Hello Cashflow Privacy Policy

A legal disclaimer

Last updated: 1 October 2026

Hello Cashflow Limited (8169568) ("Hello Cashflow", "we", "us") provides cashflow forecasting and budgeting tools, and a free Financial Health Check report, that you can connect to Xero, QuickBooks Online, and other business systems. This policy covers our website at hellocashflow.com, the landing pages we run for our advertising campaigns at landing.hellocashflow.com ("our landing pages"), and the application at app.hellocashflow.com ("the app"). Where they differ, we say so. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you access our web application, request a Financial Health Check, start a trial, or use related services (collectively, the "Services").

Hello Cashflow Limited is the agency responsible for the personal information described in this policy. Our privacy officer can be reached at support@hellocashflow.com.

We handle personal information in accordance with the New Zealand Privacy Act 2020. If you are in Australia, we also handle it in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth). If you are in the United States, see section 7.

1. Information we collect

We collect only the information required to operate Hello Cashflow and to satisfy Xero and Intuit platform requirements when you authorise an accounting-provider connection. This includes:

Account details: name, email address, business name, phone number if you provide it, authentication identifiers (via Firebase Auth), and organisation settings that you provide when you register or are invited to an account.
Financial data from Xero or QuickBooks Online: bank transactions, chart of accounts, general ledger balances, invoices, bills, journal entries, customers, suppliers, budgets, and other bookkeeping data that you authorise us to sync through the Xero or QuickBooks API. We import this data on a read-only basis to power dashboards, budgeting insights, and the Financial Health Check. We do not write data back to your accounting provider.
Information about other people. Your accounting data will usually contain personal information about people other than you, for example the names and contact details of your customers, your suppliers, your contractors, and in some cases your staff. We hold and use that information on your behalf, only for the purposes described in this policy, and we do not use it to contact those people or to market to them. You are responsible for having the authority to give it to us and for meeting your own obligations to the people it is about. If one of them contacts us directly about their information, we will normally refer them to you.
Financial Health Check and trial sign-ups: when you request a free Financial Health Check or start a trial before subscribing, you give us your name, email address, and business name, and you authorise us to sync the financial data above, so that we can generate your report and email you a secure link to it, along with a link to download a PDF copy. If you give us your details but do not go on to connect your accounting provider, we keep them so that we can follow up with you as described in section 2. We also keep a customer-relationship record for your business that may include how you found us, which emails we have sent you and whether you opened them, an internal rating of how engaged your business is, tags, and notes made by our team. This applies whether or not you go on to subscribe.
Payment details: we use Stripe to take payments. When you start a card-upfront trial or subscribe, your card details pass from your browser to Stripe directly and never reach our systems. Stripe is certified to PCI DSS Level 1. Stripe makes available to us: card brand, last four digits of your card, expiry, billing address you gave at checkout. We never receive your full card number or security code, and only store Stripe identifiers and subscription status.
Fraud checks when you pay: Stripe's scripts run on the pages where you enter payment details. They collect technical information about your device and browser, and signals about how the page is used, for example how long you spend on it and whether card details were typed or pasted. Stripe uses this to detect card testing and fraud, not for advertising, and handles it under its own privacy policy. We do not receive it.
Product configuration data: cashflow scenarios, budgeting assumptions, notes, and other business inputs you create inside Hello Cashflow.
Usage and diagnostics: device and browser metadata, your IP address, feature usage events, and error logs, collected to maintain reliability, improve performance, and meet our logging obligations.
Support interactions: messages and attachments you send to support@hellocashflow.com, through the contact form on our website, or through in-product forms; any feedback you give us when you cancel; and, if you join a coaching or support call with us, a recording and transcript of that call, which we make with your agreement so that we can follow up accurately.
Cookies and tracking tools: The app uses cookies that are strictly necessary to keep you signed in and secure. Our website, hosted by Wix, uses only Wix's built-in visitor statistics. Our landing pages, and the two app pages you see after connecting your accounting software or starting a trial, use Google Analytics and the Meta Pixel to measure our advertising. These set cookies and tell Google and Meta about your device, the pages you visit, and the ad that brought you to us; our landing pages also keep a first-party cookie for 90 days to remember where you came from. If you came through a landing page, we also tell Google and Meta when you connect your accounting software, start a trial, or first pay. For Meta we include a hashed (scrambled) version of your email address. Visitors from the United Kingdom, the European Economic Area and Switzerland are asked for consent first. None of these tools receive your financial data or the contents of your reports. You can opt out as described in section 6.

2. How we use information

We use personal information to:

Provide, operate, and secure the Services you request.
Sync, enrich, and display Xero and QuickBooks data that you have authorised.
Deliver budgeting recommendations, cashflow projections, Financial Health Check reports, AI-generated insights, budget suggestions and groupings (produced from summarised financial data using a third-party AI provider, as described in section 3), and scenario planning features.
Send operational communications, for example onboarding guidance, product updates, security notifications, trial reminders, scheduled report reminders (which may include your report as a PDF attachment), and billing notices.
Marketing communications. When you provide your name, email address and business name, to request a Financial Health Check, download content, start a trial, or submit any of our forms, you consent to receiving marketing emails from Hello Cashflow. These may include the content you requested, cashflow tips, and information about our plans, features, and offers, and may refer to figures from your own report. We use the customer-relationship record described above to determine what to send and when. Every marketing email identifies Hello Cashflow as the sender and includes a working unsubscribe link, as required by the Unsolicited Electronic Messages Act 2007 (NZ) and, for Australian recipients, the Spam Act 2003 (Cth). You may withdraw consent at any time via that link or by emailing support@hellocashflow.com. Unsubscribing takes effect immediately and does not affect operational messages such as billing, security, or service notices.
Produce aggregated and de-identified statistics about how the Services are used, and, where our accounting platform partners permit it, anonymous industry benchmarks. This information cannot identify you or your business, and we do not release the underlying data.
Monitor platform health, detect fraud or abuse (including preventing repeat use of one-time free offers), and comply with legal or contractual obligations, including Xero's and Intuit's API and developer policies.
Respond to questions, troubleshoot issues, and provide customer support.
Advertise and measure. We use the tools described in section 1 to measure whether our advertising works, and, using data collected on our landing pages, to show Hello Cashflow ads to people who have visited our landing pages, and to reach audiences similar to businesses that have enquired. We do not use your financial data or report content for any of this.

Automated outputs. Scores, forecasts, ratings, and recommendations in the Services are generated automatically from your data. They are provided for information only. We do not use them to make decisions about you that have a legal effect, and we do not make credit decisions about you or supply them to credit reporting agencies. No automated output decides anything about your account. If we ever need to restrict, suspend, or close an account, someone on our team reviews the situation and makes that call.

3. How we share information

We do not sell personal information. We share information only with:

Service providers, who process data on our behalf under confidentiality agreements. Your data is hosted with Amazon Web Services in the Sydney, Australia region. Only the specific data described in this section leaves that environment. Our other providers are authentication (Google Firebase, United States), payment processing (Stripe, United States), email delivery (Postmark, United States), website hosting (Wix, United States), log management and error monitoring (Logz.io, United States), and a customer relationship system held with Wix (United States) that we are retiring.
AI providers. We use AI providers for two different purposes. None of them uses your data to train its models.

In the product. We use OpenAI (United States) for three features: the insights in your reports and dashboards, budget suggestions, and sorting the issue reports you submit in the app. For insights and budget suggestions we send monthly summary figures for your organisation. We do not send your name, email address, contact details or individual transactions. Where a feature asks you to type something, such as an issue report, the text you type and details of the screen you were on are sent as well. OpenAI may keep this data for up to 30 days to monitor for abuse, then deletes it. It does not use it to train its models. What these features produce is information, not a decision about you, as described under Automated outputs above.

Our Team. Our team uses AI assistants, including Anthropic's Claude, OpenAI's ChatGPT and Google's Gemini (United States), to help analyse code, documents, call notes, and customer feedback while building, supporting, and improving the Services. Where investigating a fault, answering a support question, or verifying that a feature works correctly requires it, a limited extract of the affected data may be included. We keep such extracts to the minimum the task needs, access is logged, and we do not use these tools for general access to customer data. These tools are used under account settings that do not permit model training.

