Legal

Privacy Policy

Chasy Group Pty Ltd

Your privacy at Chasy

Chasy helps people manage shared expenses without the awkwardness of keeping track of who owes what and chasing people for payment.

Because the service involves personal information and information about shared expenses, we take privacy seriously. This Privacy Policy explains what information Chasy collects, how we use it, who may process it, how we protect it and the choices available to you.

Chasy is operated by Chasy Group Pty Ltd.

If you have a question about privacy or want to exercise your privacy rights, contact us at:

privacy@chasy.com.au

1. About this Privacy Policy

This Privacy Policy applies when you use Chasy through our website, web application, mobile applications or related services.

We are committed to handling personal information consistently with the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply to us.

The information Chasy collects depends on which features you use.

We aim to:

• collect only information reasonably required to provide and protect Chasy;
• use information for clear and legitimate purposes;
• limit access to personal information;
• give service providers only the information required for their function;
• keep different types of financial and personal information appropriately separated;
• protect information using appropriate technical and organisational safeguards; and
• delete, de-identify or restrict information when it is no longer required, subject to legitimate legal, security, financial and shared-record requirements.

2. Current external beta

Chasy is currently being prepared for external beta testing, including through Apple TestFlight.

For the current external beta:

• Bank Connections are disabled;
• PayTo is disabled; and
• PayID payment functionality is disabled.

External beta testers are therefore not being provided with live Open Banking or Chasy-facilitated PayTo or PayID payment functionality.

Users can still use Chasy to:

• create and join groups;
• record shared expenses;
• split expenses between participants;
• calculate balances;
• review who owes what;
• manage settlement obligations;
• report and confirm payments made outside Chasy;
• set payment commitments or dates; and
• use Chasy's reminders and follow-up features.

If Chasy later enables Open Banking, PayTo, PayID or another regulated payment service, additional personal or financial information may be required.

We will review and update our privacy disclosures before or when those features become available.

3. Information we collect

Account and profile information

When you create or use a Chasy account, we may collect:

• your name;
• email address;
• phone number where used for authentication or communication;
• Chasy user identifier;
• profile details;
• account status; and
• relevant account preferences.

Authentication information

Chasy uses a specialist authentication service to manage registration, sign-in, identity and user sessions.

Authentication information may include:

• your name;
• email address or phone number;
• authentication identifiers;
• verification status;
• session information;
• sign-in and sign-out events; and
• security and access records.

The authentication service does not have direct access to Chasy's private production database or shared-expense records.

Groups, invitations and guests

When you create, join or participate in a Chasy group, we may collect:

• group names;
• group membership;
• member names and identifiers;
• invitation information;
• email addresses or phone numbers used for invitations;
• guest names and details;
• membership status; and
• information about joining, leaving or being removed from a group.

A person may be included as a guest in a group or expense before they create a Chasy account.

Shared expenses and splits

Chasy collects information required to manage shared expenses, such as:

• expense descriptions;
• merchant or description information entered by a user;
• expense dates;
• amounts;
• who paid;
• participants;
• split methods;
• individual allocations;
• notes;
• changes and corrections;
• questions or issues raised by group members; and
• expense history.

Balances and settlements

Chasy calculates and records information about amounts group members owe each other.

This may include:

• group balances;
• settlement rounds;
• settlement obligations;
• payer and recipient information;
• payment dates and commitments;
• reminder activity;
• follow-up activity;
• payment reports;
• confirmation that an external payment was made or received;
• payment method descriptions where recorded;
• partial payment amounts;
• settlement status;
• cancellations; and
• settlement history.

For the current external beta, Chasy does not provide live PayTo or PayID payment processing.

Where people pay each other outside Chasy, information about the payment may be recorded in Chasy so the relevant obligation and group balance can be updated.

Receipts

You may choose to upload or photograph a receipt to help create or update an expense.

We may collect:

• the receipt image;
• merchant information;
• date;
• amount;
• individual line items; and
• other information appearing on the receipt.

Receipt scanning is optional.

Receipts can sometimes contain personal or sensitive information unrelated to the expense. You should avoid uploading information that you do not want processed by Chasy or shared with the relevant group.

Where automated receipt extraction is used, the extracted information should be reviewed by the user because automated extraction may be incomplete or inaccurate.

Notifications

Chasy may provide in-app, email, push and, where enabled, SMS notifications relating to:

• group invitations;
• expenses;
• reviews;
• reminders;
• payment commitments;
• settlement obligations;
• account activity;
• support matters; and
• security.

Information used to provide notifications may include:

• your email address or phone number;
• device push tokens or similar device references;
• notification preferences;
• delivery status;
• delivery failures;
• whether an in-app notification has been read; and
• identifiers or links needed to direct you to the relevant part of Chasy.

