Privacy Policy

Last updated 20 October 2026

1. Who we are

YellowBAS (yellowbas.com.au) is operated by MMVP Pty Ltd trading as YellowBAS (ABN 29 629 141 055), New South Wales, Australia ("we", "us"). This policy explains what information YellowBAS handles, where it goes, and the choices you have. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth) as our standard of practice.

2. What stays on your device

YellowBAS is software that runs in your web browser. When you add bank statements, receipts, invoices or an accountant's template, your browser reads them, and all categorising, matching and GST calculations happen on your device (computer, tablet or phone). The draft PDF and Excel files are also created on your computer.

So that you can continue later, the browser keeps your work in its own storage on your device (browser "local storage" and "IndexedDB"): your drafts and the files in them, the rules and choices you set, and your settings. This information is on your device, not on our servers. We have no copy of it and cannot recover it for you. You can delete it at any time from the app (My drafts) or by clearing this site's data in your browser settings. Anyone with access to your device and browser profile may be able to see it, so use a device you control.

3. Information we handle

3.1 Website analytics (Google Analytics 4)

On yellowbas.com.au we use Google Analytics 4, a service of Google LLC, to understand how the site is used so we can improve it. When the page loads, Google Analytics may collect: the pages you view and when, how you reached the site, your device type, browser and operating system, screen size, approximate location (city or region, derived from your IP address), and a random identifier stored in a cookie. We do not send Google the contents of your documents, file names, amounts, BAS figures or your business details. Google Analytics does not run on the staging site or when you use YellowBAS on your own computer.

When you first add your own files, the site also tells us, so we know someone is using YellowBAS: how many files of each kind (PDF, CSV, photo, Excel), the ad or link tags in the address you arrived by and the site you came from, your time zone (which tells us your state, not your address), language, device type and browser. It does not include file names, contents, amounts or your IP address, and it reaches us as one email per visit, which we do not store anywhere else. While you stay on the page, it records which steps you open and which buttons you press (their names only, never the text or amounts of your lines), how long you stayed and how many lines were read, how each document read (its type, bank name, number of lines, whether its balances add up, which receipt fields could not be read) and which kinds of fields or categories you corrected (never the values), and adds this to that email, which is sent once you leave.

To see which pages help people, we also count steps per day for each landing page and ad tag: opened the page, opened the sample, saw the sample's BAS, added their own statement, downloaded their own report, asked for a reminder. These are totals only: no names, emails, files, figures or addresses. Test visits are not counted.

Our ad landing pages (start, try and checklist) send us the same kind of note for every visit, even if you add no files. Our home page sends one only when you arrive from an ad or a tagged link, or do something there besides opening My BAS (such as pressing a button or opening a question). The note holds: the ad or link tags you arrived by, your time zone, language, device type and browser, which buttons and links you press, which questions you open, which checklist items you tick, how far down the page you scroll and how long you stay. If you then add files in YellowBAS, this becomes part of that visit's email. To tell us your approximate town or city, our server looks up your IP address with an IP-location service when the note is made; the IP address itself is not put in the email or stored by us. No file names, contents or amounts are sent. We also keep a copy of each note in our database for 90 days, without the town, so we can see over time which pages and ads work; it holds no email address, IP address or name, then it is deleted.

We also use the Meta Pixel, a service of Meta Platforms, to measure our ads on Facebook and Instagram: when a page loads, Meta may receive the page address, your browser and device details and your IP address, and may link this to your Meta account if you have one. When you add your own files, Meta is also told that this happened (one "Lead" event per visit), so we can see which ads bring people who try YellowBAS; it is not told what the files are, how many, or anything in them. It never receives your documents, bank lines or figures. You can control ads that use this information in your Facebook or Instagram ad settings.

Google processes this information as our service provider and may store and process it in the United States and other countries. You can learn more at How Google uses information from sites that use its services, and you can stop Google Analytics from collecting data about you with the Google Analytics opt-out browser add-on or by blocking cookies for this site.

3.2 Sending photos from your phone, and moving a draft to another device

If you choose "Show QR code for my phone", your computer or tablet shows a QR code containing a one-time link. The link includes a secret key after the "#" sign; browsers do not send that part of a link to any server, so we never receive the key. Your phone encrypts each photo or file with that key (AES-GCM, 256-bit) before uploading it. Our server stores only the encrypted file until your computer or tablet downloads it, then deletes it. Files that are not collected are deleted automatically within about an hour, and a QR code stops working after 12 hours. Because we do not have the key, we cannot read these files.

"Continue on another device" works the same way. Your device packs the open draft (its statements, receipts, answers and settings) and encrypts it (AES-GCM, 256-bit, a new key each time) before uploading it. The key is only in the link after the "#" sign, so we never receive it. Until the other device opens the link, our server stores only the encrypted draft, in parts of up to 7 MB. Each part is deleted as soon as the other device downloads it. The link works for 15 minutes; anything not collected is deleted automatically about 15 minutes after it was sent, and "Cancel link" on the sending device deletes it at once. These files are not included in our backups. We cannot read the draft, but anyone who has the link can, so keep it private.

