser and device type, and the date and time of your visit. We use this to operate the service, keep it secure and prevent abuse.

How we collect information

We collect personal information:

• directly from you, when you complete a form, email or call us, or use Gatherify;
• from the accounting practice you work for or are a client of, including from systems the practice connects to Gatherify, such as FYI or Xero Practice Manager;
• from clients through the client portal, when they respond to a request from their practice; and
• automatically, when you use our website or the Gatherify service.

If we receive personal information we didn’t ask for and could not have collected under the APPs, we will destroy or de-identify it where it is lawful and reasonable to do so.

Cookies and analytics

This website does not use advertising or analytics cookies. The Gatherify app uses cookies and similar technology only where needed to keep you signed in and to protect your account. Our hosting and security providers may process your IP address to deliver pages and block malicious traffic.

How we use information

We use personal information to:

• assess beta applications, contact applicants and set up the beta with participating practices;
• provide, operate, support and secure the Gatherify service;
• prepare information requests, check what comes back, and support review on a practice’s behalf;
• send service messages, such as confirmations, notifications and account information;
• understand how Gatherify is used and improve it, including through feedback sessions;
• meet our legal and regulatory obligations, and resolve disputes.

We only use client information provided by a practice to deliver the service to that practice. We never sell personal information.

Marketing

We may send you updates about Gatherify if you have applied for the beta or asked to hear from us. Every marketing email includes a way to unsubscribe, or you can contact us to opt out at any time. We never send marketing to a practice’s clients.

Gatherify AI and automated decisions

Gatherify AI uses information in a client’s file, including prior returns, documents, correspondence and responses to earlier requests, to suggest what a practice should ask that client, check whether what comes back is complete, and estimate how much risk and review a job involves.

These outputs are recommendations to the practice, not decisions. Nothing reaches a client without a person at the practice reviewing and approving it, and Gatherify AI does not make decisions about individuals that have legal or similarly significant effects without human review. Every recommendation is logged with its source, its confidence and who approved it.

Some of this processing is carried out by third-party AI model providers acting as our service providers. We do not use customer data to train public AI models, and we select providers and settings so that customer data is not used to train their models.

Who we share information with

We disclose personal information only as needed for the purposes in this policy, including to:

• service providers who help us run Gatherify, such as cloud hosting and storage, content delivery and security, sign-in and authentication, email delivery, and AI model providers;
• the accounting practice that the information relates to;
• software a practice chooses to connect to Gatherify, such as FYI or Xero Practice Manager;
• our professional advisers, auditors and insurers;
• a buyer or successor, if our business or assets are sold or restructured, subject to equivalent privacy protections; and
• government agencies, regulators or law enforcement, where required or authorised by law.

Our service providers may only use personal information to provide services to us, and are required to keep it secure and confidential.

Overseas disclosure

Information held in the Gatherify service is stored in Australia. Some of our service providers process personal information outside Australia, including for email delivery, content delivery and security, and AI model processing. These providers are located in, or operate from, the United States and other countries where they maintain infrastructure.

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs, including through contractual obligations and reviewing each provider’s security and data-handling practices.

How we protect information

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include:

• encrypting information in transit and at rest;
• keeping each practice’s data separate from every other practice’s data;
• limiting access by role, so people only see what they need for their work;
• additional protection for tax file numbers, which are masked by default; and
• logging access to and changes made to client information.

Data breaches

If we become aware of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme. Where the breach involves information we hold for a practice, we will notify that practice promptly and work with it to respond.

How long we keep information

We keep personal information only for as long as we need it for the purposes in this policy, or as required by law. When we no longer need it, we take reasonable steps to destroy or de-identify it securely.

Information held for a practice is kept in line with our agreement with that practice. When a practice stops using Gatherify, it can export its data, after which we delete or de-identify it, except where we are required by law to keep it.

Dealing with us anonymously

You can browse this website and ask us general questions without telling us who you are. We need your name and contact details to assess a beta application, set up an account, or provide the Gatherify service.

Accessing and correcting your information

You can ask for access to the personal information we hold about you, or ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Contact us using the details below. We will confirm your identity before acting on a request, and respond within a reasonable period, usually within 30 days. We don’t charge for making a request.

If we refuse a request, we will tell you why in writing and how to complain. If the information is held on behalf of an accounting practice, we will refer your request to that practice and help it respond.

Making a complaint

If you think we have breached the APPs or mishandled your personal information, please contact us in writing using the details below. We will acknowledge your complaint, investigate it, and aim to respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.

Changes to this policy

We may update this policy as Gatherify changes or the law changes. The current version is always available on this page, with the date it was last updated. If we make a significant change, we will let affected customers know.

Contact us

For privacy questions, requests or complaints, contact our Privacy Officer: