DRAFT — pending legal review before production. This document has not been reviewed by a lawyer. It is drafted to meet Xero developer-platform T&Cs clause 9 and clause 12, Security Standard §4, and the Security Requirements (privacy policy accessible from the website), and must be cleared by a legal reviewer before it is relied upon in production. It is not legal advice.
Orvikon — Privacy Policy
Version: 2026-07-01 · Last updated: 1 July 2026
This Privacy Policy explains what personal and business information Orvikon (“we”, “us”, “our”) collects, why we collect it, and how we store, use and share it. It applies to the Orvikon platform (the “Service”). It forms part of our Terms of Use.
1. What we collect
- Account & identity — your name and email address (managed through our authentication provider), and your role within your company.
- Company details — your company’s ABN, registered name, addresses, trade capabilities and service areas.
- Job & financial data — projects, jobs, offers, completion evidence, fees, and invoices you create or receive through the Service.
- Uploaded files — photos, notes, company logos and user avatars you upload.
- Location data — addresses you enter, which we geocode to map them to service-area zones.
- Usage data — basic technical and usage information generated as you use the Service (for example, request logs used to operate and secure the platform).
2. Why we collect it
We collect this information to operate the job and invoice workflow, verify that companies are legitimate, deliver invoices to the correct counterparty, connect your accounting where you choose to, provide the map and service-area features, and to secure and support the Service.
3. How we store it
Your data is stored in a Supabase-hosted PostgreSQL database and object storage. Data is encrypted at rest and transmitted over encrypted (TLS) connections. Where we hold credentials for an integration you connect (such as Xero access tokens), those tokens are encrypted before they are stored.
Data residency / hosting region: Australia.
4. How we use it
We use your data strictly to provide, secure and support the Service as described above. We do not sell your data. We do not use your data — including any data sourced from Xero — to train, fine-tune, adapt or enhance any artificial-intelligence or machine-learning model, and we do not pass it to a third party except as described in Section 5 (see our AI / API-Data Use Policy).
5. How we share it — third parties (sub-processors)
We share data only with the service providers we need to operate the Service. Each is listed here with the business need it serves. This is a living list: any new provider that touches your data is added here before that integration ships.
| Provider | What it touches | Why (justifiable business need) |
|---|---|---|
| Supabase | Authentication, PostgreSQL database, object storage | Core platform infrastructure that runs the Service |
| Xero (only when you connect it) | Invoice and paid-status data pushed to your connected organisation | Accounting sync to the software you already use |
| An email delivery provider (selected at cutover) | Invoice emails and the attached invoice PDF | Deliver invoices to the counterparty |
| Australian Business Register / ABN Lookup | Your company ABN and registered name | Verify company legitimacy at signup |
| Nominatim / OpenStreetMap | Addresses you enter, for geocoding | Map addresses to service-area zones |
We do not currently use any third-party error-tracking, analytics or telemetry service. If we add one, it will be listed here before it is switched on.
Data shared with Xero: once your data is received by Xero through a connection you authorise, Xero’s own terms and privacy notice govern Xero’s use of that data.
6. Your rights & retention
You may request access to, or correction of, the personal information we hold about you by contacting us (Section 8). We retain your data for as long as your account is active and as needed to provide the Service and meet legal, tax and record-keeping obligations, after which it is deleted or de-identified. (Self-service data export and deletion tooling is planned; until then we handle these requests manually.)
7. AI / data-training
We do not use your data — including data sourced from Xero — to train, fine-tune or adapt any AI model, and we do not pass it to any third party for that purpose. This is a standing commitment; see our AI / API-Data Use Policy.
8. Contact & breach notification
For any privacy question or request, contact us at [email protected]. If a data breach affects your information, we will notify affected users and any regulators as required by law, following our internal incident-response process.
9. Accessibility
This Privacy Policy is accessible from the Orvikon website footer and is linked from the signup form, so it is available before you agree to it.