Internal tooling: our team uses Slack and similar collaboration tools (United States) to receive operational notifications. These can include your name, email address, subscription status, and any feedback you leave when cancelling, so that we can respond to you quickly. When you join a call with us, we may record it using Zoom or Google Meet, and transcribe it using Otter, and our support team may record short screen videos of your account using Tella or Loom to explain a problem to our engineers (all United States). These tools are used only by Hello Cashflow staff and are bound by the same confidentiality and access controls as our other systems.
Integration partners: Xero and Intuit QuickBooks Online, and any other integrations you explicitly connect. We transmit the minimum data required to fulfil the actions you request.
Your accountant, bookkeeper, or adviser: if you add them as a team member, or your organisation is linked to their Partner account, they (and a Partner's team members) can access your organisation's data in Hello Cashflow. This happens at your direction, and you can remove a team member yourself in Settings or ask us to end a Partner link at any time.
Professional advisers and authorities: when required by law, regulation, or to protect the rights, property, or safety of Hello Cashflow, our customers, or others.
A buyer or successor, if Hello Cashflow is involved in a merger, acquisition, financing, or sale of assets. Personal information may be transferred as part of that transaction. We will require the recipient to honour this policy, and we will tell you before your information becomes subject to a materially different privacy policy.
Advertising and analytics providers: Google (United States) receives page-visit information from our landing pages and the two app pages described in section 1, and notice of your sign-up milestones, through Google Analytics. Once Google Ads is enabled, Google will also use those milestones to measure our Google advertising. Meta Platforms (United States) receives page-visit information from the same pages, notice of your sign-up milestones, and a hashed version of your email address where you came to us through a landing page. They use it to report to us on our advertising, and also for their own purposes under their own privacy policies, including improving their advertising services and, in Meta's case, personalising the ads you see. Neither receives your financial data.

Where we use service providers outside New Zealand, we take reasonable steps to ensure appropriate safeguards are in place before disclosing personal information, including contractual protections comparable to those required by the Privacy Act 2020, or Standard Contractual Clauses where relevant. The countries our providers operate in are set out above and we will keep that current.

4. Data retention

We keep your data for a short time by design. We are not a reporting entity under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009, we do not hold or move your money, and we are not required to keep your records for five or seven years. So we do not.

We retain personal information for as long as your organisation maintains an active Hello Cashflow account, or as long as needed to deliver the Services you have requested. The paragraphs below set out what happens after that.

When your subscription ends. If your subscription ends and you do not resubscribe within 30 days, we disconnect from your accounting provider and delete your financial data from our live systems within a further 30 days. You can ask us for an export of your data during that first 30 day period (see the Terms of Service, clause 13.5), or ask us to delete it sooner.

If you disconnect your accounting provider. If you disconnect Hello Cashflow from Xero or QuickBooks, or your provider disconnects us, and you do not have a subscription, we delete your financial data from our live systems within 30 days. If you have a subscription we keep your data so that you can reconnect.

Financial Health Check leads. If you request a free Financial Health Check but do not subscribe, we disconnect from your accounting provider and delete your report and the financial data behind it within 90 days of your last interaction with us. Details you enter on our landing pages are kept by our landing-page system for the same period and deleted on the same schedule. If you disconnect us before then, the 30-day rule above applies.

Your contact details. Whether or not you went on to subscribe, we keep the contact details you gave us, your name, email address, and business name, separately from your financial data. We keep them, and our customer-relationship record, for as long as you remain on our mailing list, or have an account with us. Every message has an unsubscribe link. If you unsubscribe and do not have an account with us, or ask us to delete your details, we remove them and keep only a suppression record so that we do not contact you again by mistake. If you have an account, unsubscribing stops marketing only, and your details stay with your account until it is closed.

Usage and diagnostic logs. We keep usage events and error logs for up to 12 months, after which they are deleted or aggregated so that they no longer identify you.

Advertising and analytics data. We keep Google Analytics data for 14 months. Google and Meta hold the data collected through their tools under their own retention rules.

Backups. We keep continuous backups of our database for 35 days and a monthly backup for 12 months, used only for disaster recovery. Deleted data may remain in those backups until they expire. We do not use backups to restore data we have deleted at your request.

