Legal
Version 3.0. Effective 30 September 2026
Welcome to Ensurva Pty Ltd’s (“Ensurva”, “we”, “us” or “our”) Privacy Policy.
Ensurva respects your privacy and is committed to protecting your personal information. This Privacy Policy informs you about how we use and look after your personal information (also referred to as personal data), including any personal information you may provide through our website and our platform or when you request information from Ensurva or otherwise communicate with us, and when your personal information is provided to us relating to our business.
We are subject to the Privacy Act and the APPs. Where applicable privacy laws provide for exceptions or exemptions, we may rely on those exceptions or exemptions in our information handling practices.
Ensurva is responsible for your personal information. Ensurva is also responsible for the website located at https://ensurva.com and the platform which helps businesses understand and manage supplier spending and contracts.
Our Privacy Department is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy, including any requests to exercise your legal rights (including any opt-out mentioned in this Privacy Policy), please contact the Privacy Department using the details set out below.
Our contact details are:
In this Privacy Policy:
Where reasonably practicable to do so, we will collect your personal information directly from you. For example you may give us personal information when you use our platform at https://ensurva.com, when you contact us either directly or through our website or social media pages, in the course of administering and performing any contracts or services for us or through our recruitment or engagement processes.
We only collect personal information that is reasonably necessary for our functions or activities. The types of personal information we collect about you depends on the circumstances in which the information is collected. The personal information we generally collect includes the following:
If you are a customer or an authorised user, we also collect account and subscription details (e.g. organisation membership, job title, login details, roles and permissions, the plan selected, payments you make, method of payment, invoices and cancellation details). We also collect enquiries, support requests and feedback you provide.
If you are an employee, individual contractor or apply for a role with us, in addition to name and contact details, we may also collect information relevant to your engagement with us including qualifications, length of engagement, resume, current and former employment details, pay rate and salary, bank details, feedback from supervisors and referees, training records and logs of your usage of our equipment (e.g. phones, computers and vehicles).
In certain cases we may collect personal information about you from publicly available sources and third parties, such as suppliers, recruitment agencies, referees, contractors, our customers and business partners.
We collect supplier and spending information from a customer’s Xero organisation when an authorised administrator connects it to Ensurva. The connection is read-only and initially retrieves supplier bills for the preceding 24 months and relevant supplier contacts. While the connection remains authorised and access to the service is active, it then synchronises automatically each day without the customer having to initiate it. Synchronisation stops if the customer disconnects Ensurva in Xero or the Ensurva app, the authorisation lapses or access is locked. This includes names, contact details, dates, amounts, line items, account codes, tax details and payment status. It does not create, change, approve, pay or delete Xero transactions or contacts.
We retrieve relevant supplier contracts, invoices and receipts from a folder an authorised person shares with us. These documents may contain personal information, including names, contact details, signatures, commercial terms and renewal dates. Customers should use a dedicated folder and limit the information shared to what is needed for the service. Information collected from a customer may relate to its users, supplier contacts, sole traders and individual contractors, whether or not those people have an Ensurva account.
Google sign-in provides basic identity information, such as name, email address and profile image. Signing in does not give us access to your mailbox, files or administrative workspace information.
You can revoke a Xero connection through Xero or the platform, revoke folder access through the source service, or contact us for help. This stops future collection through that connection. Information already imported remains subject to section 8 and any stricter source-provider requirements. Customers must remove departing users’ access and revoke connections when authority ends. Their remaining authorised users may continue to access previously imported business records.
We collect personal information when you use the website or platform and when you navigate through them. Information collected automatically may include:
Cookies help maintain sessions, preferences and security. You can restrict cookies through your browser, although this may affect sign-in and other functions.
If you give us personal information about other people (for example your users or supplier contacts) then you confirm that you have authority to do so, have obtained their consent where required, and will make them aware of the information in this policy about how we will use their personal information. This does not replace our own obligations to take reasonable steps to notify individuals of the collection or ensure they are aware.
In addition to the types of personal information identified above, we may collect personal information as otherwise permitted or required by law.
If we receive personal information we did not request, we assess whether we could lawfully have collected it. If not, and it is not a Commonwealth record, we destroy or de-identify it as soon as practicable where lawful and reasonable.
