DRAFT FOR LAWYER REVIEW
This document is a DRAFT only. It is not legal advice. Do not publish until reviewed and approved by an Australian lawyer. Placeholders appear in [SQUARE_BRACKETS].
Privacy Policy — AndMyData
Effective date: Draft as at 15 September 2026 (not yet in force — pending lawyer approval)
Operator: Tubby Code Pty Ltd (trading as AndMyData)
ABN: 32 653 747 329 · ACN: 653 747 329
Contact: henry@laterletter.cool
This policy explains how we collect, use, store, and share personal information when you use AndMyData (the app at https://app.andmydata.com and our marketing site).
We follow the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) where they apply. This policy is written in plain Australian English.
By creating an account or using AndMyData, you acknowledge that you have read this policy and consent to us handling your personal information as it describes (including the overseas disclosure in section 7). Where the law requires specific consent for a particular collection or use, we will ask for it at that point.
We may update this policy by posting the revised version on this page with a new effective date (see section 14). Continued use after that date means you accept the updated policy.
1. Who we are
AndMyData is a receipt-capture product operated by Tubby Code Pty Ltd (trading as AndMyData).
We are not a bank. We do not hold deposits. We do not provide financial advice.
AndMyData is for adults only. A household can include up to six adult members. AndMyData is not a children’s product.
2. What we collect
Depending on how you use AndMyData, we may collect:
| Category | Examples |
|---|---|
| Account | Email, display name, timezone, currency preference |
| Household | Household metadata (e.g. membership, roles, invite codes) |
| Receipts | Photos or PDFs you upload, plus extracted merchant, store name, printed address, totals, and line items |
| Chat | AI chat threads (per adult) |
| Derived data | Categories and similar insights we generate from your receipts |
| Technical | Session/auth data needed to keep you signed in (see Cookies notice) |
We do not intentionally collect information about children.
3. How we collect it
- Directly from you — when you create an account, set preferences, upload receipts, or use chat.
- Automatically — session and similar technical data needed to operate the service.
- Derived by us — merchant, address, categories, and related insights from receipts (including with AI assistance — see overseas disclosure below).
4. Why we collect it (purposes)
We use personal information to:
- Provide and operate AndMyData (accounts, households, receipt views, and items).
- Read receipts you upload and extract store, address, totals, and line items.
- Provide AI extraction and chat features.
- Secure the service, prevent abuse, and fix faults.
- Communicate with you about the service (e.g. privacy or security notices).
- Investigate and respond to misuse, security incidents, and complaints.
- Meet legal obligations.
We do not sell your personal information.
Marketing. We do not currently send marketing or promotional messages. If we ever do, we will comply with the Spam Act 2003 (Cth) — we will only send them with your consent, they will identify us as the sender, and each will include a working unsubscribe.
5. Who we share with
We share personal information only as needed to run AndMyData, including with:
| Party | Role |
|---|---|
| AWS (ap-southeast-2, Sydney) | Hosting for app and database |
| Amazon Cognito (AU) | Authentication |
| xAI (Grok) | AI receipt reading and chat — see overseas disclosure |
| Stripe | [PLANNED — only if/when billing is enabled; payment processing] |
| Professional advisers / authorities | Where required by law or to protect rights |
We require service providers to handle information appropriately under our arrangements with them, subject to their own terms and applicable law.
6. Overseas disclosure
Some processing may occur outside Australia.
In particular, AI categorisation and chat are provided via xAI (Grok). Treat this as an overseas disclosure of relevant chat content and data needed for those features, unless your lawyer advises a different characterisation.
AWS app/DB hosting and Cognito for AndMyData are configured in Australia (Sydney / AU) where stated above.
By using AI features, you acknowledge that related information may be processed overseas. Ask us at henry@laterletter.cool if you need more detail before using those features.
7. Storage and security
We store AndMyData app and database data primarily in AWS ap-southeast-2 (Sydney).
We take reasonable steps to protect personal information. No method of storage or transmission is completely secure. Do not treat AndMyData as a vault for secrets you cannot afford to lose.
8. Retention
We keep information for as long as needed to provide AndMyData, meet legal obligations, resolve disputes, and enforce agreements.
Confirmed receipts remain until you delete the receipt or the household.
Exact retention periods: [LAWYER TO CONFIRM / RETENTION_SCHEDULE].
9. Deletion and your choices
What the product currently supports:
- Leave a space / household (as implemented in-product).
- Delete an upload / receipt.
- Delete a chat thread.
Full account erasure may be incomplete in the product today. If you want us to delete personal information beyond what the app supports, email henry@laterletter.cool and we will respond in line with applicable law and our operational ability.
You may also request access or correction of your personal information via henry@laterletter.cool.
10. Marketing site, cookies, and third-party links
See our separate Cookies and tracking notice for essential auth/session data, localStorage, and Google Fonts on the marketing site. We do not currently run a full analytics cookie consent wall because we do not currently operate non-essential analytics tracking as described there.
AndMyData and our marketing site may link to third-party websites or services (for example, the OAIC). Those sites have their own privacy practices, which we do not control and are not responsible for. Read their privacy policies before providing them with personal information.
11. Not financial advice
Categories, receipt totals, and AI chat are tools to help you organise information. They are not financial, tax, or credit advice. See also our Terms of Use.
12. Complaints
Contact henry@laterletter.cool first. We will try to resolve your complaint promptly.
If you are not satisfied, you may contact the Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.au/
13. Changes
We may update this policy from time to time. We will post the updated version on this page with a new effective date; the posted version is the current version. Continued use of AndMyData after that date means you accept the updated policy. Material changes may also be notified in-app or by email where appropriate.
14. Contact
Privacy (access, correction, deletion, complaints): henry@laterletter.cool
Report misuse, a security concern, or a suspected data breach: henry@laterletter.cool
Operator: Tubby Code Pty Ltd (trading as AndMyData)
ABN: 32 653 747 329 · ACN: 653 747 329
Address: 19-21 South Steyne, Manly NSW 2095
Website: https://andmydata.com