privacy policy
Last updated: October 2026
This Privacy Policy describes how Beljay Labs ("we", "us", "our") collects, uses and protects your information when you use our carbon snapshot, carbon reporting, business health scan or business health monitoring services (together, the "Service").
1. information we collect
1.1 Xero account data
When you connect your Xero account, we access:
- Organization name and details
- Your name and email address, which Xero shares with us when you connect
- Chart of accounts (ledger names and codes)
- Transaction data (purchases, expenses, sales)
- Contact/supplier information (names, categories)
- Invoice attachments (when using Invoice Intelligence features)
1.2 usage data
We collect information about how you use the Service, including:
- Classification corrections you make (to improve accuracy)
- Reports generated and features used
- Technical logs for troubleshooting
2. how we use your information
We use your data exclusively to:
- Provide the Service: Calculate carbon footprint estimates and generate reports
- Improve accuracy: Train our classification system based on your corrections
- Support you: Respond to inquiries and troubleshoot issues
- Enhance the Service: Develop new features and improve existing ones
3. data sharing
We do not sell your data. We may share data only in these circumstances:
- Service providers, all bound by confidentiality agreements: Amazon Web Services, which hosts the Service and stores its data, reads invoices and other documents, runs the AI models that analyse data, and sends the Service's emails. Section 8 says where it does so.
- Legal requirements: When required by law or to protect our rights
- Aggregated data: We may publish anonymized, aggregated statistics (e.g., "average emissions by industry") that cannot identify individual organizations
4. data security
We implement appropriate security measures including:
- Encryption in transit (HTTPS/TLS)
- Secure database storage with access controls
- OAuth 2.0 for Xero authentication (we never see your Xero password)
- Regular security reviews and updates
5. data retention
We retain your data as follows:
- While connected: Data is retained to provide the Service
- After disconnection: We delete your transaction data within 30 days
- Aggregated insights: Anonymized patterns may be retained indefinitely
6. your rights
You have the right to:
- Access: Request a copy of your data
- Correction: Request correction of inaccurate data
- Deletion: Request deletion of your data
- Disconnect: Revoke access at any time via Xero's settings
7. cookies and tracking
We use essential cookies only for session management and authentication. We do not use advertising cookies or third-party tracking.
8. where your data is stored and processed
We store and process your data in Australia, on Amazon Web Services. Your sign-in details, the reading of invoices and other documents, the AI models that analyse your data and our records of the emails we send you are all in Australia too. Amazon Web Services is owned by a United States company, so United States law could still reach your data.
An email we send you is delivered to your own email provider, which keeps it wherever it keeps your other mail.
If your organisation has agreed a different setup with us, such as one in which nothing leaves your own environment, your agreement says where your data is stored and processed.
We use document-reading and AI model providers only on terms that do not allow them to use your data to train their models.
9. children's privacy
Our Service is intended for business use and is not directed at children under 18. We do not knowingly collect data from children.
10. changes to this policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page.
11. contact us
For privacy-related inquiries:
Email: hello@beljaylabs.com
Address: Brisbane, Queensland, Australia