Privacy Policy
Last updated 8 July 2026
TaxDuck is built to be private by default. This policy explains what we collect, why, and what we don't touch.
What we collect
- Bank statements you upload are parsed entirely in your browser. The raw file never leaves your device.
- Classified line items and totals for your report are stored so you can revisit it after paying.
- Account email (if you create one) so we can send your report-ready email and let you sign back in.
- Payment records from Stripe — we see the payment status and last-4 of your card, never full card details.
What we don't collect
- Your bank login credentials — we never ask for them.
- The raw PDF or CSV of your statement.
- Tax File Numbers or Medicare numbers.
How we use it
- To generate your deduction report.
- To send transactional emails about your report and account.
- To detect fraud and abuse of the service.
We do not sell your data. We do not use it for advertising.
Sub-processors
- Lovable Cloud (Supabase) — database and authentication, hosted in Australia.
- Stripe — payment processing.
- Mailgun (via Lovable) — transactional email delivery.
Retention
Report data is kept for 7 years to align with ATO record-keeping rules, unless you ask us to delete it sooner. Email you can request deletion at support@taxduck.com.au.
Your rights
Under the Privacy Act 1988 (Cth) you can request access to, correction of, or deletion of your personal information. Email support and we'll action requests within 30 days.
Contact
Privacy questions or complaints: support@taxduck.com.au.