Privacy Policy

At Practice Sprint (operated by Super Stack IT Pty Ltd, ABN 96 676 550 726), we are committed to protecting your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy covers both staff platform users and client portal users.

Last updated:

1. Information We Collect

We collect the following categories of personal information:

  • Account & profile information: name, email address, role, and profile image, received via OAuth authentication.
  • Authentication data: Google and Microsoft OAuth tokens. We do not store passwords.
  • Client & business data: entity names, ABNs, contact details, addresses, and engagement status entered by your firm.
  • Financial & billing data: time entries, billing rates, WIP reports, and invoice records.
  • Documents & files: uploaded documents up to 50 MB, categorised by type and financial year.
  • Communications data: portal messages, email templates, and communication logs.
  • Compliance data: ATO deadline tracking, workflow progress, and task completion records.
  • Usage & analytics data: via PostHog: page views, feature usage, and masked session recordings for staff users only. Direct names, email addresses, raw page URLs, and client portal routes are excluded from analytics tracking.
  • Error & diagnostic data: via Sentry: error reports may include user ID and tenant ID for debugging, with direct names, email addresses, URLs, and secrets scrubbed before capture.
  • Client portal data: portal user profiles, magic link tokens, document uploads, and message threads for your clients accessing the portal.
  • Demo & waitlist enquiries: when you request a demo or join the waitlist, we collect your name, firm, and email. We keep a record in our Practice Sprint PostgreSQL application database so we can respond to your request. A demo request is used to respond to that enquiry; waitlist sign-up includes your consent to receive Practice Sprint waitlist updates. Resend and self-hosted workflow automation may receive the minimum necessary details downstream to help deliver or process those communications.

Marketing enquiry privacy notice version: .

2. How We Use Your Information

We use the information we collect to:

  • Provide and operate the platform: job management, CRM, time tracking, and compliance
  • Process transactions and generate financial reports: WIP, utilisation, and billing
  • Operate the client portal: magic link authentication, document exchange, and messaging
  • Send communications: system notifications, timesheet reminders, compliance alerts, and bulk client communications via templates
  • Power AI features: Magic Import, task extraction, and upcoming AI tax compliance and bookkeeping agents (see Section 4)
  • Analytics and service improvement: PostHog analytics for staff platform only
  • Error monitoring and debugging: Sentry
  • Comply with legal obligations: ATO requirements and tax agent obligations

3. AI Features & PII-Safe Architecture

Practice Sprint uses artificial intelligence to enhance productivity. We have designed a privacy-first architecture for supported agent document workflows, where sensitive identifiers are tokenised before prompts reach external AI models. Basic assist features process the text users type directly, so they are labelled separately and should not receive TFNs, bank details, or other sensitive identifiers.

Our PII pipeline for supported agent document workflows:

  1. Step 1, PII Detection: Deterministic, rule-based code scans your supported agent document input to identify personal information including names, Tax File Numbers (TFNs), addresses, bank account details, dates of birth, and other identifiers.
  2. Step 2, Anonymisation: Detected identifiers are replaced with opaque tokens before model handoff. The mapping between real values and tokens is kept in the Australian-hosted PII vault.
  3. Step 3, Verification: Redaction confidence is checked before the agent run proceeds. Low-confidence scans are blocked for review rather than sent onward.
  4. Step 4, Cloud AI Processing: The external model receives the tokenised prompt for that supported workflow. After the response returns, tokens are mapped back inside the Practice Sprint environment for reviewer display.

What this means for you: For supported agent document workflows, sensitive identifiers are tokenised before external model handoff. In-app assist features such as Magic Import are different workflows and process the text users choose to enter.

AI output disclaimer: AI-generated content, suggestions, compliance workflows, and bookkeeping outputs are provided as productivity aids only. They do not constitute professional accounting, tax, or legal advice. All AI outputs should be reviewed by a qualified professional before being relied upon or submitted to any authority.

