Last updated 24 September 2026

Legal

Privacy Policy.

Version 1.2, effective 24 September 2026.

Purpose

This Privacy Policy sets out what Personal Information Dexterous AI Pty Ltd (trading as dexIQ, we, us or our) collects, why we collect it, how we use it, and how we protect it. This includes information accessed from connected platforms such as Google Workspace, Microsoft 365, Xero and other accounting or ERP systems. It also sets out your rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

By accessing or using the Platform or Services, you acknowledge that you have read and understood this Privacy Policy. Capitalised terms used but not defined have the meaning given in our Enterprise Terms and Conditions or End User Terms and Conditions (End User TCs).

Scope

This policy applies to all individuals whose Personal Information we collect in connection with the Platform and Services, including customers, users, prospective customers, suppliers and other visitors to our online properties. It also applies to Personal Information collected through our website, communications, support interactions and other online and offline channels related to the Platform and Services.

We are committed to respecting your privacy, handling Personal Information in a lawful, fair and transparent manner, and complying with the APPs. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and any other privacy laws to the extent they apply to our handling of Personal Information.

Definitions

  • Customer means the party named in the commercial terms who receives the benefit of the Services.
  • Customer data means information and materials a customer or user provides for processing through the Services, which may include Personal Information.
  • Personal Information has the meaning given in the Privacy Act: information or an opinion about an identified individual, or an individual who can reasonably be identified.
  • Sensitive Information has the meaning given in the Privacy Act and includes categories such as health information, biometric data, religious beliefs, sexual orientation and criminal record.
  • User or you means an end user of the Services, as described in the End User Terms and Conditions.
  • Your data means any content or data you upload, input or otherwise make available through the Platform, which may include Personal Information.
  • Connected Platform means a third-party system, such as Google Workspace, Microsoft 365, Xero or another accounting or ERP system, that you connect to the Platform.
  • AI provider, AI or LLM provider means a third-party provider of artificial intelligence or large language model services that dexIQ integrates with to deliver the Services.

References

  • Privacy Act 1988 (Cth)
  • Dexterous AI Pty Ltd Enterprise Terms and Conditions
  • Dexterous AI Pty Ltd End User Terms and Conditions
  • Google API Services User Data Policy

1. The information we collect

  • 1.1 We collect information that is reasonably necessary for our functions and activities, including to operate, secure and improve the Platform and Services.

  • 1.2 Personal Information. This may include your name, role or job title, organisation, business contact details (email, phone number, address), user account identifiers, and authentication information.

  • 1.3 Account and usage information. This includes account registration data, user preferences, licence tier and entitlements, audit logs, access times, activity on the Platform, configuration settings, feature use, and support interactions.

  • 1.4 Transaction and billing information. This includes subscription details, payment method tokens or references, billing contact details, invoices, receipts and payment records. Payment processing is ordinarily handled by third-party payment providers; we do not store full bank or card numbers.

  • 1.5 Customer data and your data. In the ordinary course, customers and users provide data for processing by the Platform, including by connecting third-party systems such as Google Workspace, Microsoft 365, Xero and other accounting or ERP systems. This may include invoices, purchase orders, supplier information, tax numbers, approval workflows, internal references, messages, notes, and emails, attachments, contacts or files accessed through those connections. Customer data and your data may contain Personal Information relating to you or to third parties relevant to your business workflows.

  • 1.6 Technical and device information. This includes IP address, device and browser type, operating system, language settings, referrer URLs, session identifiers, diagnostic data, error logs and similar technical telemetry.

  • 1.7 Communications. This includes emails, in-product messages, support tickets, call notes and feedback you provide, as well as records of your marketing preferences and responses.

  • 1.8 Sensitive information. We do not seek to collect sensitive information (as defined in the Privacy Act). If you choose to include sensitive information in customer data or your data, you must ensure you have the necessary consents and lawful basis to do so. We will only handle sensitive information where reasonably necessary for our functions or activities and as permitted by law.

  • 1.9 How we collect Personal Information. We collect Personal Information directly from you (for example, when you register, configure or use the Platform, communicate with us or participate in demos) and indirectly from your use of the Platform and Services (for example, telemetry, logs, cookies). We may also receive Personal Information from your organisation (as a customer), service providers, or other third parties where permitted by law.