Business record kept after deletion. Separately from anything above, we keep a minimal record of each business that has connected to Hello Cashflow. It holds a one-way hash of the accounting-provider organisation identifier, the business name, tags describing how the business came to us, and dated entries recording which offers it has received and when. It holds no report content, financial data, email address, or phone number, and we cannot use it to contact anyone. We keep it indefinitely so that one-time offers cannot be claimed repeatedly, including where the same organisation reconnects later. These are kept to protect the integrity of our systems, are tamper-evident, are accessible only to authorised staff, and are never used to contact anyone or to rebuild deleted data. Where a business name identifies an individual, for example a sole trader trading under their own name, we treat the record as personal information and will delete it on request. Separately, our internal security and audit records may retain references to a deleted organisation.

5. Security

We secure data using encryption in transit (TLS 1.2 or higher) and at rest, restrict access to personal information to authorised staff through role-based permissions, log and monitor system activity, and review our security posture annually to satisfy Intuit's security assessment programme and Xero's partner requirements. While no method of transmission is entirely secure, we continually improve our technical and organisational safeguards. If a privacy breach is likely to cause you serious harm, we will notify you and the relevant regulator as soon as practicable, as required by law.

If you believe you have found a security vulnerability in the Services, please tell us at support@hellocashflow.com.

6. Your choices and your rights

Xero and QuickBooks access: you can disconnect Hello Cashflow at any time from Xero under Settings, Connected apps, from the QuickBooks Apps dashboard, or by contacting us. Disconnecting stops future data imports.
Marketing emails: every marketing email includes an unsubscribe link, which takes effect immediately. You can also email support@hellocashflow.com and we will action your request within 5 working days. Unsubscribing does not stop operational messages you need in order to use the Services, such as billing notices or security alerts.
Advertising and analytics: you can block the tools in section 1 with your browser settings or a content blocker, install Google's Analytics opt-out add-on, and manage ad personalisation in your Google Ads Settings and Meta Ad Preferences. You can also email support@hellocashflow.com to ask us to stop sending your details to Google and Meta. We honour Global Privacy Control signals wherever we use advertising tools.
Access and correction: you have the right to ask what personal information we hold about you, to get a copy of it, and to ask us to correct it if it is wrong. Email support@hellocashflow.com. We respond within 20 working days, or sooner where the law requires. If we decline to correct information, you can ask us to attach a statement of the correction you sought, and we will do so.
Export and deletion: email support@hellocashflow.com to request an export or deletion of personal information. Some information may be retained where the law requires it, or as described in section 4.
Partner access: to find out whether an accountant or adviser is linked to your organisation, or to remove their access, email support@hellocashflow.com.
Complaints: if you are not happy with how we have handled your information or your request, contact our privacy officer at support@hellocashflow.com and we will look into it. If you are still not satisfied, you can complain to the Office of the Privacy Commissioner (New Zealand) at privacy.org.nz, or, if you are in Australia, to the Office of the Australian Information Commissioner at oaic.gov.au.

7. Residents of the United States

If you are in the United States, the following applies in addition to the rest of this policy. We do not sell personal information. Through our landing pages and the two app pages described in section 1, we share limited information with Meta (cookie identifiers, page activity, notice of sign-up milestones, and a hashed email address) and page activity and notice of sign-up milestones with Google, for advertising measurement and remarketing, which some state laws treat as ‘sharing’ for cross-context behavioural advertising. When we enable Google Ads, Google will also use those milestones to measure our Google advertising. You can opt out at any time by emailing support@hellocashflow.com, and our landing pages honour Global Privacy Control signals. We do not use sensitive personal information for any purpose other than providing the Services. Depending on the state you live in, you may have the right to know what personal information we hold about you, to obtain a copy of it, to correct it, and to ask us to delete it. Email support@hellocashflow.com to make a request. We will not discriminate against you for exercising any of these rights.

8. Age and business use

The Services are intended for business use by people aged 18 or over. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

9. Changes to this policy

We may update this Privacy Policy to reflect new functionality, legal requirements, or security practices. Changes will be posted on this page with an updated "Last updated" date. Where a change materially affects how we handle your personal information, we will tell you by email or in-product notice before it takes effect.

10. Contact us

For privacy questions or requests, contact us at:

Privacy officer: support@hellocashflow.com

Hello Cashflow Limited, 490e Main Road North, Timberlea, Upper Hutt, 5018, New Zealand