Privacy policy

Who we are

Deliverta is operated by [legal entity name], ABN [number], of [address], Australia ("we", "us"). We are the controller of the personal information described here. Contact us at hello@deliverta.com.

What we collect

From Xero	Your name, email address and Xero user id when you sign up. For each organisation you connect: its name, address, phone, email and tax number; quotes and sales invoices changed in the last 90 days and after; and the contact details on those documents, including billing and delivery addresses, phone numbers and email addresses. We never read bills, bank data, payroll or reports.
What you create	Delivery notes and packing slips, your templates and logo, docket numbers, dispatch dates, quantities, receiver names and phone numbers, and notes you type.
From signers	When someone signs a delivery note on a phone: their name, the signature image, the time, an optional photo, their location if they allow it, and the device's IP address and browser identifier. The signing page tells the signer this before they sign.
Email	The address a signed copy is sent to, and whether that email was delivered or bounced, as reported by our email provider.
Billing	When you subscribe, your payment details go directly to Stripe. We store your subscription status and the last four digits of the card, never the card number.
Technical	Server logs with request ids, organisation ids, timestamps and error messages. Logs never contain Xero tokens, signatures, photos or document contents.

What we use it for

• Building, printing and storing your delivery notes and packing slips.
• Capturing signatures and attaching the signed PDF to the matching invoice in Xero.
• Emailing a signed copy to your customer when you ask us to.
• Keeping a tamper-evident record of who signed what and when, which is the point of proof of delivery.
• Running, securing and supporting the service, and billing you for it.

We do not sell personal information, and we do not use it for advertising.

Where it is stored

Our application and database run on Railway in Singapore. Files, including PDFs, signature images and photos, are stored in Railway's private object storage, which may hold them outside Australia and New Zealand. Data is encrypted in transit and at rest, and your Xero access tokens are encrypted with a key held outside the database.

This means your data is held outside Australia and New Zealand. The Australian Privacy Act 1988 and the New Zealand Privacy Act 2020 allow this with reasonable safeguards and disclosure, which this page provides. If your business must keep data onshore, contact us before connecting.

Who else processes it

Xero	The source of your documents and the destination of signed attachments. Xero's own privacy policy applies to data in Xero.
Railway	Hosts the application and database in Singapore, and stores files.
Cloudflare	Serves this website and the app.
Mailgun	Sends signed copies and notification emails.
Stripe	Handles subscription payments.

Each of these is a company outside Australia and New Zealand. We share only what each one needs to do its job.

How long we keep it

• Signature images and photos are deleted after the retention period your organisation sets, from one to seven years. The signed PDF and its audit record remain while your account exists.
• Cached copies of Xero documents are refreshed on each sync and deleted when you disconnect the organisation.
• Disconnecting a Xero organisation deletes its access tokens immediately. Your documents stay readable.
• Deleting your account disconnects every organisation only you belong to, revokes our access in Xero, and deletes your data and files within 30 days.
• Server logs are kept for a short period for security and support for 30 days.

Cookies

This website sets no cookies. The app sets one session cookie so you stay signed in. There are no analytics or advertising cookies anywhere.

Your rights

You can see, correct or export the information we hold about you, and you can delete your account from the app at any time. Signers who want their signature or photo removed can ask us or the business that delivered to them. If you are not happy with how we handle a request, you can complain to the Office of the Australian Information Commissioner or, in New Zealand, the Office of the Privacy Commissioner.

Changes

We will email account holders at least 14 days before a change that affects what we collect or who processes it. Smaller changes are noted here with a new version number.