Privacy Policy

1. What we collect

To run Friday we collect:

• Account information — your name, business name, email address, and (where you set one) password hash. Provided by you when you sign up.
• OAuth-granted access — when you connect your Gmail inbox and Xero organisation through the standard Google and Xero consent flows, you grant Friday access tokens that let us read incoming mail and read/write bills and contacts in your Xero. We never see your Google or Xero password.
• Bill content — the supplier name, amount, GST, line items, due date, and reference that Friday extracts from each bill in your inbox. The original PDF is read on demand to extract these fields and attach a copy to the draft in your own Xero; Friday does not keep the PDF itself.
• Usage data and logs — request times, IP addresses, error reports, and events generated as Friday processes bills. Used to operate, debug, and improve the service.
• Billing information — invoice amounts and payment status for the $750 onboarding fee and usage-based subscription (25c per bill drafted into Xero). Payments and card details are handled outside Friday by our accounting provider — we never see or store card numbers.

2. Why we collect it

We collect this information only to provide and operate Friday: monitoring your inbox for bills, extracting and coding them, drafting them in Xero, logging job costs, and sending you summaries. We also use it to support you when you have questions, and to meet our own tax and accounting obligations as a New Zealand business.

We do not sell your information. We do not use your information for advertising. We do not train any AI model on your information.

3. Who we share it with

Friday is built on third-party infrastructure. The following providers process your information on our behalf, under contractual terms that restrict them to acting on our instructions:

• Anthropic, PBC— operates the Claude API. When Friday processes a bill, the PDF content is sent to Anthropic's API to extract structured fields. Anthropic does not use API customer data to train its models. (See anthropic.com/legal/privacy.)
• Supabase, Inc. — Postgres database and authentication.
• Vercel, Inc. — application hosting, request routing, and logs.
• Google LLC — Gmail access via OAuth. Read-only on the messages Friday classifies as bills.
• Xero Limited — the destination for the drafts Friday creates. You are already a Xero customer; we act inside the access you grant.
• Resend, Inc. — transactional email delivery (sign-in links, daily summaries, support email).

We do not share your information with anyone else, except where we are required to by New Zealand law (for example, a lawful court order).

4. Where your information is stored

Some of the providers listed above store information outside New Zealand — typically in the United States or the European Union. We use providers that are bound by equivalent privacy obligations to those in the New Zealand Privacy Act 2020, in accordance with Information Privacy Principle 12 (disclosure of personal information outside New Zealand).

5. How long we keep it

We keep your account and bill data for as long as your Friday subscription is active, plus seven years afterwards — the retention period required by Inland Revenue for business records you may need to refer back to.

If you ask us to delete your account, we will remove your bill data and audit logs from active systems within thirty days. Some backup snapshots may persist for up to ninety days before being overwritten on the normal backup rotation.

6. Your rights

Under the New Zealand Privacy Act 2020 you have the right to:

• Access any personal information we hold about you.
• Correct any information that is wrong or out of date.
• Withdraw consent for Gmail or Xero access by revoking the OAuth connection (either from inside Friday at /dashboard/connections, or directly from your Google or Xero account settings).
• Delete your account and your associated data, subject to the retention obligations above.
• Complain to us, or directly to the Office of the Privacy Commissioner (privacy.org.nz), if you believe we have mishandled your information.

To exercise any of these rights, email us at hello@usefriday.co.nz. We will respond within twenty working days.

7. Security

We protect your information with industry-standard controls: encrypted connections (HTTPS) end to end, encrypted storage at rest, scoped database access with row-level security, per-tenant isolation between Friday customers, and short-lived OAuth tokens that are rotated automatically. No system is perfect, but we treat customer financial data as the sensitive information it is.

8. Cookies

Friday uses a small number of cookies for session management (so you stay signed in) and for referral attribution when you arrive from another Friday customer's referral link. We do not use third-party advertising or analytics cookies.

9. Changes to this policy

We may update this policy over time. If we make a material change, we will notify active customers by email before it takes effect. The "Last updated" date at the top of this page reflects when the current version was published.

10. Contact

Questions about this policy, or about how we handle your information: hello@usefriday.co.nz.