Privacy Policy

1. Overview

Registrum Pty Ltd ("we", "us", "our") operates the Registrum platform. This Privacy Policy explains how we collect, hold, use, and disclose your personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and guidance issued by the Office of the Australian Information Commissioner (OAIC). The Privacy Act is the governing instrument for this policy. Registrum is an Australian service for Australian businesses and we do not market to individuals in the European Union.

2. Information We Collect

We may collect the following categories of personal information:

• Account information — name, email address, and password when you register.
• Business data — invoices, expenses, payroll records, inventory, contacts, and financial documents you create within the platform.
• Payment details — billing information processed securely through our third-party payment provider. We do not store full card numbers.
• Usage data — browser type, device information, IP address, pages visited, and feature usage to improve our service.
• Cookies and analytics — we use essential cookies for session management and optional analytics cookies to understand how the platform is used. You can manage cookie preferences via your browser settings.

3. Lawful Basis for Processing

Under the Australian Privacy Principles, we handle your data on the following bases:

• Contractual necessity — to provide and maintain the Registrum service you have signed up for.
• Legitimate interest — to improve our platform, prevent fraud, and ensure security.
• Consent — for optional analytics and marketing communications, which you may withdraw at any time.
• Legal obligation — to comply with Australian tax, financial reporting, and record-keeping requirements.

4. How We Use Your Information

• To operate, maintain, and improve the Registrum platform.
• To process transactions and send related notices (e.g., invoice reminders).
• To provide customer support and respond to enquiries.
• To send service updates and, with your consent, promotional communications.
• To detect, prevent, and address technical issues or security threats.
• To comply with legal obligations, including ATO record-keeping requirements.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

5. Data Security

We implement industry-standard security measures including encryption in transit (TLS) and at rest (AES-256), Row-Level Security for strict data isolation between accounts, multi-factor authentication options, and regular security audits. While no system is completely secure, we take reasonable steps to protect your data from unauthorised access, modification, or disclosure.

6. Third-Party Integrations & Disclosure

We may share your information with:

• Service providers — hosting, payment processing, email delivery, and analytics providers who assist us in operating the platform under strict confidentiality agreements.
• Connected integrations — when you choose to connect third-party services (e.g., banking, e-commerce platforms), we access those APIs solely on your behalf and only as you have configured.
• Legal requirements — if required by law, regulation, legal process, or government request.
• Authorised users — accountants or team members you have explicitly granted access to your data.

Current sub-processors:

• Supabase / AWS (Dublin, Ireland) — primary application database, authentication, file storage and edge functions.
• Basiq Pty Ltd (Sydney/Melbourne, Australia) — ACCC-accredited CDR Data Recipient used to retrieve bank feed data on your behalf.
• Stripe Payments Australia Pty Ltd — subscription billing and Stripe Connect for accepting customer payments.
• Resend — transactional email delivery (invoices, receipts, system notifications).
• Telegram FZ-LLC — optional document delivery channel where you have enabled and authorised it.
• Google (Gemini) and OpenAI — AI providers accessed via the Lovable AI Gateway, used to power the Reggie assistant. Prompts and the records you reference are processed transiently to generate a response; we do not allow them to train on your data.
• Mapbox — address autocomplete on document and contact forms.
• Frankfurter / Open Exchange Rates — public FX reference rates for multi-currency revaluation.
• Cloudflare, Inc. (USA) — provides the Turnstile bot-protection challenge on our sign-up and public lead-capture forms. Cloudflare processes your IP address, user-agent string, browser characteristics, interaction signals and an ephemeral challenge token to distinguish humans from automated traffic and prevent abusive account creation. Data may be transferred to the United States under Standard Contractual Clauses. See Cloudflare's Privacy Policy and the Turnstile Privacy Addendum.

We review this list whenever a new sub-processor is added. Material changes will be communicated as set out in section 15.

7. Cross-Border Data Transfers

Your data is stored on Amazon Web Services (AWS) infrastructure located in Dublin, Ireland (eu-west-1 region). This is a disclosure required by APP 8 (cross-border disclosure of personal information). Before using this provider we took reasonable steps to satisfy ourselves that it handles personal information under contractual and technical safeguards at least comparable to the Australian Privacy Principles.

Registrum is an Australian service for Australian businesses. We do not market to, or target, individuals in the European Union, and hosting in Ireland does not make Registrum or its customers subject to EU data protection law.

We do not transfer your data to any country without adequate safeguards in place.

7b. Bank Feeds & Open Banking Data

When you connect a bank account, Registrum uses Basiq Pty Ltd, an ACCC-accredited Data Recipient under Australia's Consumer Data Right (CDR) framework, to retrieve your transaction data. Basiq stores bank feed data in AWS data centres in Sydney and Melbourne. Your bank data is never stored outside Australia by Basiq except where you select a financial institution that uses Basiq's secure web connector (non-CDR), in which case Basiq's standard data handling terms apply. Bank feed consent is valid for 12 months and will expire automatically. You will receive a reminder in Registrum before expiry. You can withdraw consent at any time from Banking → Bank Feeds → Disconnect. For Basiq's full CDR Policy, visit basiq.io.

8. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Where you make a verified request to delete your account, we delete your personal information within thirty (30) days, except for: (a) records we are required by law to retain, (b) data held by our payment processor under its own retention terms, and (c) copies held in encrypted backups, which are fully removed within ninety-one (91) days.

Statutory retention periods that apply to records held in Registrum:

• Employee and payroll records: seven (7) years, as required by the Fair Work Act 2009 (Cth).
• Tax and financial records generally: a minimum of five (5) years, as required by the Taxation Administration Act 1953 (Cth) s262A and ATO record-keeping rules.