2. Purposes for which we collect and use Personal Information

  • 2.1 We collect, use and disclose Personal Information for purposes reasonably necessary for, or directly related to, our functions and activities, including to:

    • provide, operate, host, secure and support the Platform and Services;
    • create and manage accounts, authenticate Users and administer licences;
    • process transactions, issue invoices and receipts, and manage billing and account queries;
    • process and analyse Customer Data and Your Data to deliver the Services and functionality you request (for example, document capture, classification, extraction and workflow automation);
    • personalise your experience, including to provide in-product tips, configurations, automations and suggestions based on your prior or historical use of the Platform;
    • develop, maintain and improve the Platform, Software and Services, including through diagnostics, analytics, testing, quality assurance, troubleshooting and security monitoring;
    • communicate with you regarding the Services, Platform updates, changes to terms and policies, and respond to enquiries and support requests;
    • comply with legal and regulatory obligations, enforce our agreements, prevent, detect and investigate fraud, misuse or security incidents, and protect our rights, Users and Customers;
    • conduct de-identified and aggregated analytics and reporting to understand usage, performance and trends across our Services;
    • send direct marketing communications about the Services, using contact details you have provided directly to us (not data accessed through a connected platform such as Google Workspace, Microsoft 365 or Xero), where permitted, which you may opt out of at any time.

  • 2.2 We do not use or disclose Personal Information for purposes other than those described in this Privacy Policy, your agreement with us, or as otherwise permitted or required by law.

3. How we use AI, third-party Services and your data

  • 3.1 AI and third-party APIs. The Platform may rely on or integrate third-party Services, software or APIs, including large language models (for example, OpenAI or other LLMs), OCR and data extraction tools. We only disclose the minimum data reasonably necessary to enable the requested functionality and take steps to contractually restrict third-party use and disclosure.

  • 3.2 Model training and learning. dexIQ does not use your data to train foundation or cross-customer machine learning models. We will not learn from users’ data except to improve your experience, including automating suggestions and configurations for your organisation based on your prior or historical use of the Platform, and any data that may be learned for these specific purposes will be de-identified. Any per-customer context retained is scoped to your organisation and used to provide you a service.

  • 3.3 LLM configuration. Where we use LLM Services, we configure requests so that inputs and outputs are not used by the LLM to train or improve the LLM’s models. We also implement data minimisation, access controls and logging in relation to such integrations.

  • 3.4 No sale of Personal Information. We do not sell Personal Information. We may disclose or transfer Personal Information to a third party in connection with any merger, acquisition, sale of all or a portion of our business or assets, corporate reorganisation, or other similar transaction. In such circumstances, we will take reasonable steps to ensure that any recipient of Personal Information will handle it in a manner consistent with this Privacy Policy and the requirements of the Privacy Act. Where required by law, we will notify affected individuals of such a disclosure or transfer.

  • 3.5 Google Workspace and connected platform data. Where the Platform connects to Google Workspace, our access to and use of that data complies with the Google API Services User Data Policy, including its Limited Use requirements. Google Workspace data is used only to provide or improve the Services, is not sold, is not used for advertising, and is not used to train general-purpose or generalised AI models. Where an AI provider processes this data as part of delivering the Services, that processing may occur outside Australia and is subject to the same restrictions set out in this clause 3 and to the cross-border safeguards described in clause 4.

4. Data hosting, location and cross-border disclosure

  • 4.1 Hosting and storage. All production data for the Platform, including Customer Data and Personal Information, is stored in Australia.

  • 4.2 Third-party processing. Some third-party service providers engaged by dexIQ to support the Platform and Services, including cloud hosting providers and AI or LLM providers used to deliver the Services, may operate outside Australia. Where we disclose Personal Information to an overseas recipient, we will take reasonable steps to ensure the recipient will handle the information in a manner consistent with the APPs (for example, by entering into appropriate contractual arrangements) or otherwise as permitted by the Privacy Act.

  • 4.3 Disclosures required by law. We may disclose Personal Information to law enforcement, regulators or courts where required or authorised by law.

5. De-identified and aggregated information

We may de-identify Personal Information and create aggregated datasets and statistics for purposes including service improvement, benchmarking, capacity planning and security. De-identified information does not identify an individual. We may use and disclose de-identified information, including to third parties, provided it is not re-identified.

