Privacy Policy

Preekie is a product of CPAI Australia Pty Ltd (ACN 674 037 668), 119 Bushmans Way, South Morang, Victoria 3752. hello@preekie.com

Version 1.1 · Approved 19 October 2026 · Effective 19 October 2026

This policy explains how CPAI Australia Pty Ltd (ACN 674 037 668) ("CPAI", "we", "us") handles personal information in Preekie, and on preekie.com. CPAI is a small business under the Privacy Act 1988 (Cth), but we choose to handle personal information in line with the Australian Privacy Principles (APPs), because the information in Preekie is financial and entrusted to us by our clients.

1. What we collect

About you, as a user

• your name, email address, and the organisation and role you use Preekie for;
• sign-in and security details: your password and the key that links your authenticator app are held securely by our sign-in provider, and we never see your password;
• records of your use: sign-ins, and which organisation's information you viewed and when (our audit trail);
• technical information such as your IP address and browser type, recorded for security;
• feedback you send us, and your acceptance of these documents (which version and when).

About your organisation, from Xero

With your organisation's authority, Preekie reads, but never changes, information from its Xero file: bank transactions, contacts, organisation settings, invoices, payments and bank summary reports. This can include personal information about people your organisation deals with, such as names on contacts and transactions.

About people in meetings you record

If your organisation uses Meetings and you choose to record a meeting, we collect:

• the audio of the meeting, recorded by your own device: your microphone and, for online calls, the sound of the call;
• a transcript of what was said, and draft notes prepared from it;
• a record that you confirmed the people taking part had agreed to the recording, including which notice wording you were shown and when.

This can include personal information about anyone who speaks in the meeting, and anything else your device picks up while recording. If someone mentions health or other sensitive information, it may appear in the transcript. Meetings must not be used for medical or health consultations, or with anyone under 18.

2. Why we collect it

• to provide Preekie: showing your organisation's findings and deadlines;
• to transcribe meetings you record and prepare draft notes for your review;
• to keep Preekie secure: verifying who you are, keeping each organisation's information separate, and detecting and investigating misuse;
• to improve Preekie using your feedback;
• to meet our legal obligations.

We don't sell personal information, and we don't use it for advertising. If you don't give us the information we need, such as a working email address and authenticator, we can't give you access.

Preekie uses AI to prepare findings and draft meeting notes. It does not make decisions about individuals: a person reviews what it prepares before relying on it.

3. How we collect it

Mostly directly from you, or from your organisation when it invites you. Information about your organisation's finances comes from Xero, with your organisation's authorisation. Security records are created automatically as you use Preekie.

Meeting audio is recorded by your own device, only after you press record and confirm that the people taking part have agreed. People in the meeting who are not Preekie users are told about the recording by the person recording it.

4. Who we share it with

We use these service providers to run Preekie:

• Amazon Web Services (AWS): hosting, storage, sign-in, email notifications, meeting transcription, AI note drafting (Amazon Bedrock) and security monitoring. Preekie data is stored in AWS's Sydney region.
• Xero: the source of your organisation's data, accessed with your organisation's authorisation.
• Anthropic: AI services used to build, operate and support Preekie. These may process personal information when working on Preekie's systems. Meeting audio, transcripts and notes are not sent to Anthropic: the AI model that drafts meeting notes is run for us by AWS in Australia.
• GitHub: hosting of Preekie's source code and build pipeline. Client data is not stored there.
• Stripe: payment processing, once fees are introduced. Stripe handles card details directly; we never see or store them.

We may also disclose information where the law requires it, or to professional advisers under a duty of confidence. We don't share one organisation's information with another.

5. Overseas disclosure

Preekie data is stored in Australia. Meeting audio, transcripts and notes are processed and stored in Australia. Some service providers are based overseas, mainly in the United States (Anthropic, GitHub and Stripe), and AWS may access data from other countries to support its services. We take reasonable steps to make sure they protect personal information consistently with the APPs. Xero processes your data under its own terms and privacy policy, which your organisation agreed with Xero.

6. How we protect it

• encryption in transit and at rest, using keys we control;
• meeting audio that hasn't finished uploading is held encrypted on your device. We hold the key, and it expires after 72 hours, after which that audio can't be read;
• two-factor sign-in for every user;
• each organisation's information kept separate, with access checked on every request;
• Xero credentials locked so that only an emergency access process can read them;
• continuous security monitoring and alerts;
• an audit trail of access that cannot be altered or deleted for one year;
• separate environments, with real data only in production.

7. How long we keep it

• Account details: while your account is active, then deleted or de-identified within 90 days of closure, unless we must keep them longer.
• Audit and security records: one year. They are locked and cannot be deleted during that time.
• Organisation data from Xero: read when needed to produce findings. Findings are held in memory to display them and are not kept as a permanent copy of your ledger. Connection credentials are deleted when the organisation disconnects.
• Meeting audio: deleted once it has been transcribed. Audio that hasn't uploaded from your device becomes unreadable after 72 hours. Any uploaded audio that hasn't been processed is deleted automatically after 4 days.
• Transcripts, meeting notes and recording-consent records: kept while your organisation's account is active, then deleted 90 days after the account is closed.
• Feedback: kept for 2 years to improve Preekie.

8. Access, correction and complaints

You can ask to see or correct the personal information we hold about you by emailing hello@preekie.com. We will respond within 30 days. If we refuse, we will tell you why.

If you took part in a meeting recorded by a Preekie user, you can make the same request to that user's organisation, or to us.

If you have a privacy complaint, email us at hello@preekie.com. We will respond within 30 days. If you're not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

9. Data breaches

If we become aware of a data breach that is likely to result in serious harm to you, we will tell you as soon as practicable, explain what happened and what you can do, and notify the Office of the Australian Information Commissioner where we consider it appropriate. We will also notify your organisation in line with its data agreement with us.

10. Cookies

The Preekie console uses a single cookie, which is needed to keep you signed in securely. It isn't used for tracking or advertising. Preekie currently loads no third-party scripts, fonts or analytics.

While you record a meeting, the Preekie console stores the encrypted audio in your browser's storage until it has uploaded.

11. Changes and contact

We may update this policy, and will tell you when we do. Contact us at hello@preekie.com, or CPAI Australia Pty Ltd, 119 Bushmans Way, South Morang, Victoria 3752.