Privacy Policy

Last updated: 27 June 2026

SiteMargin is operated by Your Finance Department Pty Ltd (ABN tbc), an Australian company. We take your privacy seriously and handle personal information in accordance with the Australian Privacy Principles set out in the Privacy Act 1988 (Cth).

1. What we collect

When you sign up for and use SiteMargin we collect:

• Account data — name, email, company name, password (hashed), provided at sign-up.
• Xero data — once you connect your Xero file, we read invoice, bill, credit-note, employee and tracking-category data using OAuth 2.0. We do not receive your Xero login credentials.
• Project and labour data — anything you enter into SiteMargin (projects, variations, roles, labour entries).
• Usage data — log events, error reports, basic analytics about how features are used (no personal browsing history).
• Communication data — emails to support, feedback, signup-form submissions.

2. How we use it

• To provide the service — sync your data, calculate WIP and margins, post journals back to Xero.
• To improve the product — understanding which features are used so we can build better ones.
• To communicate with you — service updates, billing notices, occasional product news (opt-out anytime).
• To meet legal obligations.

We do not sell your data. Ever.

3. How we store and protect it

• Data is stored on Supabase (PostgreSQL) hosted in AWS Sydney (ap-southeast-2).
• Application code is hosted on Vercel.
• Authentication uses Supabase Auth with industry-standard password hashing (bcrypt).
• All data in transit is encrypted via TLS (HTTPS).
• Xero OAuth tokens are stored encrypted at rest.
• Application-level access controls ensure you only see your own organisation's data.

4. Third parties

We use the following service providers, each of which has its own privacy commitments:

• Xero — reads invoice, bill, credit-note, contact, settings and payroll data you authorise, and writes back the sales invoices, manual journals and payroll timesheets you create in SiteMargin. We do not receive your Xero login credentials.
• Supabase — database and authentication hosting.
• Vercel — application hosting and content delivery.
• HubSpot — waitlist signups and customer communications.
• Resend — delivery of transactional emails (billing and account notifications).
• Stripe — subscription billing and payment processing.
• Google Analytics (GA4) — aggregated website usage analytics (pages viewed, general engagement) on our public marketing site. See Google's Privacy Policy.
• Meta (Facebook) Pixel — measures the effectiveness of our advertising and lets us show relevant ads to past visitors on Facebook and Instagram (retargeting). See Meta's Privacy Policy.

5. Your rights

Under Australian privacy law you have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate.
• Request deletion of your account and associated data.
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

To exercise any of these rights, email privacy@sitemargin.com.au.

6. Cookies

The SiteMargin app uses essential cookies — authentication session, security tokens — required for it to function.

Our public marketing website also uses cookies and similar technologies from Google Analytics and Meta (Facebook) Pixel to understand site usage and measure the effectiveness of our advertising, including showing you relevant ads on Facebook and Instagram if you've previously visited our site (retargeting). You can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on, manage ad personalisation via Meta's Ad Preferences, or block these cookies generally through your browser settings.

7. Data retention

We retain your data while your account is active. If you cancel, we delete your data within 60 days unless we're required to keep it longer for legal or accounting reasons.

8. Changes to this policy

We'll update this page if we change how we handle data, and notify active users by email for any material change.

9. Contact

Privacy enquiries: privacy@sitemargin.com.au
General support: hello@sitemargin.com.au