Service providers

Amazon Web Services (AWS)

Used for

Running the app and keeping your records.

When

Always.

Where

Auckland, New Zealand, for the app's server, your records and documents, the daily backups, and the service's own passwords and keys. Sydney, Australia, for the app's own files (the pages and code your browser loads).

What it receives

Everything you keep in Tax App, encrypted in transit and at rest. The files served from Sydney hold none of your records.

Amazon SES, with Resend as a backup

Used for

Email: invitations, verification, password resets, and the messages and reports you send to your contacts, together with their replies.

When

Whenever the app sends an email. Resend is used only if Amazon SES cannot send one.

Where

Amazon SES is part of AWS and runs in Sydney, Australia. Resend is a US-based email service.

What it receives

Each email, with its addresses. Replies to messages from the app are kept for up to 30 days and then deleted automatically.

ipwho.is

Used for

Turning an IP address into a rough town or country, to protect accounts against abuse, to check that a new organisation is signing up from New Zealand, and to see roughly where a sign-up came from.

When

When an organisation is created, when the app records usage, and when someone visits this website.

What it receives

The IP address only. No name, email address, or financial record is ever sent with it.

Google reCAPTCHA

Used for

Bot protection on the contact form of this website.

When

Only after you start to use the contact form. It may set its own cookies.

What it receives

Signals from your browser, and your IP address, to help it tell a person from a bot. It does not receive your message.

Google Fonts

Used for

The app's typeface.

When

Each time the app opens in your browser.

What it receives

Your browser loads the typeface from Google, so Google sees your IP address and your browser type. It sees nothing you enter in the app.

Sign in with Google

Used for

Signing in with your Google account instead of a password.

When

Only if you choose "Continue with Google".

What it receives

Nothing from us. Google shares your name, email address, and Google account identifier with Tax App. The app never asks for your Gmail, Google Drive, Contacts, Calendar, or any other Google service.

Akahu

Used for

Bank feeds.

When

Only if you connect your bank.

Where

A New Zealand open-banking service.

What it receives

You connect your bank at Akahu, with your own internet banking login, which Tax App never sees. Akahu passes the transactions of the accounts you choose to the app. The access it gives Tax App can read transactions but cannot move money.

Bank feeds guide

Xero

Used for

Keeping your Xero accounts in step with your records.

When

Only if you connect Xero.

What it receives

The records you choose to sync are sent to, and read from, your own Xero organisation. Tax App never sees your Xero login.

Xero guide

Tenancy Services (MBIE)

Used for

Checking the bonds held for your tenancies.

When

Only if you connect Tenancy Services with your RealMe login.

Where

A New Zealand government service.

What it receives

When you link your landlord number: that number, the landlord's name, email address and phone number, and the contact person's name, email address and phone number. After that, the app's requests to read the bonds held under your landlord number. The app reads each bond's amount, status, bonded address, dates, and tenant names, to check them against your tenancies. It does not lodge, change, or refund a bond.

Addressfinder

Used for

Looking up New Zealand addresses as you type into an address field.

When

Only for an organisation that has turned on address lookup with its own Addressfinder account.

Where

A New Zealand company. Its logs are held in Australia.

What it receives

From our server, under that account: what you type and the address you choose, kept in its logs for up to 14 days. Nothing else about you. The address you choose, with where it is on the map, is saved only with your records.

OpenStreetMap

Used for

The small map shown under an address.

When

Only where address lookup is turned on and an address has been chosen.

Where

The OpenStreetMap Foundation, based in the United Kingdom.

What it receives

Your browser loads the map pictures from it, so it sees your IP address and the area of the map shown, but not the address itself or anything else about you. If you choose View on OpenStreetMap, it also receives the exact spot on the map.

The AI provider your organisation chooses

Used for

Reading invoices, bills, and PDF bank statements, to pre-fill records and to help match bank transactions.

When

Only for an organisation whose owner has switched on AI and saved its own key for Claude (Anthropic), GPT (OpenAI), or Gemini (Google).

Where

All three providers are based outside New Zealand.

What it receives

The document being read, with your organisation's expense account names and the names of its contacts, so that it can name the supplier. When you reconcile expenses, it also reads invoices already attached to expenses, to find their due dates. The provider handles them under its own terms with your organisation, which come with the key you saved.

AI apps you connect

Used for

Working with your records from an AI app, such as Claude or ChatGPT.

When

Only if an owner of your organisation has switched AI connectors on and you connect an app.

Where

Wherever the company behind the app keeps data, which may be outside New Zealand.

What it receives

The records it asks for, when you tell it to, within your own role and the limits the owner has set. From that point, that company handles them under its own terms with you.

AI connectors guide