If you do not provide personal information that we request, it may mean that we are unable to provide you with the platform or customer services you have requested or consider you for the role you have applied for. You can make general enquiries anonymously or using a pseudonym where lawful and practicable. We need enough information to operate an account, authenticate access and respond safely to requests. Optional connections can be declined, but the related functions will not be available.
As a general rule, we only collect, use and process personal information for purposes that would be considered relevant and reasonable in the circumstances. The purposes for which we use and disclose your personal information will depend on the circumstances in which we collect it. Whenever practical we endeavour to inform you why we are collecting your personal information, how we intend to use that information and to whom we intend to disclose it at the time we collect your personal information.
We may use or disclose your personal information:
In general, we collect, use and disclose your personal information so that we can do business together and for purposes connected with our business operations.
Some of the specific purposes for which we collect, hold, use and disclose personal information are as follows:
We use AI and other computer programs to extract information from documents, classify suppliers, match records, identify spending patterns and renewal dates, and produce customer-specific summaries and insights. Inputs may include supplier names and contact details, invoice descriptions and amounts, transaction and payment details, contract terms, signatures, renewal information and document content. Classifications, summaries and inferences about an identifiable individual are also personal information, even if incorrect.
Our analyses may substantially assist customers in deciding whether to retain, renegotiate with, consolidate or replace suppliers. These decisions may significantly affect sole traders and individual contractors. Customers make the final decision and should check source records and context. Automated account and billing processes use account, subscription and payment information to administer trial expiry, renewals and access restrictions under the Terms of Service. The platform does not itself select, engage, renew or terminate a supplier or a person’s employment. You can request access to or correction of personal information used in these processes under section 9.
Customer documents and supplier records are used to provide the relevant customer’s service. We do not currently combine customers’ records into a retained cross-customer benchmark dataset or use them for aggregated marketing insights. We do not use customer information, source-provider data or de-identified aggregates to train, fine-tune, adapt or enhance AI or machine-learning models. We use AI services under applicable provider terms and account settings under which submitted information is not used for model training, and do not opt in to training or voluntary data sharing. Using an existing model to analyse information for a customer is different from training a model.
We only collect sensitive information about you where reasonably necessary for our functions or activities and with your consent, or otherwise in accordance with the Privacy Act.
Our platform is not intended to collect sensitive information. Customers should remove sensitive or unrelated information before sharing documents.
Providing sensitive information, or including it in a document, does not by itself establish consent to its collection, use or disclosure. We use and disclose sensitive information only for the purpose for which it was collected or as otherwise permitted by privacy law.
We may send you messages (by telephone, post, text, email, SMS and other digital means) to administer your account, trial, subscription and payments and keep you informed about our terms and conditions and features of our website and platform.
We may also send you marketing messages (usually via email or SMS), to inform you about products and services (including those of others) that may be of interest to you where:
You can opt out of receiving direct marketing messages at any time by contacting us (see Contact Us at the beginning of this Privacy Policy) or by following the unsubscribe instructions in our marketing messages. We identify ourselves in marketing messages and action email and SMS unsubscribe requests within five working days, without requiring you to log in or close your account. Necessary service messages may continue. Unsubscribing does not cancel a subscription.
We may disclose your personal information to third parties in connection with the purposes described in section 2 of this Privacy Policy. This may include disclosing your personal information to the following types of third parties:
Details of our service providers, the information they handle and relevant locations and retention arrangements are set out on our Service Providers and Data Locations page at https://ensurva.com/legal/service-providers. That page forms part of this Privacy Policy and is updated as providers and arrangements change. If our information handling practices change, we update this Privacy Policy where necessary.
Information imported into a customer’s account is available to that customer’s authorised users according to their permissions. We do not disclose customer-specific supplier records, documents or analyses to other customers. Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including applicable Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy. Where those requirements apply, they also protect derived, aggregated and de-identified information. We do not use Google user data for advertising, cross-customer benchmarking or AI model training. Human access and transfers are limited to permitted circumstances, including specific consent where required.
Before we disclose personal information to a third party, we take steps to ensure that the third party will protect personal information in accordance with applicable privacy laws and in a manner consistent with this policy.
Sometimes the third party will be located outside of Australia, in which case see section 6 for more information.
