Privacy policy

Last updated 8 October 2026

TradeSync is operated by Ian Samonte (“we”). It helps trade businesses check supplier invoices against purchase orders, keep product prices current, work out landed costs, chase overdue invoices and match bank lines. This policy explains what information TradeSync handles, why, and the choices you have.

What we collect

• Your account: the name and email address you sign up with, your company name, and who in your company has access and in what role.
• From your Xero organisation, once you connect it: purchase orders, products and their costs, supplier and customer contacts, bills, and unpaid customer invoices with their payment history.
• From your accounts mailbox, once you connect it with Google: emails that have a PDF attached and emails from the freight senders you list, including their sender, subject and attachments, and a record of the reminders sent from it.
• Files you upload, such as bank statement CSVs and test invoices.
• What you do in TradeSync, such as approvals and settings changes, recorded with your email so your team can see who did what.

How we use it

Only to provide TradeSync to your company:

• reading supplier invoices and comparing them with your purchase orders;
• keeping supplier price lists and, when you approve, product costs in Xero up to date;
• linking freight to orders and calculating landed costs;
• drafting payment reminders and, when you approve them, sending them from your own mailbox;
• suggesting which invoices your bank lines pay.

We don't sell your information, use it for advertising, or use it to train or improve AI models. Each company's information is only shown to that company's members.

Google user data (Gmail)

When you connect your mailbox, TradeSync asks Google for two Gmail permissions. Read: it searches for new emails with a PDF attached or from your listed freight senders, reads those emails and their attachments, and turns supplier invoices into structured data (supplier, invoice number, line items, totals); other emails are not opened. Send: it sends the payment reminders someone in your company approves (or has set to send automatically), from your own address, to the customer's email in Xero. It never deletes, moves or labels email.

TradeSync's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Gmail data is used only to provide the invoice and freight features you can see in TradeSync; it is not used for advertising, not sold, not used to train AI models, and not read by people except with your permission, for security reasons, to comply with the law, or where it has been aggregated and anonymised for running the service.

You can disconnect the mailbox at any time in TradeSync (Connections → Accounts inbox → Disconnect) or in your Google account at myaccount.google.com/permissions.

Xero data

TradeSync connects to Xero through Xero's own sign-in, with access you approve. It only writes to Xero when someone in your company approves a change (for example a new product cost). You can disconnect in TradeSync or revoke access in Xero at any time.

AI processing

Invoice PDFs, and reminder drafts you choose to have rewritten, are sent to Anthropic's Claude API to be read or reworded. Anthropic processes them to return a result and, under its commercial terms, does not use them to train its models. Every decision about an invoice (price changes, duplicates, missing items) is made by TradeSync's own rules, not by AI.

Where it's stored and who else handles it

• Supabase stores account and company data. Connection tokens for Xero and Google, and any AI key you add, are encrypted before they are stored.
• Vercel hosts the application.
• Anthropic reads invoice PDFs, as described above.
• Google and Xero provide the data you connect.

These providers may process data outside Australia. They only handle it to provide their part of the service.

How long we keep it

We keep your company's information while your account is active. If you disconnect Xero or Google, we stop collecting from it straight away and delete the stored connection. If you ask us to close your account, we delete your company's information within 30 days, except where the law requires us to keep it.

Security

Each person signs in with their own account. Database rules stop one company seeing another's data, connection tokens are encrypted, and everything travels over HTTPS. No system is perfectly secure; if we become aware of a breach affecting your information we will tell you promptly.

Your choices

You can see and change your company's settings, disconnect Xero or your mailbox, remove team members, and ask us for a copy of your information or for it to be corrected or deleted. Contact us at hello@iansamonte.com.

Changes

If we change this policy in a way that matters, we'll tell account owners by email before it takes effect.

Contact

Questions or requests: hello@iansamonte.com.