Privacy Policy
Last updated: 21 July 2026
1. Introduction
Beeswax is operated by Ryanchow Pty Ltd (ABN 99 100 901 488), an Australian-registered company ("we", "our", "us"). Ryanchow Pty Ltd is the data controller for the personal information described in this policy, except where section 7 says otherwise. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application and services.
This policy applies globally. Two sections at the end apply additionally by region: United Kingdom, Australia.
2. Information We Collect
Information You Provide
- Account registration details (name, email address, company name)
- Billing and payment information
- Content you create within the Service (projects, invoices, expenses, tasks, documents, and accounting records)
- Payroll and contact records you add about other people — for example your employees (including pay, leave, and government identifiers needed for payroll filings) and your clients and suppliers. Section 7 explains our role for this data.
- Communications with our support team
Information Collected Automatically
- Usage data and analytics (pages visited, features used)
- Device and browser information
- IP address and general location
- Cookies and similar technologies
- When you connect Beeswax to His Majesty's Revenue and Customs (HMRC), additional device and connection details required by United Kingdom law — see the United Kingdom section.
Information From Connected Services
- Bank feed data: if you connect a bank feed, we receive your bank transaction data from the feed provider you authorise
- Accounting integrations: if you connect Xero, we exchange accounting records with your Xero organisation as you direct
3. How We Use Your Information
We use your information to:
- Provide, maintain, and improve the Service
- Process transactions and send billing notifications
- Prepare and, on your instruction, submit filings to tax authorities (section 6)
- Provide the artificial-intelligence features described in section 4
- Respond to your enquiries and provide customer support
- Send important service updates and announcements
- Analyse usage patterns to improve user experience
- Detect, investigate, and prevent security incidents
- Comply with legal obligations
4. Artificial-Intelligence Features
Beeswax includes artificial-intelligence features on every paid plan — for example extracting details from receipts, suggesting bank-transaction matches and account allocations, and reviewing draft tax figures. To provide these features we send the relevant financial records (such as a receipt image, transaction descriptions, or draft return figures) to our artificial-intelligence provider, OpenAI, acting as our processor.
This data is used only to produce the result you asked for. Under our agreement with OpenAI, data submitted through its business interface is not used to train its models. Artificial-intelligence output is assistive only — you review and approve results before they affect your records.
5. Data Sharing and Sub-processors
We do not sell your personal information. We share information only as described here:
- Service providers (sub-processors) who help us run the Service, limited to what their role requires: Amazon Web Services and Heroku (Salesforce) for hosting and file storage; Stripe for billing and online invoice payments; Postmark for transactional email; OpenAI for the artificial-intelligence features (section 4); our bank feed providers (currently Lunch Flow, and the provider named when you connect a feed); Bonsai for search infrastructure; and Airbrake and New Relic for error and performance monitoring.
- Tax authorities, on your instruction — see section 6
- Integrations you connect (for example Xero, Google Drive) — data flows to them only when you connect them, and you can disconnect at any time
- Legal authorities when required by law or to protect our rights
6. Data You Ask Us to Send to Tax Authorities
Beeswax can prepare and submit tax filings. Submissions happen only on your instruction, and you review the figures before they are sent. Depending on your region this includes filings to His Majesty's Revenue and Customs in the United Kingdom and the Australian Taxation Office in Australia. The regional sections below describe exactly what is sent to each authority.
7. Employee and Client Data — Our Role
Records you keep in Beeswax about other people — employees, clients, suppliers — are your records. For that data, you are the data controller and Beeswax processes it on your instructions to provide the Service. You are responsible for having the right to collect that information and for responding to those individuals' requests; we will assist where the law requires.
8. Where Your Data Is Stored and International Transfers
Beeswax is hosted on Amazon Web Services and Heroku infrastructure located in the United States. Your data is therefore transferred to and stored in the United States, whichever country you use Beeswax from. Our hosting providers are certified under the European Union–United States Data Privacy Framework and its United Kingdom extension. The regional sections below describe the legal safeguard that applies to your transfer.
If you connect your own storage (Google Drive or your own network storage), documents you store there are held by that provider or on your own infrastructure, under your agreement with them.
9. Data Security
We implement industry-standard security measures to protect your data, including encryption in transit and at rest, security tooling and audits, multi-factor authentication, and access controls. However, no method of transmission over the Internet is 100% secure.