Our payment provider collects your card details directly when you choose to provide a payment method for a paid subscription, including during a trial, to administer subscriptions and recurring payments. We use the limited billing information it provides to administer your subscription, invoices and billing enquiries. The provider may also handle information independently for legal, security and fraud-prevention purposes.
PCI-DSS requirements help ensure the secure handling of credit card information by our platform and its service providers.
For more insight, please read our payment provider’s privacy policy, linked on our Service Providers and Data Locations page. That policy explains the provider’s own information handling. This Privacy Policy continues to apply to personal information we hold or handle.
Ensurva does not hold or have access to complete card numbers or card security codes provided to our payment provider. We do receive billing contacts and addresses, customer and subscription identifiers, card brand, last four digits and expiry, invoices, payment status and cancellation details.
This website and our services may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share information about you. We do not control these third-party websites and are not responsible for their privacy practices. When you leave our website, we encourage you to read the privacy policy of every website you visit. This does not remove our responsibility for our own collection, use or disclosure of personal information, including through our service providers.
Communication, engagement and actions taken through external social media platforms are subject to the terms and conditions as well as the privacy policies of those social media platforms.
Some of the third parties to whom we disclose personal information are located outside Australia. The countries in which such third party recipients are located depend on the circumstances. In the ordinary course of business we commonly disclose personal information to recipients located in the United States. Our primary production database and document storage are in Sydney, Australia. Some information is processed overseas, including documents and supplier records sent for AI analysis, and identity, billing, notification, support and technical information. Our Service Providers and Data Locations page identifies the countries where recipients are likely to be located, where practicable, including relevant support and subcontractor locations. You can contact us for further information.
From time to time we may also engage an overseas recipient to provide services to us, such as cloud-based storage solutions. Please note that the use of overseas service providers to store personal information will not always involve a disclosure of personal information to that overseas provider.
Countries outside Australia where personal information relating to you may be stored and/or processed, or where recipients of personal information relating to you may be located, may have privacy and data protection laws which differ to those under the Privacy Act. Information handled overseas may be subject to lawful access under local laws.
We take measures to ensure that any international transfer of information is managed carefully and in accordance with applicable data protection laws. Before disclosing personal information overseas, we take reasonable steps required by APP 8.1 to ensure the recipient does not breach the APPs in handling it, unless a specific legal exception applies. This includes appropriate contractual, security, purpose and retention safeguards. We may remain accountable under the Privacy Act for an overseas recipient’s handling. We do not seek your agreement to disapply APP 8.1 through this Privacy Policy.
We may, from time to time, expand, reduce or sell our business, and this may involve the transfer of certain divisions or the whole business to other parties. Personal information relating to you may, where relevant and lawfully permitted, be disclosed to prospective buyers under appropriate confidentiality safeguards or transferred along with that division and the new owner or newly controlling party will, under the terms of this Privacy Policy, be permitted to use personal information relating to you for the purposes described in this Privacy Policy, subject to applicable privacy law and source-provider restrictions.
The security of personal information received from or about you is a high priority. We take such steps as are reasonable to store personal information regarding you so that it is protected from unauthorised use or access, misuse, interference, loss, modification or unauthorised disclosure. We only use third party service providers whom we are satisfied look after personal information securely and in accordance with privacy laws. This includes both physical and electronic security measures. Examples include:
We promptly assess suspected data breaches and take containment and remediation steps. We take all reasonable steps to complete an assessment of a suspected eligible data breach within 30 days and notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable where the law requires. We also notify customers without undue delay of actual or reasonably suspected incidents materially affecting their data, unless prohibited by law, and cooperate with their assessments.
We will destroy or de-identify personal information once it is no longer needed for a valid purpose or required to be kept by law.
Following account closure, we ordinarily retain customer information for 30 calendar days to allow reactivation and export. This period runs from account lock following trial cancellation, trial expiry without paid activation or a failed first payment; from cancellation and account lock following an unsuccessful renewal retry period or cancellation during that period; or, for another paid subscription, from its expiry or termination. The Terms of Service explain other locks and temporary suspensions. Collection and synchronisation from connected services stop on account lock, except as briefly needed for a secure authorised export, and whenever no longer authorised.
Unless the account is reactivated, we delete customer information from active systems at the end of that period. This includes imported records, shared documents and customer-specific summaries and analyses. Connection tokens are revoked and deleted when no longer authorised and, in any event, on permanent deletion.
Customers may request earlier deletion, subject to authority checks and lawful retention. We provide a secure export link before a scheduled lock or when a customer immediately cancels a trial. During the retention period, an authorised customer can request an export, which we provide within five business days (excluding weekends and public holidays in Melbourne, Victoria) following reasonable checks and before deletion. If an authorised customer requests an export within the retention period, we defer deletion of the information reasonably required to fulfil the request until the export has been provided, then delete it unless another permitted retention ground applies. After an urgent security lock, export may need to wait until safe and lawful. Individual privacy requests are handled under section 9.
Ensurva-controlled backups are deleted or overwritten within a further 35 calendar days after active-system deletion. They are isolated from ordinary use and deletions are reapplied after disaster recovery. Provider retention can differ: some identity-provider offline backups may remain for up to 14 months, and AI services may retain abuse-monitoring logs or application records. The Service Providers and Data Locations page explains these arrangements. We give appropriate deletion instructions and take reasonable steps to restrict retention and use; a provider’s standard policy does not remove our own obligations.
We may retain the minimum billing, taxation, accounting, security, fraud-prevention, dispute and legal-claim records, and evidence of acceptance or payment authority, for as long as reasonably needed for the relevant permitted purpose or legal requirement. Retained records are restricted to those purposes and are not used for continued customer-specific vendor intelligence. Payment providers and customer-connected services may independently keep their own records. Deleting an Ensurva account does not delete a customer’s source-service account.
You may contact our Privacy Department (see the contact details section at the start of this Privacy Policy) to request access to the personal information that we hold about you and/or to make corrections to that information, at any time. If we lawfully refuse access, we will provide you with a written notice stating our reasons for refusing access (unless unreasonable to do so) and how you can complain. We may seek to recover from you reasonable, non-excessive costs incurred for providing you with access to the personal information we hold about you. We explain any access charge in advance. There is no charge to make a request or correct information. You do not need an Ensurva account to exercise these rights. We may make reasonable identity or authority checks and work with the relevant customer to locate records, without removing our own obligations.
We take reasonable steps to correct personal information that is inaccurate, out of date, incomplete, irrelevant or misleading for the purpose for which it is held. If we refuse a correction request, we will provide you with a written notice stating our reasons for refusing (unless unreasonable to do so) and how you can complain. You can ask us to associate a statement of the correction sought with the information. On request, we also take reasonable steps to notify other APP entities to which we disclosed corrected information, unless impracticable or unlawful.
We will respond to all requests for access to or correction of personal information within a reasonable time. We ordinarily respond within 30 days.
We ask that you contact us to update or correct your information if it changes or if the personal information we hold about you is inaccurate.
If you have any questions, concerns or complaints about this Privacy Policy or how we handle your personal information, including if you believe we have breached the APPs or an applicable registered APP code, please contact our Privacy Department (see the contact details section at the start of this Privacy Policy).
When contacting us please provide as much detail as possible in relation to your question, concern or complaint.
We take all complaints seriously, and will respond to your complaint within a reasonable period. We request that you cooperate with us during this process and provide us with any relevant information that we may need. We acknowledge complaints promptly, investigate and aim to provide a substantive written response within 30 days. If more time is needed, we explain why and give an expected response date. Our response explains our findings and any proposed remedy.
If you are dissatisfied with the handling of your complaint, or it has not been resolved within a reasonable period, you may contact the Office of the Australian Information Commissioner,
Office of the Australian Information Commissioner
GPO Box 5288, Sydney NSW 2001
Telephone: 1300 363 992
Privacy complaints: https://www.oaic.gov.au/privacy/privacy-complaints
We review and amend our Privacy Policy from time to time. Any changes we make to this Privacy Policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to this Privacy Policy. We take reasonable steps to notify affected people of material changes and obtain consent where required. Changes do not retrospectively authorise unlawful handling or reduce accrued rights. Continued use does not replace any required consent. You can contact us for a free copy of this Privacy Policy or the Service Providers and Data Locations page, including another accessible form where reasonable.
Last updated: 29th September 2026