This policy describes how we collect, hold, use, disclose, and protect your personal information when you use TaxFlowAI. "We" means Frontline Holdings Group Pty Ltd (ABN: 59 671 861 475), which owns and operates the TaxFlowAI platform under the registered business name "TaxFlowAI by Frontline Financial" and is a registered ASIC agent (Agent Number: 51843). Tax agent services are provided by TAX7 T04 PTY LTD (ABN: 73 680 225 512), a registered tax agent (Tax Agent Number: 26313222) trading as TaxFlowAI; it also handles your information in connection with those services. We handle your information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the Privacy (Tax File Number) Rule 2015.
We collect: identity and contact details (name, DOB, address, email, phone, occupation); business identifiers (ABN, ACN where relevant); documents and receipts you upload; payment information (card payments are processed by Stripe and we do not store your card number); identity verification information, where we need to verify who you are; technical and account information (login credentials, IP address, audit logs); and, for company clients, company and director information needed for ASIC-related services. We only collect what is reasonably necessary to provide our services.
The TaxFlowAI platform does not collect or store your Tax File Number (TFN) or bank account details as records. Where they are needed for tax agent services, your tax agent collects them from you directly and holds them in its own practice management systems. Documents you upload, such as tax returns and notices of assessment, may contain them.
We collect information directly from you (registration, forms, uploads, messages, bookings), from your tax agent when they set up your account, from public registers (e.g. ABR, ASIC) where relevant, and automatically (e.g. IP address, browser type) for security and logging.
We hold it in secure systems. Information is encrypted in transit and at rest, every sign-in requires a password and a one-time verification code, access is role-based, and security events are logged. The platform, its database and its backups are hosted in Amazon Web Services' Sydney region. Documents you upload are held in Dropbox, which stores them in the United States.
We use your information to provide tax and (where applicable) ASIC-related services, communicate with you, process payments, verify your identity, comply with law, and maintain security.
We may disclose it to: TAX7 T04 PTY LTD, as the registered tax agent; the ATO and, for company clients, ASIC; the service providers listed in section 5, who help us run the platform; staff located overseas who assist with lodgement preparation; and regulators when required by law. We do not sell or trade your personal information.
Staff located overseas work under system-enforced access controls and cannot run exports of client data.
Some of our service providers and staff are located outside Australia, so your information may be stored or accessed overseas, mainly in the United States. Where we disclose information overseas, we take reasonable steps so the recipient handles it consistently with the APPs. You can contact us to ask which countries apply.
Our service providers, what they do, and where they process information:
Amazon Web Services: platform hosting, database and backups (Australia).
Dropbox: storage of documents you upload (United States).
Microsoft 365: email (Australia).
Xero and Xero Practice Manager: accounting and tax data for lodgement (Australia and other countries).
Anthropic, with OpenAI as a backup: AI processing of the receipt, document or message being handled (United States). Under their commercial terms, your content is not used to train their models.
Stripe: card payments (multiple countries).
Resend: email delivery (United States).
Twilio: SMS, including sign-in codes (United States and other countries).
Annature: electronic signatures (Australia).
Didit: identity verification (multiple countries).
Calendly: appointment bookings (United States).
Google Maps: address lookup (multiple countries).
Cloudflare: protection against automated abuse (multiple countries).
Vercel: hosting of our public website (multiple countries).
The TaxFlowAI platform does not collect or store your TFN as a record. Where your TFN is needed for tax agent services, it is collected by your tax agent, TAX7 T04 PTY LTD, and held in its practice management systems in line with the Privacy (Tax File Number) Rule 2015. We do not send TFNs by email or store them in cookies or logs.
Documents you upload may contain your TFN. They are held as described in section 3, and access to them is restricted to staff working on your file.
You are not obliged to provide your TFN, but withholding it may affect the services that can be provided (e.g. higher withholding). If you suspect TFN misuse, contact the ATO on 13 28 61.
You can request access to or correction of the personal information we hold about you. You can view much of it in your TaxFlowAI profile; for a full export or to correct details, contact us. We will respond within 30 days.
If you believe we have breached your privacy, contact us (see Contact below). We will acknowledge within 5 business days and aim to respond within 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (OAIC): oaic.gov.au or 1300 363 992. For tax agent issues you may also contact the Tax Practitioners Board (tpb.gov.au or 1300 362 829).
We may update this policy from time to time; we will update the effective date and, for material changes, notify you via the platform or email. Continued use of TaxFlowAI after changes means you accept the updated policy. For any privacy enquiries or requests, contact us: Email: taxflowai@frontline.financial; Phone: 0422 959 486; Post: Level 49, 8 Parramatta Square, Parramatta NSW 2150.
Email: taxflowai@frontline.financial
Phone: 0422 959 486
Address: Level 49, 8 Parramatta Square, Parramatta NSW 2150