Privacy Policy

Ovio is an Australian record-keeping and tax-time preparation tool for small businesses, sole traders, and freelancers. In this policy, the terms Ovio, we, us, and our mean Loom Labs Pty Ltd (ABN 21 677 704 666), the operator of the Ovio service at ovio.au, app.ovio.au, api.ovio.au, and related Ovio domains.

This policy explains how we collect, use, disclose, store, and protect information when you visit the public website, join an Ovio product waitlist, create an account, use Ovio, connect third-party services, send receipt material to Ovio, pay for a plan, or contact support. It may be amended as the Ovio service, our providers, or applicable requirements change.

We handle personal information under applicable Australian privacy obligations, including the Australian Privacy Principles where they apply to us. You may ask to access or correct personal information we hold about you, and you may make a privacy complaint by contacting Ovio's Privacy Officer at [email protected]. We may need to verify your identity before acting on account-specific requests. If you are not satisfied with how we deal with a privacy complaint, you may be able to contact the Office of the Australian Information Commissioner.

We collect information when you provide it directly, including when you join a product waitlist, when you upload or forward receipt material, when you import bank CSV files, when you connect or use third-party services, when payment and support providers send us status updates, and when our systems create logs needed to run, secure, and improve Ovio.

Receipts, invoices, bank CSV files, emails, WhatsApp messages, attachments, exports, and support requests may include personal information about customers, suppliers, employees, contractors, advisers, or other third parties. You are responsible for ensuring that you have authority, consent, or another lawful basis to provide that information to Ovio and to allow Ovio and its providers to process it for the purposes described in this policy.

Receipts, bank records, emails, WhatsApp messages, support attachments, and other materials you provide may incidentally include sensitive information. Do not submit sensitive information to Ovio unless it is reasonably necessary for your use of the service and you are authorised to provide it. Where sensitive information is included in records you submit, we process it only as part of providing, securing, supporting, and administering Ovio, or as otherwise required or permitted by law.

Ovio uses AI to extract structured fields from receipt images and PDFs and to make bank transaction descriptions easier to review. Information from records you submit, including receipt images, PDF pages, merchant details, dates, amounts, GST fields, transaction descriptions, and surrounding review context, may be sent to AI providers for those tasks. Langfuse may process prompt, model-call, trace, error, and observability metadata needed to run, debug, monitor, and improve the reliability and product quality of Ovio AI workflows. Where practicable, improvement analysis uses aggregated or de-identified information. AI output may be incomplete or incorrect. You must review Ovio AI suggestions before relying on them. Ovio does not use AI to decide business versus personal use, infer GST when GST is not shown, lodge BAS/GST, or provide tax, accounting, legal, or financial advice. We do not use your submitted receipt, bank transaction, workspace, or business records to train general AI models.

If you choose Google sign-in, Google may provide Ovio with basic Google account information needed for sign-in: your name, email address, profile image, and Google account identifier. Google sign-in does not give Ovio access to your Gmail.

Where WhatsApp receipt forwarding is enabled, Ovio receives receipt photos, files, sender details, message content, media, delivery status, and security metadata through the WhatsApp Business Platform or Cloud API. Ovio may also send service replies through WhatsApp about receipt delivery, routing, or processing. WhatsApp is operated by Meta, and Meta may process sender, message, media, delivery, device, and diagnostic data globally under Meta's and WhatsApp's own terms, privacy policies, infrastructure, retention rules, and cross-border processing arrangements. You can stop using WhatsApp receipt forwarding by not sending further messages, disconnecting the receipt source where available, replying STOP where supported, or contacting [email protected].

Ovio uses cookies and similar technologies for sign-in sessions, trusted browsers, security checks, and site operation. We use Sentry, Langfuse, server logs, and product measurement technologies to understand errors, AI workflow reliability, website and product usage, referral sources, campaign performance, and feature quality. We may use other analytics or marketing measurement providers as those systems change. We may use local or session storage for interface state or preferences. Ovio uses httpOnly cookies rather than browser storage for auth tokens. We may use Cloudflare Turnstile to reduce automated abuse. Do not block security cookies if you need to sign in or use protected parts of Ovio.

We may send service messages about security, account access, billing, receipt ingest, support, product changes, and legal updates. These are not marketing messages and may be required to provide Ovio. We may also send product or marketing communications where permitted by law. Marketing communications will identify the sender and include a functional unsubscribe or opt-out method where required by Australian spam laws. You can opt out of marketing communications, but not required service or account messages. If you join the Ovio Request waitlist, we may contact you about Request development and availability. You can opt out of those updates at any time using the method included in the message or by contacting us.

We share information with service providers only as needed to run Ovio, secure it, process user-directed records, provide support, manage billing, measure product or marketing performance, or meet legal obligations. Providers may have their own terms, privacy policies, retention practices, subprocessors, and cross-border processing arrangements. We may also disclose information in connection with a restructure, financing, merger, acquisition, sale, or transfer of the Ovio business or assets. We do not sell personal information. Current providers that may process account, business, receipt, billing, support, security, or operational information include:

We use technical and organisational safeguards appropriate for an early-stage SaaS product, including private file storage, time-limited file links, server-side file validation, hashed passwords, httpOnly auth cookies, MFA support, scoped application access, webhook signature checks, and operational logging. Providers may process or store data in Australia, the United States, the European Union, the United Kingdom, Singapore, or other countries where they or their subprocessors operate, and those locations may change as provider infrastructure changes. Where Australian privacy law requires reasonable steps before disclosing personal information overseas, we take reasonable steps in the circumstances to ensure overseas recipients handle it consistently with the Australian Privacy Principles or that another permitted basis applies. Ovio personnel and contractors may access information only where reasonably needed for operations, support, security, billing, legal, or abuse-handling purposes.

If we suspect a data breach, we will assess it under applicable law. If we identify an eligible data breach under Australia's Notifiable Data Breaches scheme, including where unauthorised access, disclosure, or loss of personal information is likely to result in serious harm and remedial action has not prevented that risk, we will notify affected individuals and the Office of the Australian Information Commissioner as soon as practicable where required.

We keep information while your account is active and for as long as reasonably needed for service operation, billing, security, backups, legal compliance, dispute handling, tax and accounting records, fraud prevention, product integrity, and legitimate business records. Waitlist entries are kept while they are useful for the stated product-update purpose or until you ask us to remove them, subject to records we must retain. You can request access, correction, export, or deletion by contacting us. Deleting an account, workspace, connected service, or receipt source may not immediately remove information from backups, logs, billing records, security records, legal records, or records we are legally required or reasonably entitled to keep. Disconnecting a connected service stops future collection from that connection but does not automatically delete records already imported into Ovio.

You can ask us to access or correct personal information we hold about you. If you have a privacy complaint, email Ovio's Privacy Officer at [email protected] with enough detail for us to investigate. We aim to respond within 30 days where practicable and may need to verify your identity before acting on account-specific requests. If you are not satisfied with our response, you may be able to complain to the Office of the Australian Information Commissioner.

Ovio is designed for business record keeping by adults, small businesses, sole traders, and freelancers. It is not directed at children. Some public website browsing or general enquiries may be possible without identifying yourself, but most Ovio features require an identified account, workspace, billing status, and security records. Do not use Ovio if you are not able to enter into these arrangements or do not have authority to provide the business records you submit.

We may update this policy as Ovio, our providers, or legal requirements change. The latest version will be posted on this page with a new last-updated date. Contact Ovio's Privacy Officer at [email protected].