Your information.
Your control.

Information we collect

We receive information you provide, information from authorised connections and technical information generated when you use the service.

• Account and workspace details: your name, email address, account identifiers, workspace membership, invitations and permissions.
• Connected financial records: data from the Xero organisations you connect, including accounts, transactions, invoices, bills, journals and contact records. Names, contact details and transaction descriptions may contain personal information.
• Assistant requests and results: the inputs sent to an xpnAi tool, the workspace and connection used, query results, generated exports and evidence associated with finance workflows.
• Service records: subscription and billing status, support correspondence, request times, error diagnostics and administration events. Technical logs may include device, connection and IP information.

How we use information

Account and permission information lets us authenticate users and restrict access to the correct workspace. Connected records and tool inputs let us answer financial queries, prepare reports and carry out the workflows you request. Subscription records support billing; diagnostics and administration records support troubleshooting, security and accountability.

We also use contact information to respond to enquiries and send service communications. Marketing messages include an opt-out. We may use information to meet legal obligations and resolve disputes.

ChatGPT and AI assistants

When you connect an assistant, it sends xpnAi the inputs needed for a tool request. xpnAi returns results to that assistant, which may include personal information in financial records. This does not give xpnAi automatic access to your entire conversation history; information included in tool inputs is received by xpnAi.

Provide only information needed for your task. Do not put payment-card data, protected health information, government identifiers, passwords, API keys or one-time security codes in plugin requests or records selected for a plugin task. Authenticate through the connection sign-in flow.

xpnAi does not use customer data to train AI models. AI inside xpnAi requires express permission and is used to identify accounts and contacts that may be candidates for deferrals or intercompany loans, based on their names.

Your chosen assistant provider receives the results you request. Its own privacy terms and account settings govern its handling of that information, including retention and model training. Review those terms before connecting financial data.

Who receives information

Recipients include authorised personnel, hosting and support providers, professional advisers, authorised third parties and authorities where legally required. A business transfer may involve disclosure.

For xpnAi, these recipients also include your authorised workspace members, providers that support sign-in, billing, email and monitoring, Xero for connected accounting operations, and the AI provider you choose, such as OpenAI when using ChatGPT. A tool result sent to an assistant is a disclosure to that provider.

xpnAi uses Microsoft Azure hosting in Australia. Overseas providers, including those in the United States, may process information. We take reasonable steps to protect information transferred overseas consistently with Australian privacy requirements.

Storage and retention

xpnAi protects stored data with encryption and uses HTTPS for connections. Access is controlled by account and workspace permissions. See our trust and security page for details.

We retain information while your subscription is active to provide the service. After subscription termination, the following information is retained for up to 30 days and deleted earlier on request:

• Account and financial data: account details, workspace records, connected financial data, generated exports and workflow evidence.
• Request logs: assistant request records, service diagnostics and associated operational records.
• Backups: backup copies of account, financial and request data.

Request earlier deletion by emailing privacy@xpna.co. If law requires us to retain particular records longer, we retain only those records for the required period and explain the exception when responding to your request.

Revoking an assistant connection does not terminate your subscription or delete existing records. Our deletion policy applies to copies controlled by xpnAi. Previously downloaded files, source records in Xero and information already received by your assistant provider are subject to their respective owners’ controls and retention policies.

Your choices and rights

• Choose the scope: each assistant connection is authorised for one workspace. Workspace Administrators manage membership and connections.
• Control changes: Xero write access is off by default and must be explicitly enabled for an agent connection.
• Stop future access: revoke an assistant under Connections > MCP. Removing workspace membership also blocks subsequent requests. Existing export links remain usable until they expire.
• Request access, correction or deletion: email privacy@xpna.co with the account or workspace concerned. We may verify your identity and authority, and explain any legal or operational limits on the request. Do not email passwords or financial records to identify your account.
• Manage copies held elsewhere: use your AI provider’s privacy controls for conversations and results it holds. Deleting data from xpnAi does not delete source records in Xero.

Website and cookies

This website uses Google Analytics to understand visits and improve the site. Google receives website usage and device information, such as pages viewed, visit times, approximate location and browser details. Analytics cookies can distinguish visits.

You can manage or block cookies in your browser and use Google’s Analytics opt-out browser add-on. Services you visit to sign in or use xpnAi may also use cookies for authentication and preferences; blocking these can affect sign-in. Google and other linked services apply their own privacy policies to information they receive.