1. Who We Are

ReceiptWave Pty Ltd (ABN 25 696 339 992) ("ReceiptWave", "we", "us") provides digital receipt delivery and management services for businesses and consumers in Australia. This policy explains how we collect, use, and protect your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. What Personal Data We Collect

We collect the following categories of personal information:

• Business users: Name, email address, phone number, ABN, business address, and payment information (processed by Stripe).
• Consumers: Email address (if provided), device identifiers, and NFC tap activity. We do not require consumers to create an account.
• Receipt data: Transaction amounts, line items, payment method type (e.g. "Visa ****4242"), date/time, and store location. Receipt data is provided by the merchant's point-of-sale system.

2A. Prospective Merchants

If you register your interest in ReceiptWave, we may collect your email address and any business name, industry or POS system information you choose to provide. We use this information to manage your expression of interest and communicate with you about ReceiptWave and its availability. We may use service providers located or operating outside Australia, including in the United States, to provide communications and related services.

2B. Merchant deliveries

We may collect a merchant's nominated delivery address and recipient details to provide NFC stands, tags or other physical products. The nominated address may be a business or residential address. We may disclose those details to postal, courier or fulfilment providers where necessary to arrange delivery.

2C. Merchant identification information

We may obtain or derive information used to identify your business on digital receipts, including your trading name or bank statement descriptor, from information you provide, your connected point-of-sale provider or automated tools. We will show the proposed descriptor to you so you can confirm or correct it. We use this information to identify your business and transactions within ReceiptWave.

We may use automated or artificial-intelligence services to assist us in standardising or suggesting merchant identification information. Where we do so, we limit the information provided to those services to what is reasonably necessary for that purpose.

2D. Sharing receipts with an accountant, bookkeeper or employer

Your receipts are private unless you choose to share them. If you choose to share receipts with an accountant, bookkeeper, BAS or tax agent, or an employer that uses the ReceiptWave organisation portal, that organisation can see the receipts you share (the business, date, items, amounts, GST and any photo you captured) and your name, and can download copies. We record what you chose, the notice you were shown, and each time the organisation views or downloads your receipts, which you can see in the app. You can stop sharing at any time; copies the organisation has already downloaded stay with it, under its own legal obligations and its agreement with us. We also collect the email addresses, roles and sign-in records of the people who use the portal for an organisation, and the details an organisation gives us when it registers, including its ABN.

3. Why We Collect This Data

• To deliver digital receipts to consumers via NFC tap, claim code, or direct link.
• To provide business analytics, reporting, and sustainability metrics to merchants.
• To process subscription payments and manage billing.
• To send transactional communications (receipt delivery, account notifications).
• To improve our service, monitor performance, and prevent fraud.

4. Third Parties We Share Data With

We share data with the following service providers, each under appropriate data processing agreements, and with an accountant, bookkeeper or employer only where you choose to share receipts with them (section 2D):

• Microsoft Azure (Sydney region) — hosting, database, storage.
• Stripe — payment processing for business subscriptions.
• Square, Shopify, Xero — POS and accounting integrations (only when connected by the merchant).
• SendGrid — transactional email delivery.
• Sentry (United States) — error monitoring and crash reporting (anonymised).
• Anthropic (United States) — automated processing used to read receipt line items and to standardise or suggest merchant identification information.
• Postal, courier and fulfilment service providers — delivery of stands, tags or other physical products.

We do not sell, rent, or trade personal information to any third party.

5. How Long We Retain Data

• Receipt claim links: Active for 48 hours after generation.
• Merchant delivery addresses: Delivery addresses associated with completed hardware deliveries will ordinarily be deleted or de-identified 12 months after delivery unless ReceiptWave reasonably requires the information for a dispute, legal obligation, fraud investigation or another permitted purpose.