External notifications are designed to contain limited information and direct you back to the authenticated Chasy application.

We do not intentionally include detailed banking information, payment credentials or unnecessary sensitive financial information in external notifications.

Support and correspondence

If you contact Chasy, we may collect:

• your name;
• contact details;
• details of your enquiry;
• correspondence;
• screenshots or attachments you choose to provide;
• complaint information; and
• information reasonably required to investigate or resolve the matter.

Technical, diagnostic and security information

We collect limited technical and operational information required to operate, maintain and protect Chasy.

This may include:

• account and user identifiers;
• authentication events;
• timestamps;
• access-denied events;
• application and API events;
• device or push references;
• security events;
• administrative events;
• application errors;
• background processing information;
• deployment information; and
• infrastructure monitoring records.

Our production logging is designed to use identifiers, timestamps, event types and status information rather than unnecessarily recording detailed financial information, receipt contents or credentials.

Chasy does not currently use third-party session replay or screen-recording tools within the product.

We do not currently use third-party behavioural advertising trackers within Chasy.

4. Device permissions

Some Chasy features may request access to functions on your device.

Camera and photos

If you choose to photograph or upload a receipt, Chasy may request access to your device camera or photo library.

We use this access only to allow you to capture or select content for the feature you have chosen to use.

Camera and photo permissions are not used by Chasy for advertising or behavioural profiling.

Contacts

Where a Chasy version offers contact-assisted invitations, Chasy may request access to device contacts so that you can select someone to invite.

Contact information accessed for that purpose is used to support the invitation process and is not used by Chasy to build an unrelated marketing database or for behavioural advertising.

You can decline a device permission, although the feature requiring that permission may then be unavailable.

Notifications

Your device or operating system may ask you whether Chasy can send notifications.

You can manage these permissions through your device settings.

5. How we collect information

We may collect personal information:

• directly from you;
• when you create or update your account;
• when you create or join a group;
• when you invite another person;
• when another person invites or includes you in a group;
• when you create, edit, review or split an expense;
• when you upload a receipt;
• when you report or confirm a payment;
• when you use settlement, reminder or follow-up features;
• when you contact Chasy;
• from our authentication and operational service providers; and
• automatically through application, security and infrastructure systems.

Where another Chasy user provides your contact details to invite you to a group, we use that information for the invitation and associated onboarding process.

6. How we use personal information

We may use personal information to:

• create and operate Chasy accounts;
• authenticate users;
• maintain secure sessions;
• create and manage groups;
• deliver group invitations;
• record and split shared expenses;
• calculate balances;
• calculate settlement obligations;
• maintain expense and settlement records;
• provide reminders and automated follow-up;
• record payments made outside Chasy;
• process optional receipt scans;
• deliver notifications;
• provide support;
• investigate disputes and errors;
• prevent misuse and protect accounts;
• detect and respond to security incidents;
• maintain and improve service reliability;
• meet accounting, legal and regulatory obligations; and
• comply with legitimate obligations to our service providers.

We do not sell personal information.

We do not sell banking, financial, receipt or settlement information.

We do not provide banking, receipt or settlement information to third parties for their own advertising.

7. Information shared within Chasy groups

Chasy is a shared-expense service, so some information is intentionally visible to other members of the relevant group.

Depending on the feature, group members may see:

• relevant participants;
• expense descriptions;
• merchants or descriptions deliberately included in an expense;
• amounts;
• dates;
• who paid;
• split allocations;
• group balances;
• settlement obligations;
• review status;
• payment confirmation or settlement status;
• notes; and
• receipts deliberately attached to a shared expense.

Users should only add information that is appropriate to share with the relevant group.

Information belonging to one group is not intended to be visible to unrelated groups.

8. Service providers

Chasy uses selected service providers to help operate and support the service.

We limit information provided to each service provider to what is reasonably required for its approved function.

Amazon Web Services

Amazon Web Services provides Chasy's core production infrastructure, including backend services, the private production database, storage, security logging, monitoring and parts of our notification infrastructure.

Chasy's primary production backend and database are hosted in the AWS Sydney region in Australia.

OpenAI

OpenAI is used only for optional receipt processing.

If you choose to use receipt scanning, receipt information may be sent to OpenAI so information such as the merchant, date, amount and line items can be extracted to assist with expense entry.

Chasy does not send Open Banking transaction information, payment-provider information, banking credentials or general production database contents to OpenAI.

Chasy does not use receipt contents for advertising or behavioural profiling.

Authentication services

Chasy uses a specialist authentication provider to provide registration, sign-in, user identity, session management and account security.