6. Direct marketing

In accordance with clause 2.1, we may send you marketing communications about the Services or related features and offerings, consistent with applicable law. You may opt out at any time by using the unsubscribe link in our emails or contacting us via the details below. We will respect your preferences.

7. Cookies and similar technologies

We use cookies, SDKs and similar technologies across our website and the Platform to operate our Services, remember your settings, authenticate sessions, improve performance, and perform analytics. Analytics and advertising cookies are set only if you accept them in the cookie banner shown on your first visit. Decline and we keep only what is needed for the website or Platform to function, such as your light or dark theme preference. You can change your choice at any time by clearing your browser’s stored data for the relevant site, which makes the banner appear again. You may also adjust your browser settings to refuse some cookies; however, this may affect functionality.

8. Security

  • 8.1 We implement reasonable technical and organisational measures designed to protect Personal Information, taking into account the nature of the information and the risks associated with processing. These measures are taken against unauthorised access, modification or disclosure, and against misuse, interference and loss. Measures include access controls, encryption in transit, role-based permissions, logging and monitoring, and secure development and change practices. We also require personnel and contractors with access to Personal Information to be subject to confidentiality and data protection obligations.

  • 8.2 No method of transmission or storage is completely secure. You remain responsible for maintaining the secrecy and security of your account credentials and any encryption keys under your control, and for implementing appropriate safeguards within your own systems and networks.

9. Data retention, deletion and export

  • 9.1 Retention of Personal Information. We retain Personal Information for as long as reasonably necessary to provide the Services, fulfil the purposes described in this Privacy Policy, comply with our legal obligations, resolve disputes and enforce our agreements. We apply retention schedules to Customer Data and logs consistent with these purposes.

  • 9.2 Deletion requests and extraction. Upon request by a Customer or as provided in the End User TCs, we may assist with data extraction in a format we make available. Following termination of the relevant agreement, or on request at any time, you can ask us to delete your data, including Google Workspace and other connected platform data, by contacting us using the details in clause 16. We will delete or de-identify it within 90 days of your request, unless we are required by law to retain it for longer. Where we retain backups, deletion from backups occurs in the ordinary course of backup rotation. Additional extraction Services may be available on request and may incur fees.

10. Access and correction

You may request access to, or correction of, your Personal Information that we hold by contacting us using the details below. We may need to verify your identity before responding. Where we refuse access or correction as permitted by law, we will provide reasons. We will respond within a reasonable period.

11. Notifiable Data Breaches

If we become aware of a Data Breach that is likely to result in serious harm, we will assess the incident promptly and, where required under the Notifiable Data Breaches scheme in the Privacy Act, notify affected individuals and the Office of the Australian Information Commissioner (OAIC). We will also take reasonable steps to contain, remediate and mitigate the effects of the incident.

12. Children

The Platform and Services are intended for use by business Users. We do not knowingly collect Personal Information from individuals under 18. If you believe a minor has provided Personal Information to us, please contact us so we can take appropriate steps.

The Platform may contain links to third-party websites or Services. We are not responsible for the privacy or security practices of those third parties. You should review their privacy policies before providing Personal Information to them.

We handle Personal Information where reasonably necessary for our functions and activities, including:

  • with your consent (including implied consent through your configuration and use of the Services);
  • to perform a contract with you or your organisation, or to take steps at your request prior to entering a contract;
  • to comply with legal obligations; and
  • for our legitimate interests in operating, securing and improving the Platform and Services, provided such interests are not overridden by your rights and interests.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on our website and, where appropriate, notify you via the Platform or by email. The updated policy will take effect on the date indicated. Your continued use of the Platform or Services after an update constitutes acceptance of the updated policy.

Where a change to this Privacy Policy affects how we access, use or share data from a connected platform such as Google Workspace, Microsoft 365 or Xero, we will notify you and seek your consent to the change before it takes effect, rather than relying on continued use alone.

16. How to contact us

If you have questions, requests or complaints about this Privacy Policy or our handling of Personal Information, please contact:

Privacy Officer

Dexterous AI Pty Limited (trading as dexIQ)

Suite 2112, Level 32, 101 Miller Street North Sydney NSW 2060

Email: n.urry@dexiq.com.au

We take privacy complaints seriously. We will investigate your complaint and respond within a reasonable period. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (www.oaic.gov.au).