Last Updated: 3 October 2026
This policy is a draft prepared for legal review. It has not been reviewed by a qualified Australian legal practitioner.
Surplu (“we”, “us”, “our”) provides business software that helps trade and service businesses understand the profitability of their jobs. This policy explains what information we handle, where it comes from, why we handle it, and who else may be involved.
Where applicable, we handle personal information in accordance with applicable Australian privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Account and contact information — name, email address and any contact details you provide, and the organisation you belong to.
Business and organisation information — business name, GST registration status, currency and tax settings, and business preferences.
Project and job information — job names, clients, client phone numbers and site addresses, budgets, dates and status.
Financial information — transactions, amounts, GST treatment, suppliers and payees, categories, bank account records, invoices, quotes, payments, budgets and overhead settings.
Employee and labour information — employee names, roles, pay rates, employment type, superannuation settings, hours worked, timesheets, time entries and how labour is allocated to jobs.
Imported and connected data — information you upload (such as CSV files) and information received from services you connect, such as Xero.
Decision and activity records — records of how transactions were allocated to jobs, which we retain to improve future suggestions.
Technical and usage information — standard technical information generated when software is used, such as log records, page views within the application and information about the device or network used to connect. Some of this is generated by the platform we build on rather than by us directly.
Support communications — messages you send us through Help & Support, and our responses.
About passwords: authentication is handled by our platform provider. When you sign in or register, your credentials are processed by that provider’s authentication system. Surplu does not store your password. We do not store, and do not have access to, your bank login details.
If you are an employee of a business that uses Surplu, information about you may have been provided by your employer rather than by you.
We use third parties to run the Service. They receive only what they need for their role. These fall into the following categories:
Because these providers necessarily process data on our behalf, we do not claim that your information is never shared. We may also disclose information where required by law, to enforce our terms, or to protect the rights or safety of any person.
We do not sell your personal information.
Our public website — the pages you can read without signing in — uses a small piece of code from Meta Platforms, Inc., the company behind Facebook and Instagram. It is called the Meta Pixel. It is there so we can tell which of our advertising brings people to us.
What it collects. Your browser tells Meta which of our public pages you looked at, the page you came from, your IP address, general information about your browser and device, and an identifier stored on your device. It also tells Meta when you finish signing up for a Surplu account, and when you sign up to our waitlist. Those two messages carry the same information as a page visit, plus the fact that the sign-up happened, and nothing more: no name, no email address and no business data. They follow the same rule as page visits, so if you choose “No thanks” (see below) they are not sent. If you are signed in to Facebook or Instagram on the same device, Meta can connect that visit or sign-up to your account there. We do not send Meta your name, your email address, or anything you type into a form on our site.
Where it does not run. The pixel runs on seven public pages only: our home page, Features, Pricing, How it works, FAQ, Contact and the welcome page you see for a moment after you create an account, before the application opens. It does not run inside the Surplu application. Nothing about your jobs, transactions, clients, invoices, employees or payroll is sent to Meta, and no page inside the application is reported to Meta. It does not run on our log in, sign up, terms, privacy or guide pages either.
How to turn it off. The pixel runs on those public pages unless you tell us not to. The first time you visit we show a notice explaining it; choosing “No thanks” there stops it, and nothing further is sent to Meta. You can change your mind at any time using the Cookie settings link at the bottom of any public page.
Meta is overseas. Meta stores and processes this information in the United States and other countries. Meta is not bound by the Australian Privacy Act, and if something goes wrong with information Meta holds, you may not be able to seek redress under Australian law or through the Office of the Australian Information Commissioner. Meta’s own privacy policy governs what it does with the information.
Other ways to control it. You can manage how Meta uses information about you in your Facebook or Instagram ad settings. You can also use optout.aboutads.info and youronlinechoices.com.au.
Other cookies and analytics. Separately from advertising, the Surplu application uses cookies and similar storage to keep you signed in and to remember your preferences, and the platform we build on generates its own usage and analytics records as described in section 2. These are necessary to run and maintain the Service, are not used for advertising, and are not shared with Meta.
Draft note for legal review: this section describes a Meta Pixel operating on notice and opt-out rather than prior opt-in, on the basis that the advertising is targeted at Australia only and Australia has no ePrivacy-style prior consent requirement. Whether that is the correct basis, and whether the overseas disclosure to Meta engages the consent exception in Australian Privacy Principle 8, should be confirmed by a qualified Australian legal practitioner.
Some of the providers described above may store or process information outside Australia. Where that happens, we take reasonable steps to use reputable providers, but their processing is governed by their own terms and by the laws of the places they operate in.
Draft note for legal review: the specific countries in which our hosting and platform providers store data should be confirmed with those providers and stated here, as Australian Privacy Principle 8 may require.
We take reasonable steps to protect information. In practical terms, the Service uses:
No internet-connected system can be guaranteed to be completely secure. We cannot promise absolute security, and you share information with us on that understanding. If we become aware of a data breach that is likely to result in serious harm, we will respond in accordance with our obligations under applicable law.
We keep information for as long as it is needed to provide the Service to your organisation, and after that for as long as we have a legitimate reason to.
How long that is depends on:
The application includes a facility to delete an account and associated organisation records. The extent of that deletion depends on the functionality available at the time and does not remove data from backups immediately. We do not promise instant or complete erasure.
Most information about your business can be viewed and corrected directly in the application. Transaction data can be exported to CSV from the Transactions screen.
You may also ask us to give you access to personal information we hold about you, correct it if it is inaccurate, or delete it where we are able to. Make these requests through the Help & Support section of the application.
We may need to verify your identity before acting on a request. There are situations where we may not be able to fully comply — for example where we are required to keep the information, or where it relates to another person or to a business customer’s records rather than to you. If we refuse, we will explain why.
If you are an employee whose information was provided by your employer, we may need to direct your request to that employer, since they control that data.
If you think we have mishandled your personal information, contact us first through the Help & Support section of the application. Tell us what happened and what outcome you are seeking.
We will investigate and respond to you. If you are not satisfied with our response, you may be able to raise the matter with the Office of the Australian Information Commissioner (OAIC).
You may choose to connect Surplu to Xero. If you do:
Xero is a separate service operated by a third party. Your use of Xero is governed by Xero’s own terms and privacy policy in addition to this one.
Business customers may enter or import personal information about other people, most commonly employees — names, pay rates, hours worked, timesheets and job allocations.
Where you do this, you are responsible for ensuring you are entitled to provide that information and to have it processed through Surplu, including telling those people how their information is handled where you are required to. We handle that information on your instructions as part of providing the Service.
We may update this policy. The “Last Updated” date above shows when it last changed. Where a change is significant, we will make reasonable efforts to bring it to your attention.
For any privacy question or request, contact us through the Help & Support section of the application.