Privacy Policy
Last updated: 8 Sept 2026
1. Who We Are and What This Policy Covers
TREVY is operated by Trevor Wayne Wheeler trading as TREVY (ABN 32 335 055 405) in Queensland, Australia (TREVY, we, us or our). This Privacy Policy explains how we handle personal information when you use our mobile and web applications, marketing website, business websites, enquiry forms, customer portals, public links, free tools, support and connected services (together, the Service).
We comply with privacy laws that apply to us, including the Privacy Act 1988 (Cth) and Australian Privacy Principles where they apply. This Policy covers TREVY's handling of information. A business using TREVY is separately responsible for how it collects and uses information about its customers, workers, suppliers and website visitors.
2. Our Role and the Business User's Role
Businesses decide what client, worker, supplier and operational information to enter into TREVY and how to use it. We handle that information to provide the Service and follow the business's lawful instructions. If you submit an enquiry on a TREVY-hosted business website, your information goes to that business and TREVY processes it to deliver and manage the enquiry. Contact the business about its own privacy practices.
3. Information We Collect
Account, identity and business information
This may include names, email addresses, phone numbers, profile images, sign-in identifiers, business names, ABNs and other tax registrations, addresses, logos, business settings, roles, permissions and account relationships. Authentication providers may handle passwords or social sign-in credentials.
Clients, workers, suppliers and enquiries
This may include contact details, locations, work requests, website enquiries, messages, appointment information, job history, portal activity and photos supplied with an enquiry. A business user may enter information about another person, and that person may also provide information through a link, form or portal.
Business operations and content
This may include projects, jobs, visits, schedules, time records, forms and submissions, notes, price books, services, website content, service areas, domains, files, photos, attachments, signatures, communications and activity records.
Financial, transaction and accounting information
This may include quotes, invoices, credit notes, payments, refunds, disputes, expenses, receipts, suppliers, tax rates, account mappings, transaction status and identifiers, subscription status and app-store purchase information. TREVY does not store full customer card numbers entered into Stripe.
Location and route information
With device permission and when a relevant feature is used, we may process addresses, coordinates, route requests, estimated travel, arrival information and precise background location during an active On My Way trip.
Technical, usage and communications information
This may include IP address, device and browser information, operating system, app version, push-notification token and settings, identifiers, log and diagnostic data, crash reports, security events, feature activity, website analytics, support messages, emails and legal acceptance records.
4. How We Collect Information
We collect information directly from you; from a business owner, team member, customer, supplier or other person who uses the Service; automatically from apps, browsers and devices; and from services you choose to connect, such as Xero, Stripe, Apple, Google, Firebase and RevenueCat. We may also receive information when someone opens or acts through a document, portal, tracking or website link.
5. Why We Use Information
6. When Information Is Shared
We share information only as needed to provide the Service, follow an authorised user's instructions, protect TREVY or others, or comply with law. Depending on the feature, information may be available to the business owner and authorised team members; a selected customer, supplier or professional adviser; the business receiving a website enquiry; or a person who has an authorised portal or public link.
We may disclose information to regulators, courts, law enforcement, advisers or another party where reasonably necessary for a legal obligation, safety, fraud prevention, a claim, or a genuine sale or restructure of TREVY. If ownership changes, we will require personal information to remain protected. We do not sell or rent personal information.
7. Service Providers
We use providers to operate the Service. They may include Hetzner for infrastructure; Google and Firebase for authentication, messaging, analytics, diagnostics and Gemini; Mapbox for maps and routing; Stripe for business onboarding and customer payments; RevenueCat, Apple and Google for subscriptions; Xero for accounting integration; and ZeptoMail or Resend for email delivery where configured. Providers handle information under their own terms and privacy practices as well as our arrangements with them.
8. Xero Information
If a business owner connects Xero, we receive authorised identity, organisation and accounting information and exchange supported records between TREVY and the selected Xero organisation. This can include organisation settings, account and tax-rate catalogues, contacts, suppliers, invoices, credit notes, payments, expenses, bills, bank transactions and related documents or receipts.
We store connection details, encrypted access and refresh tokens, organisation identifiers, permissions, mappings, links, sync status, cursors and error records to operate and troubleshoot the connection. We do not use Xero API data to train artificial-intelligence or machine-learning models. On disconnect, we revoke or remove active access credentials and archive limited connection metadata needed for integrity, security and support. Xero retains information under its own policy.
9. Stripe and Subscription Information
When a business connects Stripe, TREVY may send business identity and contact details to prefill Stripe onboarding. Stripe collects verification and payment details directly and sends TREVY limited account, transaction, payment, refund, dispute and status information. Customer card details entered into Stripe do not pass through or remain in TREVY's systems.
