Privacy Policy

Last updated 14 October 2026

The Tech Company Group (ABN 60 997 507 184) operates TCG Invoice, an invoicing service for small businesses and trades. This policy explains what personal information we collect, why, who we share it with, and what you can do about it. It is written to meet our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you or your clients are in South Africa, it also covers the Protection of Personal Information Act 4 of 2013 (POPIA) — see If you are in South Africa below.

Two kinds of people appear in this policy, and the distinction matters throughout: you, the business that signs up for an account, and your clients, the people you invoice. We handle information about both, but in different roles.

Information we collect about you

• Account details — your email address, and your mobile number if you choose to sign in that way.
• Business details — business name, business email, country, ABN, and whether you are registered for GST.
• Payment details for your subscription — on the website, handled by Stripe; in the phone app, by Apple or Google, with RevenueCat telling us whether your subscription is active. We never see or store your card number; we hold only a customer reference and your current plan.
• Bank details you choose to show on invoices — if you enable bank transfer, the account details you enter are stored so they can be printed on the invoices you send.
• Your ID, passport or company registration number, if you connect card payments through Paystack — passed to Paystack once, only so your bank can check the account card payments are paid into is yours. We don't keep it. We keep the name on the account and whether the bank confirmed it.
• If you sign in with Google, Apple or Facebook — your name and email address from that account. With Sign in with Apple you can choose to hide your email, in which case we receive a private relay address instead.
• Your business address, if you set up Tap to Pay — Stripe registers in-person card payments against a business location, so we pass it to Stripe.
• Job descriptions for AI drafting — when you use “Describe the job”, the words you type or say, together with the descriptions and prices of items you have invoiced before, are sent to our AI provider to suggest line items and prices.
• Prices you find with Find a price — when you use a supplier's price on a quote line, we keep with that line the supplier's name, the price, the product's name and link, and when you found it. It is for your business only: never printed on or sent with a quote or invoice. The supplier's website opens in the app's own browser (or a new tab on the website); what you do there is between you and the supplier, under their privacy policy.
• Technical information — server logs recording requests to the service, including IP address and timestamps, kept for security and troubleshooting.

Information you give us about your clients

When you create a client or issue an invoice, you provide us with that person's name, and typically their mobile number or email address so we can deliver the invoice. We hold this information on your behalf. We do not market to your clients, sell their details, or use them for any purpose other than delivering and processing the invoices you send.

Proof of payment from your clients. When an invoice can be paid by bank transfer, PayID or PayShap, your client can send their bank's proof of payment (a PDF or a photo) from the invoice's payment page. It usually shows their name, the amount, the date, the reference and part of their bank account details. We keep the file in private storage that only you and any admins of your business can open, through a link that lasts one minute; your staff, other businesses and the public cannot see it. Photos are re-saved without the location and camera details a phone adds. We check the file's type and size, and we never use it for anything but showing it to you. It is kept with the invoice, and deleted with your account.

Payment confirmations. For each payment recorded on an invoice we can make a confirmation for you to download or share. For a card payment it includes what Stripe or Paystack tell us about it: the card type and last four digits, their fees, and when the money is paid into your bank.

You are responsible for having a proper basis to give us your clients' details, and for the accuracy of what you enter.

The TCG Invoice phone app

The phone app uses the same account and data as the website. It also asks your phone for a few permissions. Each is asked for only when you use the feature that needs it, and you can turn any of them off in your phone's settings:

• Location — only while you take a Tap to Pay card payment, because Stripe checks where in-person payments are taken. We do not track or store your location, and it is never collected in the background. Supplier websites you open from Find a price are never given it: when one asks, the app says no for you.
• Microphone and speech recognition — only while you tap “Speak the job”. Your phone's own speech service (Apple or Google) turns your words into text; we receive the text, not the recording.
• Contacts — only if you choose to find or add a client from your contacts. The search happens on your phone: your contacts are never uploaded. Only the client you pick and save is stored, like any client you type in. You can always type a client in by hand instead.
• Face ID, Touch ID or fingerprint — to sign you in if you turn it on. This is handled entirely by your phone. We never receive your face or fingerprint data.
• NFC — used by Stripe during a Tap to Pay payment to read your client's card or phone. Card details go to Stripe and never reach our systems.

The app does not contain advertising, and it does not share data with advertisers or data brokers.