Where both periods could apply to the same record, the longer period governs — payroll records are therefore kept for seven (7) years. Records retained under these obligations are de-identified where the identifying element is not itself required by the statute.

Encrypted backups are disaster-recovery copies, not a records archive. They are sized to our recovery objectives rather than to statutory record-keeping periods: our on-premise copies are swept after 30 days, and our off-site copies expire under an enforced provider lifecycle rule that hides objects after 90 days and permanently deletes them one day later — a maximum backup tail of 91 days from upload. Data you delete, or that we delete on request, ages out of those backups within that window rather than being individually extracted from historical backup copies.

We retain integration traffic metadata (e.g., webhook delivery logs, API call timestamps, status codes, and redacted request headers) for up to two (2) years for security, reliability, and partner-billing purposes. Full request and response payloads are redacted after 30 days.

Audit records of the deletion itself are retained. The entry recording that a deletion was requested, authorised and executed — together with the date and the acting account — is kept in identified form as part of the records we are required to keep and to evidence our compliance with Australian Privacy Principle 11.2. An anonymised record could not perform that function. No ledger content is retained under this exception.

How we verify that an erasure was complete. Immediately after an erasure is carried out, our systems scan every table in our production database for any record still linked to your account or to a business you owned, remove anything the erasure missed, and then scan a second time. The result of that second scan — clean, or the exact tables and record counts still holding data — is stored against your deletion request and shown to the administrator who authorised it. This verification record contains counts only, not ledger content, and exists so that we can demonstrate the reasonable steps required by Australian Privacy Principle 11.2 rather than assert them.

Cancelling a subscription is not a deletion request. Ending a paid plan stops billing and paid-feature access; it does not erase personal information and does not commence the 30-day period described above. Erasure must be requested separately at Profile → Danger Zone.

9. Your Rights

You have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct inaccurate or incomplete information.
• Deletion — request deletion of your account and personal data at Profile → Danger Zone → Request data deletion, or by contacting support@registrum.com.au. The request is scheduled thirty (30) days ahead and may be cancelled by you at any time within that period. If an unresolved matter prevents erasure — for example an active subscription, a business you own that still has other members, an accountant's access grant, a connected payments account or active API keys — the request is marked blocked and the reasons are shown to you and repeated in writing. When the erasure is carried out we send you written confirmation identifying what was removed and what is retained under section 8. Encrypted backup copies expire within 91 days.
• Portability — receive your data in a structured, commonly used format (e.g., CSV export).
• Withdraw consent — opt out of marketing communications or analytics at any time.
• Object — object to handling of your data that relies on our legitimate interests, such as product analytics.

To exercise any of these rights, contact us at support@registrum.com.au. We will respond within 30 days.

10. Data Breach Notification

In line with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth), if we have reasonable grounds to suspect an eligible data breach we will carry out an assessment within 30 days. If the assessment confirms a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable after that determination.

11. Cookies & Tracking

We use the following types of cookies:

• Essential cookies — required for authentication and session management. These cannot be disabled.
• Analytics cookies — help us understand usage patterns. These are optional and can be managed through your browser settings.

We do not use advertising or tracking cookies.

12. Complaints

If you believe we have breached the Australian Privacy Principles, you may lodge a complaint with us at support@registrum.com.au. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

13. Not a Tax or BAS Agent

Registrum is record-keeping software. We are not a registered tax agent, BAS agent, or SBR-enabled lodgement provider under the Tax Agent Services Act 2009 (Cth). Reports and files generated by Registrum — including BAS summaries and STP files — are for your records only. Lodgement to the ATO must be performed by you or your registered tax/BAS agent via the ATO Business Portal or SBR-enabled software.

14. Smart Notes & Knowledge Base

The Smart Notes module lets you create markdown notes, organise them with tags and folders, link them to your records (invoices, jobs, contacts, etc.), and use templates. The following applies specifically to Smart Notes data:

• Content ownership. You retain full ownership of all note content, tags, folders, and links you create. Registrum holds them solely to provide the service to you.
• Storage and limits. Each plan has a maximum number of notes and total storage size. We measure note count and storage in bytes solely to enforce your plan's limits — this usage data is not shared with third parties or used for marketing.
• No automatic overage charges. When you reach 100% of your plan's notes or storage limit, new notes are blocked and you are shown an upgrade option. We never automatically bill you above your chosen plan price. Any plan change requires your explicit confirmation.
• Visibility. Notes marked "Private" are visible only to you. Notes marked "Shared" are visible to other authenticated members of your organisation.
• Linked records. When you link a note to a record (e.g. an invoice or contact), only the link reference is stored — no additional copy of that record is created.
• Export and deletion. You can export all your notes as Markdown or CSV at any time, and delete individual notes. Deletion of your entire account can be requested by contacting support, in line with the rights set out in section 9.

14b. Children & Minors

Registrum is business software intended for people aged 18 and over. We do not knowingly collect personal information directly from children as account holders, and the platform is not directed at or marketed to children.

• Account holders and invited users. Accounts, invitations and advisor access are for adults only. If we become aware that an account holder or invited user is under 18, we will close that access and delete the associated account data in line with section 8 (Data Retention).
• Records you enter about others. You may lawfully record details of employees, customers or contacts who are under 18 — for example a junior employee's date of birth for payroll and superannuation purposes. That information is your record: you are the entity responsible for collecting it lawfully under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and Registrum processes it only on your instructions to provide the service.
• Contact. If you believe a child has created an account, or that a child's personal information has been provided to us in error, contact us using the details in section 16 and we will investigate and act promptly.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notification. Your continued use of Registrum after changes are posted constitutes acceptance of the updated policy.

16. Contact Us

For privacy-related enquiries, contact our Privacy Officer at:
support@registrum.com.au