10. Data Retention
We retain your data for as long as your account is active or as needed to provide the Service. Records that support tax and payroll filings are subject to statutory retention periods (typically five to six years depending on jurisdiction) and we may retain them for that period even after account closure or a deletion request — the law requires it. After account termination we may also retain limited data for a reasonable period to comply with other legal obligations and resolve disputes.
11. Your Rights
You may, subject to the law that applies to you (see the regional sections):
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your personal information (subject to statutory retention, section 10)
- Object to or restrict processing of your information
- Export your data in a portable format
To exercise any of these rights, contact us at the address in section 15.
12. Cookies
We use cookies and similar technologies to improve your experience, remember your preferences, and analyse how the Service is used. When you use the HMRC connection, one cookie carries the device details United Kingdom law requires us to send with submissions (see the United Kingdom section). You can manage cookie preferences through your browser settings.
13. Children's Privacy
The Service is not intended for children under 16. We do not knowingly collect personal information from children under 16. If we become aware of such collection, we will take steps to delete the information.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The date at the top of this page indicates when this policy was last revised.
15. Contact
If you have questions about this Privacy Policy or our data practices, please contact us at support@beeswaxapp.com
🇬🇧 United Kingdom
This section applies additionally if you are in the United Kingdom.
Legal bases under the United Kingdom General Data Protection Regulation
- Performance of a contract: providing the Service you signed up for, billing, and support
- Legal obligation: the fraud-prevention data described below, and retaining tax and payroll records
- Legitimate interests: securing the Service, preventing abuse, and improving features
What we send to His Majesty's Revenue and Customs
When you use Beeswax to file a Value Added Tax return under Making Tax Digital, we send HMRC the return figures you approve.
In addition, United Kingdom law (the fraud-prevention direction under the Finance Act 2019) requires software like Beeswax to send certain device and connection information with every interaction with HMRC's systems. When you use the HMRC connection we collect and transmit to HMRC:
- A device identifier (a random identifier stored in your browser)
- Your screen and window dimensions and colour depth
- Your browser's user-agent string and installed plugin names
- Your timezone
- Your public IP address, with timestamps
- How you signed in to Beeswax (whether multi-factor authentication was used)
- Your Beeswax user identifier, and our server's IP address and software version
This information is sent only to HMRC and only for fraud prevention. It is a legal requirement — we cannot offer the HMRC connection without it. If you do not use the HMRC features, none of it is collected.
International transfers
Transfers of your data to our United States hosting providers rely on the United Kingdom–United States Data Bridge (the United Kingdom extension to the European Union–United States Data Privacy Framework), under which our providers are certified.
Your rights and complaints
You have the rights listed in section 11 under the United Kingdom General Data Protection Regulation. You also have the right to complain to the Information Commissioner's Office (ico.org.uk). If a personal-data breach affects you, we notify the Information Commissioner's Office within 72 hours as required and tell you without undue delay where the risk to you is high.
🇦🇺 Australia
This section applies additionally if you are in Australia.
The Australian Privacy Principles
We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth). The purposes for which we collect, hold, use, and disclose information are set out in sections 2 to 6 of this policy.
What we send to the Australian Taxation Office
If you use Beeswax payroll with Single Touch Payroll enabled, we report your employees' pay, withholding, and superannuation information to the Australian Taxation Office each pay run, as the law requires. If you lodge activity statements through Beeswax, we send the figures you approve. Submissions happen on your instruction as the employer or business.
Tax File Numbers stored for payroll are handled in accordance with the Privacy (Tax File Number) Rule 2015: collected only for payroll and reporting purposes, encrypted at rest, and never disclosed except to the Australian Taxation Office as authorised by law.
Overseas disclosure
As described in section 8, your data is stored with hosting providers in the United States, and some sub-processors in section 5 are also located overseas. This is a disclosure of personal information to overseas recipients for the purposes of Australian Privacy Principle 8, and we take reasonable steps — including contractual safeguards — to ensure those recipients handle it consistently with the Australian Privacy Principles.
Complaints and data breaches
You can complain to us at the address in section 15; if unresolved, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au). We comply with the Notifiable Data Breaches scheme: if a breach is likely to result in serious harm, we notify affected individuals and the Office of the Australian Information Commissioner.