Apple, Google and RevenueCat process subscription purchases. We receive purchase, entitlement, product, renewal, expiry and related identifiers needed to provide paid access and support billing. We do not receive the full payment-card details used by the app stores.
10. AI Receipt Scanning
If you choose AI receipt scanning, the selected JPEG or PNG receipt image is prepared and sent to Google's Gemini API to extract suggested expense fields. The scan image is not saved by the scan request itself. A processing record and result may be kept for up to 24 hours for retry, usage and support purposes, and short-lived daily usage records are kept to enforce limits. If you save the expense, the receipt becomes part of the business account and may be sent to Xero if you direct TREVY to synchronise it.
TREVY does not use or permit its providers to use User Content, Xero data or receipt images to train generative-AI models unless you separately give express permission. AI scanning is optional and manual expense entry remains available.
11. Maps, Routes and Live Location
Mapbox processes addresses, coordinates and route requests to provide search, maps, directions and travel estimates. Route previews and precise GPS tracking points are normally retained for up to 30 days, subject to operational configuration and earlier account deletion. When you start On My Way, a selected customer can view live progress and estimated arrival through the link sent to them until sharing stops or the link expires. Device settings can restrict location access, but doing so may prevent location features from working.
12. Business Websites, Free Tools and Analytics
A TREVY-hosted business website may publish information chosen by that business. If you submit its enquiry form, TREVY stores and delivers your name, email, optional phone number, work details and up to four photos to that business. The business controls follow-up and may retain or delete the lead in TREVY. We record limited website events such as page views and contact actions; the provider-site page-view record uses a random view identifier rather than storing your IP address or user agent.
Free invoice and quote tools process the content you enter to create a PDF. That document content is not saved to a TREVY account or document database, but we may create ordinary request, security and rate-limit logs. On TREVY's marketing website, cookies or similar technologies and Google Tag Manager may be used for analytics and to record events such as app-store clicks, contact submissions and free-tool use. Analytics events are not intended to include the invoice or quote content you enter. Browser settings can limit cookies, although parts of the website may work differently.
13. Overseas Processing
TREVY's primary application, database and object-storage infrastructure is hosted by Hetzner in Helsinki, Finland. Other providers may process information in Australia, the United States, the European Union or European Economic Area, and other countries where they or their subprocessors operate. Overseas privacy laws may differ from Australian law. We choose established providers and take reasonable steps appropriate to the service and applicable law when arranging overseas processing.
14. Security
We use safeguards designed to protect information, including encrypted network connections, access controls, restricted production credentials, monitoring, and encryption of sensitive integration tokens and supported payment information. No internet or storage system is completely secure. You should protect your devices and sign-in methods, limit team access, keep exported copies secure and tell us promptly if you suspect misuse.
15. Retention and Deletion
We keep information for as long as reasonably needed to provide the Service, support the business account, meet legal and tax obligations, resolve disputes, prevent fraud and maintain security. Retention depends on the type of information and how the feature is used. Businesses can delete some records, files and leads through the Service. Connected providers keep their own copies under their policies.
An account owner can schedule deletion. There is normally a 30-day cancellation period before operational deletion begins. When processing begins, TREVY disconnects Xero, deletes the company data and storage files, and removes the user account where it is no longer connected to another business or relationship. Deletion may be retried if a provider or storage operation is temporarily unavailable.
Residual copies may remain in routine backups until they are overwritten. We may retain limited legal acceptance, transaction, security, fraud-prevention, support or deletion records where reasonably required by law or legitimate operational needs. Where practical, retained information is restricted or de-identified. Export important business records before requesting deletion.
16. Access, Correction and Your Choices
Account users can view and correct much of their information in TREVY. Depending on applicable law, you may ask us to provide access to personal information we hold about you, correct it, delete it, or explain how it has been handled. We may need to verify your identity and may refuse or limit a request where the law permits, including where it would disclose another person's information. We will explain a refusal where required.
You can manage notification and location permissions through TREVY and your device, disconnect Xero using TREVY's controls, manage your connected Stripe account through Stripe, unsubscribe from marketing messages, and schedule account deletion. A customer or worker seeking access to information controlled by a business should usually contact that business first.
17. Privacy Questions and Complaints
Contact us with a privacy question, access or correction request, or complaint. Include enough detail for us to investigate, but do not email unnecessary sensitive documents. We will acknowledge and investigate a complaint within a reasonable time. If the Privacy Act applies and you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.
18. Children and Changes to This Policy
TREVY business accounts are not intended for people under 18. Public business websites are not directed to children, and users should not submit information about a child unless it is lawful and reasonably necessary for the relevant service.
We may update this Policy when the Service, providers, law or our practices change. We will update the effective date and give reasonable notice of material changes through the Service, email or another appropriate channel. We may ask account users to acknowledge an updated version.