5A. Closing a merchant account

Merchant account closure. When a Merchant closes its account, ReceiptWave disables access immediately. The account remains recoverable for up to 30 days. At the end of that period, ReceiptWave deletes or de-identifies personal information that it is no longer required or permitted to retain, subject to information that must be retained by law or remains reasonably necessary for another permitted purpose.

ReceiptWave may retain limited merchant identity information, including the merchant's ABN, trading name and legal name, for so long as reasonably necessary to identify the issuer of receipts previously generated through ReceiptWave or to comply with legal record-keeping requirements.

Other merchant personal information, including contact details, staff accounts, authentication information, integration credentials and delivery addresses, is deleted or de-identified after the recovery period unless ReceiptWave is required or permitted to retain it for another purpose.

Disconnecting a third-party service from ReceiptWave stops ReceiptWave's access to that service. It does not necessarily delete information held independently by the third-party provider under its own terms and privacy policy.

Records kept after closure. We retain a limited record indicating whether an ABN has previously used an introductory offer so that introductory offers cannot be repeatedly claimed. That record does not contain the merchant's name, contact information or transaction history and is stored using a one-way keyed identifier.

After the 30-day recovery period, we delete or de-identify personal information that we no longer need and are not required or permitted by law to retain. Certain limited records may be retained where necessary to preserve historical receipts, meet legal record-keeping obligations, prevent repeated introductory offers, or establish or defend legal rights.

6. Data Security

We protect your data using:

• HTTPS/TLS encryption for all data in transit.
• AES-256 encryption for data at rest in Azure SQL and Azure Blob Storage.
• API key and JWT authentication for all API access.
• Role-based access controls for business staff and admin users.
• Rate limiting on all authentication and sensitive endpoints.

7. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you.
• Correct any inaccurate or incomplete information.
• Request deletion of your personal information (subject to legal retention requirements).
• Complain to us or to the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached.

7.1 Deleting a customer account

If you have the app, you can delete your account yourself: Profile → Delete account. It asks you to confirm twice, and it cannot be undone.

7.2 If you have only ever opened a receipt in a browser

We cannot action a deletion request from you, and we want to be straightforward about why. Opening a receipt link does not create an account. We do not learn your name, your email address or anything else that identifies you — there is nothing on our side we could match a request against, and no way for us to check that a request was really yours.

What we do store is a random code on your device, described in section 8. You can remove that yourself at any time by clearing cookies and site data for this website in your browser settings, and you do not need to ask us. That is the whole of what is held.

If you later install the app and sign in, you get an account with a deletion right, and section 7.1 applies from that point on.

7.3 Businesses: closing an account ends your access, and keeps the receipts

Closing a business account does not delete it. Your access ends immediately: sign-ins stop, API keys are revoked, and any point-of-sale connection is disconnected and its access tokens are erased.

The business record and the receipts already issued to customers are kept. Those receipts belong to the customers holding them — some will need one for a warranty claim or a tax return years later — and they show your trading name and ABN, so the record has to survive for them to keep working. Deleting it would leave a customer holding a receipt from nobody.

Contact details we no longer need for a closed account are removed on our retention schedule.

8. Cookies and Tracking

Our web application uses essential cookies for authentication session management. We do not use advertising cookies or third-party tracking pixels, and we do not track you across other websites.

When you open a receipt at /r/{code} we store a random code on your device: a cookie named rw_device_id. It contains no personal information and is not shared with anyone. Its only use is to keep any stamps you have collected on that device attached to it until you install the app.

If you open a merchant offer page we store a second, separate random code in your browser's local storage, under rw_device_token. It is generated in your browser, is not linked to the cookie above, and is used only to remember that this browser has already responded to an offer.

You can remove both at any time by clearing cookies and site data for this website in your browser settings. Doing so does not delete your receipts.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email to registered business users. The "last updated" date at the top of this page indicates when the policy was last revised.

10. Contact Us

For privacy enquiries, data access requests, or complaints:

• Email: privacy@receiptwave.com
• Security issues: security@receiptwave.com

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner.