Privacy Policy
Last updated: 4 July 2026
Remi is operated by Samuel Levens, sole trader (ABN 60 951 612 988), based in Queensland, Australia ("Remi", "we", "us"). Remi connects to your Xero account to help you follow up on overdue invoices. This policy explains what personal information we collect, how we use and protect it, and your rights under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Questions or requests: hello@remi-ar.au.
Information we collect
When you sign in with Xero. We use "Sign in with Xero", so we receive your name, email address and a Xero user identifier, and — once you connect an organisation — an access token and refresh token for that organisation (stored encrypted; see Security).
From your connected Xero organisation. With your authorisation, and using least-privilege access (only the scopes needed to chase invoices), we read your organisation name, your accounts-receivable invoices (numbers, amounts, due dates, status and the invoice's online payment link), and your contacts' names and email addresses. We don't request payroll, banking, or write access beyond noting a reminder against an invoice.
Reminder activity. We keep a record of the reminders sent on your behalf: who they went to, when, the amount, and whether the recipient clicked the payment link. This gives you an audit trail and lets Remi stop chasing once an invoice is paid.
Technical data. Basic server logs (request times, errors) for security and reliability.
Usage analytics. We keep our own first-party record of how the app is used and whether it's healthy: events like signing in, connecting an organisation, a reminder being sent, and any errors the app runs into. This is counts and app activity only. We do not put your customers' or debtors' names, email addresses or invoice amounts into this analytics data, and we don't use any third-party analytics service or tracking cookies to collect it.
How we use it
- To do the job you connect Remi for: identifying overdue invoices and sending reminders you set up or approve, under your business name.
- To stop chasing once an invoice is paid or part-paid.
- To show you your dashboard and audit history.
- To operate, secure and improve the service, and to contact you about your account.
We do not sell your data or your contacts' data, and we don't use it for advertising.
Who we share it with (sub-processors)
We use a small set of providers to run Remi, and share only what's needed:
- Xero — the source of your invoice and contact data (your existing Xero relationship).
- Postmark (ActiveCampaign, United States) — delivers the reminder emails. A recipient's email address and the reminder content are processed in the United States.
- Fly.io (US company; Sydney region) — application hosting; your data is stored in the Sydney (Australia) region.
- Neon (US company; Sydney region) — database hosting; your data is stored in the Sydney (Australia) region.
We'll update this list as our providers change.
Where your data is stored (cross-border)
Your Xero and contact data is stored in Australia (Sydney). The main overseas disclosure is email delivery via Postmark in the United States (above). By using Remi to send reminders, you consent to that overseas disclosure for the purpose of delivering your messages.
Security
- OAuth tokens are encrypted at rest (AES-256-GCM) and never stored in plain text.
- Data is transmitted over TLS.
- We request least-privilege Xero access, only what's needed to chase invoices.
- Access to production systems is restricted.
No system is perfectly secure, but we take reasonable steps to protect your information.
Your account, and the people you chase
For information about your own account (your name, email) you deal with us directly. For information about your customers or debtors (their names and emails), you have the direct relationship: you're responsible for having the right to provide that information to us and to contact those people, and for the content of the reminders sent on your behalf. Remi processes that data on your instruction to deliver your reminders.
Retention and your rights
We keep your data while your account is active. If you disconnect Xero or ask us to, we delete your organisation data and tokens. You can request access to, correction of, export of, or deletion of your personal information at any time by emailing hello@remi-ar.au.
Cookies
Remi uses a single essential cookie to keep you signed in. We don't use advertising or third-party tracking cookies. Our usage analytics are first-party and recorded on our own servers (see "Usage analytics" above), not gathered through cookies.
Children
Remi is a business tool and isn't directed at anyone under 18.
Changes and complaints
We may update this policy; we'll change the "last updated" date and, for material changes, let you know. If you have a privacy concern, contact us first at hello@remi-ar.au. If you're not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
Remi is an independent application that connects to Xero. It isn't affiliated with or endorsed by Xero Limited.