privacy policy
Last updated: October 2026
This Privacy Policy describes how Beljay Labs ("we", "us", "our") collects, uses and protects your information when you use our carbon snapshot, carbon reporting, business health scan or business health monitoring services (together, the "Service").
1. information we collect
1.1 Xero account data
When you connect your Xero account, we access:
- Organization name and details
- Your name and email address, which Xero shares with us when you connect
- Chart of accounts (ledger names and codes)
- Transaction data (purchases, expenses, sales)
- Contact/supplier information (names, categories)
- Invoice attachments (when using Invoice Intelligence features)
1.2 usage data
We collect information about how you use the Service, including:
- Classification corrections you make (to improve accuracy)
- Reports generated and features used
- Technical logs for troubleshooting
2. how we use your information
We use your data exclusively to:
- Provide the Service: Calculate carbon footprint estimates and generate reports
- Improve accuracy: Train our classification system based on your corrections
- Support you: Respond to inquiries and troubleshoot issues
- Enhance the Service: Develop new features and improve existing ones
3. data sharing
We do not sell your data. We may share data only in these circumstances:
- Service providers, all bound by confidentiality agreements: cloud hosting and database storage (Render); document-reading and AI model providers, which read invoices and other documents and analyse data; an email delivery provider; and a service that counts visits to our web pages. Section 8 says where they are.
- Legal requirements: When required by law or to protect our rights
- Aggregated data: We may publish anonymized, aggregated statistics (e.g., "average emissions by industry") that cannot identify individual organizations
4. data security
We implement appropriate security measures including:
- Encryption in transit (HTTPS/TLS)
- Secure database storage with access controls
- OAuth 2.0 for Xero authentication (we never see your Xero password)
- Regular security reviews and updates
5. data retention
We retain your data as follows:
- While connected: Data is retained to provide the Service
- After disconnection: We delete your transaction data within 30 days
- Aggregated insights: Anonymized patterns may be retained indefinitely
6. your rights
You have the right to:
- Access: Request a copy of your data
- Correction: Request correction of inaccurate data
- Deletion: Request deletion of your data
- Disconnect: Revoke access at any time via Xero's settings
7. cookies and tracking
We use essential cookies only for session management and authentication. We do not use advertising cookies or third-party tracking.
8. where your data is stored and processed
We store your data in Singapore. Where a service has its own sign-in, your sign-in details are stored in Australia.
Some of our service providers are in other countries. To read invoices and other documents and to analyse your data, the Service may send parts of your data to document-reading and AI model providers in the United States. Our email delivery provider is in the United States, and the service that counts visits to our web pages is in the European Union.
We use document-reading and AI model providers only on terms that do not allow them to use your data to train their models.
9. children's privacy
Our Service is intended for business use and is not directed at children under 18. We do not knowingly collect data from children.
10. changes to this policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page.
11. contact us
For privacy-related inquiries:
Email: hello@beljaylabs.com
Address: Brisbane, Queensland, Australia