Privacy Policy

Who we are

This Privacy Policy applies to the ABAFlow website, converter, dashboard and Developer API. ABAFlow is a business name registered to Helix Intelligence Pty Ltd (ABN 34 167 132 014).

We aim to handle personal information openly and carefully, in line with applicable Australian privacy requirements.

Information we collect

The information we collect depends on how you use ABAFlow. It may include:

• Account and contact information: name, email address, business name, authentication identifier and account preferences.
• Billing information: plan, payment status, invoice and payment references. Our payment provider handles full card details.
• Conversion metadata: filename, date and time, payment-line count, aggregate file total, selected bank, transaction date, conversion status and SHA-256 file fingerprints.
• Saved bank settings: sender details and Direct Entry settings you choose to save for future conversions.
• Support and enquiry information: messages, contact details and information you provide when asking for help or discussing the Developer API.
• Technical information: security, authentication and diagnostic records needed to operate and protect the Service. Error logs do not include payment-file field values.

Payment-file contents

ABAFlow must temporarily process payment rows derived from an uploaded CSV or Excel workbook, pasted spreadsheet rows or an API request to validate the payments and generate the ABA file. Excel workbooks are parsed in your browser and the raw workbook is not sent to the generation service. The generated file is then returned to you.

Uploaded spreadsheet contents, pasted payment rows and generated ABA file contents are not retained by ABAFlow as part of your conversion history after processing. We do not include recipient names, recipient BSBs, recipient account numbers, individual payment amounts or payment descriptions in conversion logs.

One-way SHA-256 fingerprints may be retained so that a file can later be checked for integrity without storing its contents.

How we collect information

We collect information directly from you when you create an account, use the converter or API, save settings, pay for a plan, submit an enquiry, request support or communicate with us.

We also receive limited account, payment and technical information from service providers that help us authenticate users, process payments, host the Service and protect it from misuse.

How we use information

We use personal information where reasonably necessary to:

• provide, secure and improve ABAFlow;
• create accounts, authenticate users and manage saved settings;
• validate conversions, provide activity history and support integrity checks;
• process payments, subscriptions, invoices and refunds;
• answer questions, resolve support issues and manage API enquiries;
• detect fraud, misuse, security incidents and technical problems; and
• meet legal, accounting and regulatory obligations.

We do not sell payment data or use payment-file contents for advertising.

Service providers and data location

ABAFlow uses trusted service providers for cloud infrastructure, authentication, managed databases, payment processing, email and operational support.

Payment-file processing is hosted in Sydney, Australia. Data is encrypted in transit using TLS. Limited account, billing or support information may be processed by Google Cloud and Stripe in Australia or other countries where they or their subprocessors operate.

We provide service providers only the information needed for their role and require them to handle it under appropriate contractual and security arrangements. Stripe retains payment records under its own privacy and legal obligations; ABAFlow does not receive or store your full card number or card security code.

Retention and deletion

• Spreadsheet, pasted-row and ABA file contents: processed for the conversion and not retained as part of conversion history.
• Conversion metadata: kept while needed to provide account history, billing, security and support. Following account cancellation or closure, ordinary conversion metadata may be retained for up to 90 days before deletion.
• Error and diagnostic logs: generally retained for up to 90 days for security, support and product improvement.
• Saved settings: retained until you remove them or close your account.
• Billing and legal records: retained for the period required by law or the payment provider’s obligations.

Information voluntarily provided when contacting support is used only to investigate and resolve the request and retained only as long as necessary.

After a verified account-deletion request, ABAFlow schedules account records, saved settings and conversion history held in its active application database for deletion within 24 hours. Limited information may remain for longer in provider backups, security logs or records that must be kept by law, and is removed or de-identified under the applicable retention cycle.

Security

ABAFlow uses safeguards appropriate to the information and Service, including TLS encryption in transit, server-side file generation, access controls, secure authentication, metadata-only conversion logging, SHA-256 integrity fingerprints and blocking validation that prevents known invalid files from being generated.

No online service can guarantee absolute security. If we become aware of a data breach, we will investigate and notify affected people and regulators where required by law.

Your choices and rights

You can update many account and saved-setting details through your dashboard. You may also ask us to:

• explain the personal information we hold about you;
• provide access to that information;
• correct inaccurate or out-of-date information; or
• delete your account and information we no longer need to retain.

Send requests to privacy@abaflow.com.au. We may need to verify your identity before acting on a request.

Communications and cookies

We send service messages needed for your account, payments, security and support. We send marketing messages only where permitted and provide an unsubscribe option.

ABAFlow uses essential browser storage and cookies where needed for sign-in, security, preferences and the operation of the Service. If optional analytics or marketing technologies are introduced, this policy and any required consent controls will be updated.

Privacy questions or complaints

Contact privacy@abaflow.com.au with a privacy question, access request or complaint. Please explain what happened and how you would like us to help. We will acknowledge the matter and aim to respond within 30 days.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.

Changes to this policy

We may update this policy when the Service, providers or legal requirements change. The current version will always show its effective date. We will provide reasonable notice if a change materially affects how we handle personal information.

For general support, contact support@abaflow.com.au.