Information we collect
We collect information you provide and information generated as you use Rebased, including:
- Account details — name, email, business details, and authentication data.
- Financial and business data you enter or import — invoices, bills, transactions, payroll, and reports.
- Payment information — processed by our payment provider; we do not store full card numbers.
- Usage and device data — log data, IP address, and product analytics used to operate and improve the service.
- Advertising and attribution data — when you arrive from a paid campaign (for example Google Ads or ChatGPT Ads) we may collect click identifiers (such as gclid, gbraid, wbraid or OpenAI’s oppref), UTM parameters, landing URL and referrer so we can measure campaign performance.
How we use information
We use personal information to provide and secure the service, process payments, power AI features you invoke, meet legal and tax-reporting obligations, provide support, and communicate important updates. We also use advertising and attribution data to measure closed-beta acquisition campaigns (Google Ads and ChatGPT Ads). For Google Ads we may use hashed contact details where appropriate (enhanced conversions). For ChatGPT Ads we load an OpenAI measurement pixel and do not send email, names, ABN or other personal details to that pixel. We do not sell your personal information.
Sharing & subprocessors
We share information only as needed to run the service — for example with cloud hosting, our payment processor, bank-feed providers, Google (for Ads measurement and conversion attribution), OpenAI (for ChatGPT Ads measurement via their advertising pixel, without personal contact details), and the Australian Taxation Office where you lodge reports such as Single Touch Payroll. These providers are bound to protect your data and use it only to deliver their service to us.
Security
We protect personal information with encryption in transit and at rest, strict access controls, and tenant data isolation. As an ATO-whitelisted Digital Service Provider we operate under the ATO’s Operational Security Framework. See our Security page for more detail.
Data retention
We keep personal information for as long as your account is active and as required to meet legal, accounting, and tax-record obligations, after which it is deleted or de-identified.
Your rights
You may request access to, or correction of, the personal information we hold about you, and you may raise a privacy concern with us at any time. We will respond in line with the Australian Privacy Principles.
Cross-border data
Your data is hosted onshore in Australia. Some subprocessors may operate overseas; where they do, we take reasonable steps to ensure your information is handled consistently with the APPs.
Cookies
We use essential cookies to keep you signed in, a limited set of analytics cookies to understand product usage, and advertising/measurement cookies (including the Google tag and Conversion Linker, and the OpenAI Ads pixel from bzrcdn.openai.com) when you interact with our paid acquisition campaigns or acquisition pages. An acquisition session cookie may be set on .rebased.app so attribution is preserved when you move from our marketing site to the application form. You can control cookies through your browser settings.
Changes & contact
We may update this policy and will note the effective date above. To exercise your rights or ask a privacy question, contact privacy@rebased.app.