3.3 Technical information

Like any website, our server necessarily receives your IP address, the time and the address of the page or file requested, and your browser's user-agent, in order to deliver the site. We use this only to operate and secure the service. We do not currently keep access logs for yellowbas.com.au; error and system logs on the server may contain this information and are kept for a limited period. Our server is run by a hosting provider in Australia.

3.4 Your account (sign-in by email)

To download Excel or PDF reports on the website you sign in with your email address. There is no password: we email you a one-time link that works for 15 minutes. You can use everything else without signing in. On our server we keep:

• your email address and when the account was created;
• your plan, and when your free trial or paid period ends;
• for each quarter, a scrambled identifier for each business you downloaded a report for. Your browser makes it from your account number and the business's ABN (or a random id when there is no ABN) with a one-way function, and our server scrambles it again with a secret key. We never receive the ABN or the business name, and the identifier cannot be turned back into them. We use it only to count businesses for your plan;
• when you type an ABN while signed in, our server passes that ABN (public information) to the Australian Business Register's ABN Lookup to show you the registered business name and GST status. We do not keep the ABN or the answer.
• when a receipt's ABN does not read clearly and you are signed in, our server sends the shop's name and postcode as printed on the receipt (public information, never amounts, dates or your details) to ABN Lookup to find that shop's ABN. We do not keep the name or the answer.
• scrambled (hashed) copies of your sign-in links and session, and for each sign-in link a shortened scrambled form of the IP address it was requested from, to limit abuse (at most 5 links per email and 20 per address per hour).
• if you add a passkey (Face ID, Touch ID or Windows Hello), its public key and id, so you can sign in without an email link. The private key never leaves your device.

When someone signs in, we may receive a short email note with their email address and the time, so we know who is using the beta.

Sign-in emails are sent by our email service provider, which receives your email address and the link. After you sign in, the app keeps a signed licence (your account id, email and plan) in your browser so that it works offline.

You can delete your account at any time: click your email at the top of the page, then Delete account. This removes your email address, plan, sessions and business counts from our server at once; copies in our server backups are overwritten within 14 days. Your drafts and settings in your browser are not affected.

3.5 Contact form

If you use the contact form, we receive what you type: your first name, email address, message and, if you give them, your last name and business name, together with any pictures or files you attach (up to 5 files, 8 MB in total). Our server passes this on as one email to our team and does not keep a copy. The email is delivered by our email service provider to our team’s mailbox. We keep these emails as long as we need them to answer you and improve YellowBAS, and you can ask us to delete them. To limit abuse, our server counts messages per IP address in memory for an hour; it does not store them.

Please do not attach documents with other people's personal information, account numbers or addresses. If a document did not read correctly, a sample with the personal details blacked out is all we need.

3.6 Help improve recognition (anonymous counts and shop names)

Under the download button there is a box "Help improve recognition". It is ticked by default; you can untick it at any time and the choice is remembered in this browser. When it is ticked and you download an Excel report, your browser sends us a short table of counts: for each bank and each way a line was sorted (for example "recognised from the shop name" or "asked"), how many lines there were, how many YellowBAS asked about, and how many you kept in the column it suggested or moved to another one. It also sends a random id made in your browser for that business and quarter, so a second download replaces the first.

When you have moved a purchase to another column yourself, it also sends that shop's short name (letters only, at most 12, for example "OFFICEWORKS") with the column you chose and whether it has GST, plus a random id of your browser so each browser counts once per shop. Transfers, payments to people, cash withdrawals and lines your bank already sorted are never sent. A shop goes into the shared list that helps every user only after at least 5 different browsers put it in the same column.

With the same box ticked, each time a statement or receipt is read your browser also sends whether it read: the kind of file (for example PDF, CSV or photo), the bank name when it was recognised (for example "CommBank"), the result (for example "read", "a scan with no text", "no table found", "hard to read") and how many lines were found. No file, file name, text, amount, date or id of any kind is sent, and the counts are added up per day.

None of this contains amounts, dates, full descriptions, account numbers, ABNs, your email or your account. We use it only to measure and improve how well YellowBAS reads and sorts statements and receipts.

3.7 Sort with AI (only if you choose it)

On the Review step you can press "Sort with AI" (or tick "Always use AI for new shops") to get a suggested category for shops YellowBAS does not know yet. This needs you to be signed in. For each such shop your browser sends us only the shop name as your bank prints it, with numbers taken out (for example "BP CAULFIELD"), and the list of categories. It never sends amounts, dates, account numbers, other lines or your files.

