Effective date: 1 January 2025 | Last updated: 9 June 2026
Book Keeps ("we", "us", "our") operates the Book Keeps mobile application and web platform (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal and financial information when you use our Service.
We are committed to protecting your privacy and complying with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By using our Service, you consent to the practices described in this policy.
Book Keeps is available to businesses in the United Kingdom as well as Australia. If you are located in the UK, we also comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 — see Section 9 (UK Users) for the terms that apply specifically to you.
When you create an account, we collect:
To provide our bookkeeping services, we collect and process:
We automatically collect:
When you use the AI Bookkeeping Assistant, we process:
We use your information to:
Your data is stored on secure cloud infrastructure. Database backups are encrypted and retained according to our backup schedule. Receipt images and documents are stored in encrypted object storage.
Access to production data is restricted to authorised personnel only and is subject to audit logging. We employ the principle of least privilege — staff only access data necessary for their role.
Sessions are secured with signed cookies and configurable session timeouts. Two-factor authentication (TOTP) is available and strongly encouraged for all accounts.
We share data with the following categories of third-party service providers, only to the extent necessary to deliver our Service:
| Service | Purpose | Data Shared |
|---|---|---|
| Cloud hosting provider | Application hosting and data storage | All app data (encrypted at rest) |
| AI/LLM provider (OpenAI, United States) | Receipt OCR, AI assistant, auto-categorisation | Receipt and document images, content from forwarded emails, transaction context for queries (no full database exports). Sent only after you give in-app consent to AI data sharing. |
| Banking data provider (Basiq) | Bank feed imports | Bank connection credentials (encrypted), imported transaction data |
| Email service provider | Transactional emails, invoice delivery, notifications | Recipient email addresses, email content |
| Push notification service | Mobile push notifications | Device tokens, notification content |
We do not sell, rent, or trade your personal or financial information to any third party for marketing purposes. Ever.
Book Keeps uses artificial intelligence in several features:
No AI feature in Book Keeps makes irrevocable decisions on your behalf. All AI outputs can be reviewed, edited, or rejected by you. We do not use your data to train general-purpose AI models — per-business learning stays within your account.
AI features require data to be sent to OpenAI, our AI provider based in the United States. Before any of your data is sent to OpenAI, we ask for your explicit, in-app consent. AI features stay switched off until you opt in. You can review your choice and withdraw consent at any time under Settings → AI Data Sharing; withdrawing immediately stops any further AI data sharing, and the rest of the app continues to work normally.
You can export all your data at any time using the Full Backup feature before deleting your account.
Under the Australian Privacy Act, you have the right to:
To exercise any of these rights, contact us at support@bookkeeps.com.au.
If you are located in the United Kingdom, the following additional terms apply. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Book Keeps is the "data controller" of your personal data.
We only process your personal data where we have a lawful basis to do so:
In addition to the rights listed in Section 8, if you are in the UK you have the right to be informed, to access, to rectification, to erasure (the "right to be forgotten"), to restrict processing, to data portability, and to object to processing (including processing based on our legitimate interests). You also have rights in relation to automated decision-making and profiling — as explained in Section 6, we do not make decisions with legal or similarly significant effects about you using solely automated means. We will respond to any request within one month, and exercising these rights is free of charge in most cases.
Where we transfer your personal data outside the United Kingdom — for example to service providers based in the United States (see Section 5) — we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or reliance on a country covered by UK adequacy regulations.
If you are in the UK and believe we have not handled your personal data lawfully, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk. We would, however, appreciate the chance to address your concerns first — please contact us at support@bookkeeps.com.au.
Our Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
Our web platform uses:
In the event of an eligible data breach (as defined by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988), we will:
If you are in the United Kingdom, where a personal data breach is likely to result in a risk to your rights and freedoms we will notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to you, we will also inform you directly.
Some of our third-party service providers (including cloud infrastructure and AI services) may process data outside Australia, including in the United States. Where this occurs, we ensure appropriate safeguards are in place, including contractual obligations on the recipient to protect data to a standard comparable to the APPs. For users in the United Kingdom, the safeguards described in Section 9.3 apply to transfers of personal data outside the UK.
We may update this Privacy Policy from time to time. We will notify you of material changes by email and/or in-app notification at least 14 days before the changes take effect. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or how we handle your data:
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (Australia) or, if you are in the United Kingdom, the Information Commissioner's Office (ICO).