The provider receives information required to authenticate your account but does not have direct access to Chasy's private production database or shared-expense records.

Application hosting

Chasy uses a specialist hosting provider to deliver the user-facing application.

The hosted frontend communicates securely with Chasy's AWS backend.

The frontend hosting provider does not have direct access to Chasy's private production database.

Notification and communication services

Chasy may use service providers to deliver email, push notifications and, where enabled, SMS messages.

These providers may receive limited information required for delivery, such as:

• your email address or phone number;
• device push tokens;
• delivery information;
• generic notification wording; and
• links back to Chasy.

These services are not intended to receive detailed expense, banking or payment information.

Mobile platform services

Where you use Chasy through a mobile application, mobile platform providers such as Apple may process information required for app distribution, device permissions and push notification delivery.

Their handling of information is also subject to their own privacy policies and device settings.

Professional and operational providers

We may use specialist providers and professional advisers for services such as:

• security testing;
• technical support;
• legal advice;
• accounting;
• privacy and compliance advice; and
• incident response.

They are provided access to personal information only where reasonably necessary for the service being provided and subject to appropriate confidentiality, privacy and security requirements.

9. Bank Connections and payment services

Bank Connections, PayTo and PayID payment functionality are disabled for the current external beta.

This Privacy Policy does not represent those features as currently available to external beta testers.

If Chasy later enables Open Banking or payment functionality, those services may involve additional regulated service providers and additional information such as:

• Open Banking consent information;
• bank transaction information;
• account information;
• payment instructions;
• recipient information;
• provider identifiers;
• payment status;
• payout information; and
• reconciliation records.

Before those features are made available, Chasy will review and update its privacy disclosures and provide any additional consent or collection information required for those services.

Chasy intends to maintain strict separation between Open Banking information, payment information, authentication services, receipt processing, frontend hosting and notification systems.

10. Storage and overseas processing

Chasy's primary production backend and private production database are hosted in the AWS Sydney region in Australia.

Some supporting service providers, including services used for authentication, application hosting, receipt processing, notifications and mobile platform services, may operate global infrastructure or use subprocessors located outside Australia.

The countries involved may change as provider infrastructure and subprocessors change.

Where personal information may be processed outside Australia, Chasy takes reasonable steps appropriate to the nature of the information and the service to:

• assess the provider;
• limit the information disclosed;
• apply appropriate contractual or technical controls; and
• protect the information from misuse, loss and unauthorised access or disclosure.

Chasy maintains stricter boundaries for financial and regulated information.

If Open Banking functionality is introduced, Open Banking information will not be provided to general authentication, receipt-processing, frontend-hosting or notification providers unless that use has been specifically assessed and is permitted under the applicable regulatory framework.

We may update this policy as our providers or processing locations materially change.

11. Security

Chasy uses technical and organisational safeguards designed to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

Depending on the information and system involved, these safeguards include:

• private production database infrastructure;
• restricted production access;
• server-side authorisation;
• encrypted network communications;
• multi-factor authentication for critical administrative systems;
• least-privilege access controls;
• secure management of production credentials and secrets;
• security and audit logging;
• monitoring and alerts;
• controlled software releases;
• separation of production and development systems;
• provider access restrictions; and
• data minimisation.

No online service can guarantee absolute security.

If we identify a security or privacy incident, we will investigate it and take appropriate steps to contain, remediate and assess any notification obligations.

12. Data retention and deletion

We retain information only for as long as reasonably required for the purpose for which it is held, including product, security, support, dispute, accounting and legal requirements.

Our current retention framework generally provides for:

Account and profile information

Retained while the account is active and generally for up to 30 days after account closure, subject to legitimate retention requirements.

Group and expense records

Retained while the group is active and generally for up to two years after final settlement or group closure.

Receipts and extracted receipt information

Retained while attached to an active expense and generally for up to 90 days after the relevant expense or group is deleted.

Notification delivery information

Generally retained for up to 90 days.

Support and complaint records

Generally retained for two years after the matter is closed.

Application and operational logs

Generally retained for up to three months.

Security, audit, deletion and administrative records

May be retained for up to six years where required for security, accountability or compliance purposes.

Production database backups

Generally retained for 14 days under the normal backup lifecycle.

Financial and payment records

Where payment functionality is introduced, records required for financial reporting, reconciliation, disputes, fraud prevention, accounting or legal purposes may need to be retained for longer periods, including up to seven years.

Information may be retained for longer where reasonably required because of:

• a legal obligation;
• a legal hold;
• an unresolved dispute;
• a security investigation;
• suspected fraud;
• accounting requirements;
• an outstanding settlement; or
• the rights of another Chasy user.

Because Chasy contains shared records, deleting one user's account does not necessarily mean every historical group or expense record can be deleted.

