Privacy Policy

Last updated: 21 August 2026

At a glance: Voder connects to your Xero with read-only access so your AI assistant can answer your questions. We can’t change anything in Xero, we don’t store your financial figures, and we don’t sell your data. Questions? Email privacy@voder.ai.

What we collect

• Your email address, so we can sign you in.
• Basic account information: the organisations you can access and the grants that link you to them.
• A single-use sign-in code (and the equivalent sign-in link) we email you when you log in. We store only a hashed copy of the code, never the code itself.
• An encrypted Xero connection token, so Voder can read your Xero data on your behalf.
• The tool calls your AI assistant makes on your behalf: the tool name and its parameters (for example a date range or an organisation), which we use to fetch the answer from Xero in real time. We don’t receive your chat with the assistant, and we don’t store the parameter values.
• Any feedback notes you or your AI assistant choose to send us.
• If you subscribe, limited billing records from Stripe: checkout, customer, subscription and payment references; amount and currency; payment or subscription status; and the date your paid access runs through. We also record whether a required trial, transition, billing or cancellation notice was sent. Stripe collects your payment and billing details in its hosted checkout. Voder does not receive or store your full card number.
• Technical logs about the shape of each request: which tool ran, the names of its parameters and how long they were, whether it succeeded, and how long it took. These never contain the parameter values or your financial figures.

What the tools do

When you connect Voder to an AI assistant such as Claude or ChatGPT, the assistant can call more than 20 read-only tools on your behalf. Each tool takes a question (and parameters like a date range or an organisation) as its input, reads the matching data from Xero, and returns the answer to your assistant. The tools cover:

• Profit and loss over time (by month, quarter, or year), revenue trends, and an executive overview of the business at a glance.
• Expenses by category and supplier, invoices, bills, credit notes, payments, aged receivables and payables, and bank transactions.
• Contacts, accounts, the trial balance, GST status, and your organisation’s details.
• Recording and reviewing feedback you choose to send us about Voder.

Every tool is read-only. Voder cannot create, edit, or delete anything in your Xero account.

What we don’t keep

We don’t store your Xero financial data. Invoices, balances, and transactions are fetched from Xero in real time to answer a question, then discarded once the answer is returned to your assistant. We never see or store your Xero password. You sign in to Xero directly.

How we use it

• To sign you in and keep your session secure.
• To connect your AI assistant to your Xero data, with your consent.
• To answer the questions your assistant asks, by reading from Xero in real time.
• To start and manage a subscription, confirm paid access, prevent duplicate charges, and handle cancellation or billing support.
• To act on the feedback you send and to keep Voder working, secure, and improving.

We don’t use your data to train AI models, and we don’t use it for advertising.

Who we share it with

We rely on a small set of service providers to run Voder:

• Google Cloud: Voder’s primary database and encryption key are in Australia, and its production application service runs in Singapore.
• Resend: sends your sign-in emails.
• Xero: the source of your accounting data, accessed with your consent.
• Stripe: hosts subscription checkout and processes payments, billing details, tax information, and fraud-prevention signals. Stripe may process personal information in Australia and overseas under Stripe’s privacy policy.
• Your AI assistant (such as Claude or ChatGPT): when you ask a question, the answer is returned to the assistant you connected. Your assistant’s provider handles that answer under its own privacy policy.

We do not sell your data or share it for advertising.

How long we keep it

• Sign-in codes: the hashed code is single-use and deleted automatically 15 minutes after it is issued.
• Your session: your signed-in session expires after 7 days, after which you sign in again.
• Xero connection token: kept encrypted while the connection is available. It is removed when you disconnect Xero, delete your account, or paid access ends and Xero confirms that Voder’s connection has been removed. If Xero cannot confirm removal, Voder blocks access and keeps the encrypted token only for a limited retry period.
• Email and account records: kept while your account is active, and deleted when you ask us to delete your account.
• Feedback notes: kept so we can act on them and improve Voder, and deleted on request.
• Billing and notice records: limited subscription, payment-status, deadline, cancellation, and notice records are kept while your account is active and as needed for tax, accounting, fraud, dispute, and legal obligations. They do not include your full card number.
• Technical logs: kept for a limited period (up to 30 days) for security and reliability, then automatically deleted.
• Xero financial data: not retained. It is fetched in real time to answer a question, then discarded.

When paid access ends

Ending paid access is not an account-deletion request. Voder stops reading the organisation’s Xero data and removes the Xero connection and encrypted token as described above. The Voder account, organisation details, access grants and members, invitations, feedback, entitlement, and limited billing and notice records remain. You can still ask us to delete your account under the choices below.

How we protect it

Sign-in is passwordless: you receive a single-use code (and an equivalent link) by email, so there’s no password to steal. Sign-in codes are hashed at rest, single-use, time-limited, and attempt-capped. Connection tokens are encrypted. Our server logs record only the shape of requests (which tool ran and how long it took), never your financial values.

Your choices

• Disconnect Xero at any time. After Xero confirms the connection is gone, Voder removes the stored connection token.
• If you subscribe, cancel before the next billing date. Access continues through the current trial, transition, or paid period, then Voder automatically removes its Xero connection. Cancellation is separate from deleting your Voder account.
• Ask us for a copy of the account information we hold about you, or ask us to correct it.
• Ask us to delete your account and the deletable data associated with it. We may keep limited billing, notice, tax, fraud, dispute, and legal records when required or needed for those purposes.

To make any of these requests, email privacy@voder.ai.

Changes to this policy

If we change how we handle your data, we’ll update this page and the date above.

Contact

Voder is operated by Windy Road in Australia. Privacy questions: privacy@voder.ai.