Privacy Policy

• Customers — business owners and their staff who create Recoupr accounts.
• Debtors — individuals whose details a customer uploads so Recoupr can send payment reminders on the customer’s behalf.
• Visitors — people browsing recoupr.com.au.

From customers: name, email, phone, business name, ABN, business address, timezone, payment instructions (the bank/BPAY details you show your customers), subscription and billing records, and your activity within the product.

About debtors (uploaded by our customers): name, email address, phone number, company, state/timezone, invoice details (number, description, amount, due date), payment status, and the history of reminders sent. If a debtor uses the self-service portal, we also record what they tell us there: that they’ve paid, a dispute and its reason, a financial-hardship notification, or a request to stop contact.

Automatically: standard technical logs (IP address, browser type, timestamps) for security and reliability. We do not run advertising trackers.

Directly from customers when they sign up and use the product; from customers about their debtors (via CSV import or manual entry); directly from debtors when they use the self-service portal or reply to a reminder; and automatically through our infrastructure logs.

A note for debtors: your details were provided to us by the business you owe an invoice to. Recoupr acts as that business’s authorised agent to send reminders. We did not obtain your details from any other source, and we do not use them for any purpose other than managing that business’s invoice with you.

• To operate the service: sending scheduled, compliance-gated payment reminders on a customer’s behalf; recording responses; showing customers the state of their invoices.
• To honour debtor protections: enforcing contact-frequency limits, contact-hour windows, and immediately actioning hardship notifications, disputes, and opt-outs.
• To bill customers (via Stripe), provide support, secure the service, and meet legal obligations.

We do not sell personal information, use debtor information for marketing, or build profiles of debtors beyond the invoice at hand.

We disclose only what each provider needs to perform its function. We may also disclose information where required by law.

Your data is stored in Australia (Supabase and Fly.io, both Sydney). However, when we send an email reminder, the email content (debtor name, email address, and invoice details) is processed by Resend in the United States for delivery. Error logs may be processed by Sentry (US), and customer billing details are handled by Stripe (US). If SMS reminders are enabled, message content is processed by Twilio (US). For Customer account data, by using Recoupr you expressly consent to the disclosure of your personal information to these overseas recipients (such as Stripe) and acknowledge that Australian Privacy Principle 8.1 will not apply to those specific disclosures. For Debtor data routed through global delivery networks (such as Resend or Twilio), Recoupr maintains active Data Processing Agreements (DPAs) incorporating Standard Contractual Clauses to satisfy our statutory obligation to take reasonable steps to protect that information under APP 8.1.

Data is encrypted in transit (TLS) and at rest. Access is restricted through row-level security so each customer can only access their own records. Payment records are append-only and cannot be altered or deleted. Debtor portal links are single-purpose tokens that expire within 72 hours. We do not store debtor payment card or bank credentials — debtors pay businesses directly and no debtor money or payment credentials ever pass through Recoupr.

7.1 Notifiable data breaches

In the event of a suspected or confirmed eligible data breach involving Recoupr’s platform infrastructure or database systems, Recoupr will notify affected Customers as soon as practicable. Recoupr will lead the data breach assessment and carry out the required notifications to the Office of the Australian Information Commissioner (OAIC) and affected individuals in full compliance with the Notifiable Data Breaches (NDB) scheme, coordinating with impacted businesses to prevent duplicate or conflicting communications.

We keep account and invoice records while a customer account is active and for a reasonable period afterwards to meet legal, accounting, and dispute-resolution obligations. Audit and payment records are retained as immutable logs. Debtor records can be anonymised on request where no legal obligation requires retention.

Customers can access and correct their information in the app. Debtors may contact us (or the business pursuing the invoice) to access or correct their information — email privacy@recoupr.com.au. We will respond within a reasonable time and will not charge for making a request.

Every reminder includes a secure link where a debtor can, at any time: tell us the invoice is already paid; dispute the invoice; notify financial hardship (which immediately pauses all contact); or request that contact stop (which we honour immediately). These are not buried options — they appear in every message we send.

We use only the cookies necessary for sign-in sessions. We do not use advertising cookies or third-party ad trackers.

Contact privacy@recoupr.com.au and we will respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.

We will post updates to this page and update the date above. Material changes will be notified to customers by email.

MTB · ABN 27766402118 · trading as Recoupr · privacy@recoupr.com.au