Where appropriate, Chasy may delete or de-identify a user's personal information while retaining the minimum information necessary to preserve the integrity of a shared expense or settlement history.

Information deleted from active systems may remain within protected backups until the normal backup lifecycle expires.

13. Access and correction

You may request access to personal information Chasy holds about you.

You may also ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

Much of your information can be viewed directly through Chasy.

Some information can also be corrected through the relevant profile, group, expense or settlement workflow.

For information that cannot be accessed or corrected directly, contact:

privacy@chasy.com.au

We may need to verify your identity before providing access to or changing personal information.

There may be circumstances where we are permitted or required to refuse access or correction. If that occurs, we will explain the reason where required.

14. Account deletion

You may request closure or deletion of your Chasy account through any account-deletion function available in Chasy or by contacting:

privacy@chasy.com.au

We aim to acknowledge account deletion or closure requests within two business days and complete them within 30 days, unless:

• a shorter legal or regulatory timeframe applies; or
• particular information must legitimately be retained.

When an account is closed, information may be:

• deleted;
• de-identified;
• disconnected from the account; or
• retained with restricted access where required.

Limited information may need to remain where necessary to:

• preserve shared group records;
• resolve outstanding settlement matters;
• investigate disputes;
• respond to security incidents;
• prevent fraud;
• meet accounting or legal obligations; or
• protect the rights of other users.

We do not retain personal information simply because it might be useful at some point in the future.

15. Communications and marketing

Chasy may contact you about:

• invitations;
• account matters;
• security;
• expenses;
• group activity;
• reviews;
• reminders;
• payment commitments;
• settlement obligations;
• support matters; and
• important service changes.

These operational communications are part of providing Chasy and are different from marketing communications.

Where permitted, Chasy may also use ordinary account or contact information to tell users about Chasy features, updates or offers.

We do not use:

• bank-account details;
• Open Banking transaction history;
• receipt contents;
• individual settlement obligations;
• payment amounts;
• security incidents;
• complaint information; or
• sensitive information

to target marketing.

Where a marketing communication is optional, it will include an appropriate way to unsubscribe or opt out.

Opting out of marketing does not stop necessary account, security, group, reminder or settlement communications.

Chasy does not sell personal information to advertisers.

16. Cookies and similar technologies

The Chasy website and web application may use cookies, local storage or similar technologies where required for:

• authentication;
• session management;
• security;
• remembering necessary settings; and
• operating the application.

These technologies may be provided in conjunction with our authentication or hosting services.

Chasy does not currently use third-party behavioural advertising cookies or session replay within the application.

If we introduce material analytics, advertising or tracking technology in the future, we will first assess the privacy implications and update our disclosures and consent mechanisms where required.

17. Automated processing

Chasy uses software automation to operate parts of the service, including:

• expense split calculations;
• balance calculations;
• settlement calculations;
• reminders and follow-up;
• notification scheduling;
• receipt data extraction; and
• operational and security processes.

These automated functions do not currently make decisions that determine a person's creditworthiness, eligibility for a financial product or similar significant legal rights or interests.

Information requiring judgement can generally be reviewed, confirmed or corrected by the relevant user.

If Chasy introduces automated decision-making that could significantly affect a person's rights or interests, we will review the privacy implications and update this Privacy Policy as required.

18. Privacy complaints

If you believe Chasy has not handled your personal information appropriately, please contact:

privacy@chasy.com.au

Please provide enough information for us to understand and investigate the issue.

We aim to:

• acknowledge a privacy complaint within two business days;
• investigate it fairly;
• request further information if required; and
• provide a response as soon as reasonably practicable, normally within 30 calendar days.

If you are not satisfied with our response, you may be able to make a complaint to the Office of the Australian Information Commissioner (OAIC).

Information about privacy rights and complaints is available at oaic.gov.au.

19. Changes to this Privacy Policy

We may update this Privacy Policy when Chasy's information-handling practices change.

This may occur when we:

• introduce Open Banking;
• introduce PayTo, PayID or another payment service;
• materially change our receipt-processing arrangements;
• add or change a material service provider;
• introduce new device permissions;
• introduce analytics or advertising technology;
• change material retention practices;
• introduce significant automated decision-making; or
• need to respond to changes in law or regulatory requirements.

The latest version will be published at:

https://chasy.com.au/privacy

The effective date and last updated date at the top of this policy will show when it was most recently changed.

Where a change is material, we may also notify users through Chasy or another appropriate communication channel.

20. Contact us

For privacy questions, access or correction requests, account deletion requests or privacy complaints:

Chasy Group Pty Ltd

Email: privacy@chasy.com.au

Website: https://chasy.com.au