How we use information

• To provide the service — creating, sending and tracking invoices.
• To send invoices to your clients by SMS or email, on your instruction.
• To take payment for invoices through Stripe or Paystack, including in person with Tap to Pay, and to bill you for your subscription.
• To suggest line items from a job description, and estimate prices for work you haven’t charged for before, when you ask for it.
• To authenticate you when you sign in.
• To tell you about your account and changes to our terms or the service, using your business email. We don't send marketing to it without asking.
• To respond when you contact us for support.
• To keep records we are required by law to keep, and to detect and prevent misuse.

We do not sell personal information, and we do not use your invoice data or your clients' details to train machine learning models. Our AI provider processes job descriptions only to return a suggestion and, under its commercial terms, does not use them to train its models.

Who we share information with

We use a small number of service providers to run TCG Invoice. Each receives only what it needs to do its job:

Some of these providers store or process information outside Australia, which means personal information may be disclosed to overseas recipients (APP 8). We take reasonable steps to ensure they handle it consistently with the APPs, but their handling is also governed by their own terms and the laws of the countries they operate in.

We may also disclose information where we are required or authorised by law, or where it is necessary to investigate suspected fraud or misuse.

Security

Data is transmitted over encrypted connections and stored in databases with access controls that restrict each account to its own records. Payment card details never reach our systems. No system is perfectly secure, and we do not claim otherwise — but we take reasonable steps to protect information from misuse, loss, and unauthorised access.

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and — for South African users — the Information Regulator under POPIA.

How long we keep information

We keep your account and invoice records for as long as your account is open, and for a period afterwards where we are required to — tax and business records generally must be kept for five years under Australian law. When we no longer need information and are not required to keep it, we delete or de-identify it.

Accessing and correcting your information

You can view and correct most of your information directly in the app, under Settings and in your client and invoice records. Under Settings you can also download your data as spreadsheets, and delete your account.

Deleting your account removes your sign-in immediately. If nobody else belongs to your business, it also deletes the business and all of its clients, quotes, invoices and payment records, and cancels a subscription paid on the website. A subscription bought in the phone app is billed by Apple or Google and must also be cancelled in your phone's subscription settings. If others belong to the business, it stays with them. Because you may need to keep tax records for five years or more, download your data before deleting. Copies in our backups are removed as those backups expire.

Step-by-step instructions, including how to ask by email if you can't sign in, are on our Delete your account page.

For anything you cannot do yourself — including a copy of the personal information we hold about you — email privacy@thetechcompanygroup.com. We will respond within a reasonable period, normally 30 days.

If your client asks you to correct or delete their details, you can do that yourself in the app. If they contact us directly, we will generally refer them to you, since the information is yours to manage.

Cookies and tracking

We set cookies that are necessary for the service to work — principally to keep you signed in. We do not use advertising cookies or third-party tracking pixels inside the application. Emails we send you may record whether they were opened or delivered, which we use to tell whether sign-in messages are reaching people.

Children

TCG Invoice is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16.

Changes to this policy

We may update this policy as the service changes. The date at the top shows when it was last revised. If we make a change that materially affects how we handle your information, we will tell you by email or in the app before it takes effect.

If you are in South Africa

For South African users and their clients, we handle personal information in line with POPIA. In POPIA's terms, we are the responsible party for your account information, and an operator processing your clients' details on your behalf — you remain the responsible party for those.

• Information Officer. Our Information Officer can be reached at privacy@thetechcompanygroup.com.
• Why we may process it. To perform our contract with you (running your account, sending your invoices and quotes, taking payments), to meet legal obligations such as tax record-keeping, and for our legitimate interest in keeping the service secure and working. We do not sell personal information or use it for direct marketing without consent.
• Your rights. You may ask whether we hold your personal information and for a copy of it, ask us to correct or delete it, and object to its processing on reasonable grounds. Email us and we will respond within 30 days.
• Information sent outside South Africa. Some providers in the table above store or process information in other countries, including Australia and the United States. We use providers bound by contracts and privacy laws that give protection substantially similar to POPIA, as section 72 requires, and transfers are needed to provide the service you signed up for.
• Records. South African tax law generally requires business records to be kept for five years, and we keep invoice records for at least that long while your account is open.
• Security breaches. If personal information is accessed or acquired without authorisation, we will notify the Information Regulator and affected people as soon as reasonably possible, as section 22 requires.
• Complaints. If you are not satisfied with our response, you can complain to the Information Regulator (South Africa) at inforegulator.org.za.

Complaints and contact

If you have a question or want to complain about how we have handled your personal information, email privacy@thetechcompanygroup.com. We will acknowledge your complaint and aim to resolve it within 30 days. If you would prefer to write to us, ask and we will give you a postal address.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.