Privacy policy

This Privacy Policy explains how Bosch Consulting Group Pty Ltd (ABN 68 666 257 941), trading as Profitdrive.app ("we", "us", "our"), collects, uses, stores, and protects personal information.

We comply with the Australian Privacy Act 1988 and follow GDPR-aligned practices for international users.

1. Information we collect

1.1 Account information

• Name
• Email
• Organisation name
• Login details
• User activity (audit logs)

1.2 Customer data (your business data)

This is the data your firm loads into Profitdrive or brings in from Xero. It includes names, work emails, roles, salaries and pay history, daily cost, timecards, leave entries, allocations, and client and supplier contacts (including contacts from Xero).

You own this data.

1.2A Who is responsible for business data

Your firm decides what it loads and is responsible for telling its people. We handle this data on your firm's behalf, to provide the Service. If someone asks us about data in a firm's workspace, we pass the request to the firm and help it respond.

Please do not record health details, such as reasons for leave.

1.3 Payment information

Handled exclusively by Paddle, our Merchant of Record.

We do not receive or store credit card information.

1.4 Usage analytics and engagement

Aggregate analytics. We may collect usage metrics such as:

• Page views
• Feature interactions
• Error logs

With each page view we also record the approximate country and region of your connection, as reported by our hosting provider, and whether the visit appears to come from an automated program such as a search-engine crawler. For these page-view analytics we do not store your IP address or your browser details.

We use these analytics in aggregate. They are not linked to you unless you give us your details or click a link in our emails (see below).

Engagement linked to you. If you have given us your details, for example in a form on this site, we link your visitor ID to your contact record at that point. If you click a link in one of our emails, we also link the pages you viewed on that browser to you. We also record whether you open or click our emails, and when an email is opened we record the email client and country. We calculate an engagement score. We use this to understand interest and to decide on follow-up. To stop marketing emails, use the unsubscribe link in any email. To stop this tracking, write to contact@profitdrive.app.

Business contacts we find. We may contact business people we find through LinkedIn, referrals or public sources, to tell them about Profitdrive. Every marketing email has an unsubscribe link.

1.5 Cookies and other services on this site

This site sets three cookies of its own:

• pd_vid holds a random visitor ID, so we can count visits across pages (90 days).
• pd_country holds your country code, taken from your connection, so example figures show your currency symbol (1 day).
• pd_cid links your visits to your contact record, and so to your email address, only after you submit a form on this site and agree to it (365 days).

The site also uses:

• Vercel Web Analytics, which counts page views in aggregate. Its script is served from this site and sets no cookies.
• Paddle.js, on the pricing page only, which uses your IP address to show seat prices in your currency.
• Google Fonts, for the Inter and JetBrains Mono typefaces. Your browser requests them from Google, which may log the request.

We use no ad networks, fingerprinting or reverse-IP company lookup, and we do not share engagement data with anyone else. To have your data deleted, email contact@profitdrive.app and we remove it within 90 days.

1.6 Trial sign-up answers

When you request access to Profitdrive, we ask for your name and work email. You can also choose to tell us your firm name and answer a few optional questions about your firm, why you want to try Profitdrive and how you would like to start, and we store your answers with your request. We use the answers to review your request, to understand firms like yours and to improve our service. We use your contact details to reply to your request and, once it is approved, to create your trial. They are stored in our website database, not shared, and kept for up to 24 months unless you ask us to delete them. Unfinished requests from our old form are deleted after 30 days. We also note your country, taken from your browser: the country of your connection as reported by our hosting provider, or otherwise your browser's time zone or language. We use it to order the accounting systems in the request form, and it is stored with your request.

1.7 Information we do not collect

We do not collect sensitive personal information such as passport numbers, driver's licence details, health records, biometric data, or government identifiers. The Service is designed to process operational and financial data related to business activities, not sensitive personal information.

2. How we use information

We use your information to:

• Provide and maintain the Service
• Improve features and performance
• Ensure security and fraud prevention
• Offer support and respond to inquiries
• Comply with legal obligations

We do not sell personal information or Customer Data.

3. Where data is stored

Your data is stored securely on Supabase, hosted in Singapore (AWS ap-southeast-1). Background processing runs on Render, also in Singapore. The Profitdrive app on Vercel does not store your data.

Data is encrypted at rest and in transit.

Backup and processing systems may run in other regions as part of Supabase's global infrastructure.

Supabase acts as our data processor, providing hosting, authentication, storage, and operational infrastructure. Supabase processes Customer Data solely for the purpose of delivering the Service to the Customer.

4. Third-party service providers

We use third parties to help deliver the Service, including:

• Supabase – hosting, authentication, database (Singapore)
• Render – background processing (Singapore)
• Neon – website database, including trial sign-up answers (Sydney, Australia)
• Paddle – billing, tax compliance, invoicing
• Vercel – website hosting and page-view analytics (Sydney, Australia)
• Postmark – email delivery (United States)
• Google Fonts – typefaces for this website
• Xero – only if you connect it, read-only

Each provider is contractually required to handle data responsibly and securely.

5. Confidentiality

We treat Customer Data as strictly confidential.

We will not access Customer Data except:

• to provide technical support,
• to maintain system stability,
• where required by law,
• or with your express permission.

Access is logged and limited to authorised personnel only.

6. Data retention and deletion

We retain Customer Data for as long as your account is active. When your trial or subscription ends, or you ask us to delete your data, the exit rules in section 13 of our Terms apply: how long we keep your data, when we email the Owner, and when we delete it.

Backups may persist for a limited period for safety.

We retain account-level personal information (such as usernames, email addresses, and audit logs) for as long as your account is active and for up to 12 months after termination for security, operational, and compliance purposes.

7. International transfers

Your data may be stored or processed outside Australia, including in Singapore (Supabase and Render), in the United States (Postmark) and by our other providers named in section 4. We take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles.

For users in the EU or UK, we also follow GDPR-aligned practices, including appropriate safeguards such as Standard Contractual Clauses (SCCs) provided by our infrastructure vendors.

8. Your rights

You may request:

• Access to personal data
• Correction of inaccurate data
• Deletion of data (subject to retention requirements)
• Export of your data
• Restriction of processing

You may withdraw consent to optional communications at any time by contacting us at contact@profitdrive.app. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

8A. Access and correction

To see or correct your personal information, email contact@profitdrive.app. We reply within 30 days and do not charge for this.

8B. Complaints

If you have a privacy complaint, email contact@profitdrive.app with "Privacy complaint" in the subject. We acknowledge it within 5 business days and respond within 30 days.

If you are not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC): oaic.gov.au, 1300 363 992.

9. Legal basis for international users

For international users, we rely on:

• Contract necessity (to deliver the Service)
• Legitimate interests (product improvement)
• Consent (for optional email communications)

10. Security practices

We use reasonable technical and organisational measures including:

• Encryption
• Role-based access control
• Audit logging
• Database row-level security (RLS)
• Regular updates

No system is completely secure, but we make reasonable efforts to protect your information.

11. Children

Profitdrive is not intended for use by individuals under 16 years old.

12. Changes to this policy

We may update this Privacy Policy. Changes will be posted on our website.

13. Contact

Questions or requests can be directed to:

contact@profitdrive.app