If you use an accountant's template with sections (for example "Car expenses", "Telephone / Internet"), YellowBAS can also ask AI where things go in it: which section fits each kind of expense, and, when you press "Suggest with AI" on the Review step, which section fits each shop that has no section yet. This also needs you to be signed in. Your browser sends only the template's section titles and the kind-of-expense names or shop names (as described above). It never sends amounts, dates, the template's other contents, account numbers or your files. The suggestions are shown to you to check; your own choice always wins and is kept in your browser and in the report you download.

Our server passes these names to an AI model through a third-party AI service, with data collection by the model provider turned off and zero data retention. The suggested category comes back to your browser. We do not log or keep the names or the answers; we only count how many lines your account sent this month, to apply the monthly limit. The answers are kept in your browser so the same shop is not asked again. A suggestion is marked "AI" and is only used for your BAS after you check and apply it.

Fix with AI on a receipt. When a receipt photo did not read well, you can press "Fix with AI" on it (signed in). Your browser then sends the text it already read from that receipt, after taking out card, account and reference numbers, phone numbers, emails and lines that name a person (such as "Served by" or a loyalty card). The photo itself is never sent. The same model, rules and monthly limit apply, and one receipt counts as one. The answer (shop, date, total, GST, ABN) is only used if those numbers appear in the text, is marked "Filled by AI", and counts only after you confirm the receipt.

3.8 Sync my settings (only if you turn it on)

If you are signed in, you can turn on "Sync my settings (encrypted)" in the Business box. It is off until you turn it on. Your browser then encrypts your settings (rules, learned columns, accountant template, GST choices, business names and ABNs) with a key made on your device, before anything is sent. We store only the encrypted copy, the date it was saved and a version number. Amounts, statements, receipts and drafts are never synced.

The key is kept on your devices. We store it only locked by your recovery key (shown to you once) or by your passkey, and we never receive either of them. This means we cannot read your synced settings, and if you lose both your recovery key and your passkey we cannot open them for you. Turning sync off, or deleting your account, deletes the encrypted copy from our server at once. It is included in our daily database backup for up to 14 days, still encrypted.

3.9 Other copies of the site

A copy of YellowBAS may also be made available on an address run by another hosting provider. If you use that copy, that provider hosts the site and, if you use the QR code there, stores the encrypted phone files (which it cannot read) until your computer or tablet downloads them, and may process technical information such as IP addresses.

4. How we use and disclose information

We use the information above only to provide, secure and improve YellowBAS. We use what you send through the contact form only to answer you and improve YellowBAS. We disclose information only to our service providers (for analytics, hosting and sending email), who act on our behalf, or where the law requires it. We do not sell, rent or trade personal information, and we do not use it to send you marketing.

5. Overseas disclosure

Some of our service providers (for website analytics and for sending and receiving email) may store and process information in the United States and other countries. This covers analytics information, the email address and link of a sign-in email, and anything you send through the contact form. If you use Sort with AI or AI for an accountant's template, the shop names and section titles described in 3.7 are processed by our AI service providers, which may be in the United States. For the visit notes described in 3.1, your IP address is sent to our IP-location service, which may be in the United States, only to look up your approximate town or city. Your statements, receipts and BAS figures are not disclosed overseas and are not stored by us, because they are not sent to us at all. The only exception is photos you send from your phone by QR code: they pass through our server in Australia encrypted, so we cannot read them, and are deleted as soon as your computer or tablet picks them up.

6. Cookies and browser storage

Blocking cookies will not stop YellowBAS from working. Clearing this site's data in your browser deletes your saved drafts, so save a draft file first if you want to keep it.

7. Automated decisions

YellowBAS suggests categories and GST treatments for your transactions. These suggestions are calculated on your device, you can change every one of them, and we do not see the results. We do not make any decision about you, and we do not use personal information to make automated decisions that affect you.

8. Security and retention

The site is served only over HTTPS. Phone transfers are encrypted end to end and deleted after delivery, as described above. We keep technical information only as long as needed to operate and secure the service. Account information is kept until you delete your account; sign-in links are removed a day after they expire, sessions when they end, and server backups are kept for 14 days. No method of transmission or storage is completely secure, and you are responsible for the security of your own device and the files you export.

9. Access, correction and complaints

Because your documents and figures stay on your device, the only personal information we hold about you is your account information (section 3.4), if you signed in, and any messages you sent us through the contact form (section 3.5). You can ask what information we hold about you, ask us to correct it, or make a complaint about how we have handled your information. We will respond within 30 days.

Contact: write to us through the contact form (choose “A question or something else”). YellowBAS, MMVP Pty Ltd, ABN 29 629 141 055, Sydney, Australia.

10. Changes to this policy

We may update this policy as YellowBAS changes, for example if we add payments or new services. We will publish the new version on this page with a new date, and point out material changes on the site before they take effect.