Privacy Policy
This policy explains how Mostest More Pty Ltd ("we") handles personal information in connection with PayeeGate. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, for people in New Zealand, the Information Privacy Principles in the Privacy Act 2020 (NZ).
1. The short version
- Payment reports and bank files you open in PayeeGate are processed in your browser. They are not uploaded to our servers. Vendor libraries uploaded for Vendor Audit are kept on our server, encrypted, without full account numbers (see the Terms of Use, section 6).
- When you send a check for final approval, a snapshot of the reviewed results is stored on our server for 7 years (see section 2).
- We hold the details needed to run your account (name, work email, role, sign-in and security records).
- Some checks send limited supplier details through our server to official registers. We do not keep full bank account numbers.
- We do not sell personal information or use it for advertising.
2. Information we collect
About users (provided by your organisation or by you):
- name, work email address, organisation, role and licence details;
- a securely hashed password and the secret for your authenticator app (two-factor authentication);
- sign-in and security records: dates and times, IP addresses, failed sign-in attempts, account changes, and acceptance of these terms;
- activity records in our audit log (for example which checks were run, when and by whom);
- anything you send us when you contact support.
About suppliers and their contacts (processed for your organisation): supplier information is mostly about businesses, but some suppliers are individuals (for example sole traders) and their names, ABNs and bank details are personal information. Most of this stays in your browser. Our server only handles:
- ABNs, NZBNs and supplier names sent for register lookups (passed to the Australian Business Register or the NZBN register and cached for up to 30 minutes);
- final approval snapshots: when a user sends a check for final approval, the reviewed results are stored so the chosen AP Manager can approve or return them and the final audit report can be produced: supplier names, ABNs, BSBs, the last 3 digits of account numbers, amounts, findings, comments, the names and email addresses of the preparer and approver, and the history of the review. Files and full account numbers are never stored. Only the sender, the assigned AP Manager and administrators can see a snapshot.
- if your organisation's agreement enables additional bank-account verification services, that agreement will describe what is sent and to whom.
3. How we use it
To create and secure accounts, sign you in, provide the checks you request, keep an audit trail for your organisation, provide support, detect and prevent misuse and fraud, maintain and improve the Service, and meet legal obligations. We do not use personal information for direct marketing to users of the Service without consent.
4. Who we share it with
- Your organisation: its administrators can see its users, licences and audit log.
- Service providers that host or support PayeeGate under confidentiality and security obligations: Replit, Inc. (application hosting and database); Zoho (delivery of account, password and approval emails); Google (web fonts, which receive your IP address when pages load); jsDelivr (delivers the open-source text-recognition (OCR) library used for scanned PDFs to your browser).
- Third-Party Sources for the checks you run: the Australian Business Register, and the NZ Ministry of Business, Innovation and Employment (NZBN register).
- Anyone we are required or authorised by law to disclose to.
5. Overseas disclosure
PayeeGate is hosted by Replit, Inc. Data, including account details, audit records and final approval snapshots, may be stored or processed outside Australia, including in the United States. Some service providers are based overseas (for example Replit, Inc. and Google in the United States) and may access information from outside Australia to provide and support their services; email may be processed by Zoho in the region where its service is provided; and web-font and library requests may be served from overseas locations. We take reasonable steps to ensure these providers protect personal information consistently with the Australian Privacy Principles.
6. Cookies and browser storage
We use a session cookie and a security (CSRF) token that are strictly necessary for signing in. PayeeGate also stores your settings, vendor lists and check history in your browser's own storage on your computer, encrypted with a key our server gives your browser at sign-in; we cannot see this data. We do not use advertising or tracking cookies.
7. Security and retention
We protect information with two-factor sign-in, hashed passwords, encrypted connections, role-based access, and access logging. We keep account details while the account is active and delete or de-identify them within 90 days after your organisation's access ends. Final approval snapshots and their history are kept for 7 years from submission and then deleted, including after access ends. Security and audit logs are kept only as long as needed for security, audit and legal purposes, or as your organisation's agreement requires. Sessions expire after 8 hours.
8. Data breaches
If a data breach is likely to result in serious harm, we will notify affected organisations and individuals and the Office of the Australian Information Commissioner (or, for New Zealand, the Office of the Privacy Commissioner) as required by law.
9. Access, correction and complaints
You can ask to access or correct personal information we hold about you by emailing support@mostestmore.net. If your organisation provided the information, we may refer you to it. If you have a privacy complaint, contact us first; we will respond within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au) or, in New Zealand, the Office of the Privacy Commissioner (privacy.org.nz).
10. Changes
We may update this policy and will post the new version here with its date. Material changes will be shown to users at sign-in.
11. Contact
Privacy contact: Mostest More Pty Ltd (ABN 12 688 336 254) · support@mostestmore.net