PLAIN ACCOUNTS LEGAL CENTRE
Privacy notice
Plain Accounts explains what personal information HOSTAL PTY LTD collects, why it is used, when it is shared and how people can exercise available rights.
1. Who this notice covers
HOSTAL PTY LTD (ABN 58 693 993 501), trading as Plain Accounts, is responsible for account, website, trial, subscription and support information. A customer business controls personal information it enters about customers, suppliers and workers; Plain processes that workspace information on the customer’s instructions.
2. Information and purposes
We process account identity, workspace membership, business and financial records, employee and payroll records, provider identifiers, security events, preferences and support communications to provide and secure the service, administer subscriptions, meet legal duties, investigate incidents and improve reliability.
3. Sharing and transfers
Information is disclosed only to authorised workspace users, contracted service providers, customer-selected connections, professional advisers, regulators where required, or a controlled business successor. The primary service is hosted in Sydney, Australia. Appropriate contractual and organisational safeguards are used where cross-border access occurs.
4. Retention and security
Information is kept only as long as needed for the service, legal record obligations, disputes and security evidence. Access controls, encryption, logging, monitoring and backup controls reduce risk, although no service can guarantee absolute security.
5. Payment records
When a subscription or a customer’s invoice is paid through Stripe, Stripe sends us a signed record of each payment event, such as a payment, refund, dispute or payout. These records can include the payer’s name, email address and billing address, the card brand and last four digits (never the full card number or security code), and the amount and date. We keep each complete record, encrypted and stored in Australia, for five years from when we receive it, then delete it automatically. Five years is the period Australian tax law requires HOSTAL PTY LTD to keep transaction records, and the records may also be needed to resolve refunds, chargebacks and disputes. Where the GDPR or UK GDPR applies, we rely on our legal obligations and our legitimate interest in being able to evidence payments and defend legal claims. Stripe handles full card details under its own privacy policy. Businesses that use Plain to get paid must keep their own business records for the period their local law requires, which in some countries is longer than five years. They can export their invoices and payment history from Plain at any time.
6. Your rights
Depending on location, people may request access, correction, deletion, restriction, objection or portability and may withdraw consent. If the information is held in a customer workspace, contact that business first; Plain assists it as processor. Complaints may also be made to the relevant privacy regulator.
7. Trial and sign-up emails
During a free trial we send a few emails about getting started, to the workspace owner’s verified address. If you tick “Email me about my sign-up” and don’t finish signing up, we keep that email address for up to 30 days to send one reminder, then delete it; only a one-way fingerprint of the address stays, so the reminder is never sent twice. Every one of these emails has a link to stop them. Account and security emails, such as password resets, still arrive.
8. Contact and changes
Questions and rights requests may be sent to privacy@plainaccounts.com. Material changes will be dated and communicated where appropriate.
9. Jurisdiction and local rights
These documents are governed by the law stated in the Terms of service, subject to mandatory privacy, consumer and data-protection rights in the customer’s country. Customers operating outside Australia should obtain advice about obligations specific to their activity and location.