4. Automated Decision-Making

In accordance with the Privacy Act 2024 amendments, we disclose that Practice Sprint uses automated processing in the following ways:

  • AI-powered task extraction from unstructured text
  • Automated compliance deadline tracking and job creation
  • AI-suggested document categorisation
  • Automated timesheet reminders and lock rules

No automated decision has material legal or financial effect without human review and approval.

5. Third-Party Data Sharing

We share data with the following third parties only as necessary to operate the service:

  • Google / Microsoft: OAuth authentication only; we receive name, email, and profile image
  • PostHog: anonymised usage analytics for staff platform only; not used on the client portal; direct names, email addresses, and raw page URLs are not sent
  • Sentry: scrubbed error diagnostic data including user ID and tenant ID for debugging
  • Supabase: real-time data synchronisation infrastructure
  • AI model providers: tokenised prompts for supported agent document workflows; user-entered text for basic assist features
  • Email delivery providers (Resend / SendGrid): for portal invitations, timesheet reminders, client communications, and delivering demo and waitlist communications. Only consented waitlist contacts may enter the marketing audience.

We do not sell your personal information. We do not use your data to train AI models.

6. Data Security

We implement the following technical and organisational measures to protect your data:

  • AES-256-GCM encryption for sensitive credentials and OAuth tokens
  • Row-level tenant isolation: multi-tenant architecture ensures your data is completely separated from other organisations
  • Supabase-managed browser authentication with server-side identity validation
  • Rate limiting on authentication endpoints
  • Role-based access control: admin, editor, and reader permissions per board
  • HMAC-SHA256 webhook signature validation

7. Data Storage & Retention

  • Data is stored in PostgreSQL with tenant-level isolation
  • Documents are stored in S3-compatible storage, encrypted at rest
  • Soft-deleted data is retained for 30 days before permanent deletion, allowing administrators to recover it
  • Time entry audit trails are retained for 7 years to meet Australian tax record requirements
  • Supabase authentication credentials, browser sessions, and sign-in links expire or refresh according to the active Supabase Auth provider configuration
  • A firm may independently revoke an individual client portal access grant. Grant revocation blocks that client context but does not by itself end the shared Supabase session, another portal grant, or staff access for a dual-role user

8. Cross-Border Data Transfers (APP 8)

Cloud infrastructure may process data in regions outside Australia. In particular:

  • AI model providers may be based in the United States

We ensure all cross-border transfers are protected by contractual obligations consistent with the APPs and that overseas recipients are bound by privacy protections substantially similar to the APPs.

9. Notifiable Data Breaches

In the event of an eligible data breach under Part IIIC of the Privacy Act 1988, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

10. Your Rights

Under the Australian Privacy Principles, you have the right to:

  • Access your personal information (APP 12)
  • Request correction of inaccurate information (APP 13)
  • Request deletion of your account and associated data
  • Withdraw consent for optional data processing
  • Export your data in a portable format
  • Opt out of analytics tracking (PostHog)
  • Lodge a complaint with the OAIC if unsatisfied with our response to a privacy concern

To exercise any of these rights, contact us at hello@practicesprint.com.

11. Cookies & Tracking Technologies

We use the following cookies and tracking technologies:

  • sb-*: Browser-managed Supabase authentication session for staff and client portal access. Storage and cookie attributes follow the active Supabase client and deployment configuration.
  • PostHog cookies: Analytics and session recording (staff platform only; not set on the client portal)

You can disable non-essential cookies through your browser settings. Disabling authentication cookies will prevent you from using the platform.

12. Children's Privacy

Practice Sprint is a business-to-business platform designed for professional services firms. We do not knowingly collect personal information from individuals under 18 years of age.

13. Changes to This Policy

We will notify registered users via email or in-app notification at least 30 days before material changes to this policy take effect.

14. Contact & Complaints

For privacy enquiries or complaints, contact us at hello@practicesprint.com.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC):
www.oaic.gov.au, 1300 363 992

By using Practice Sprint, you agree to the collection and use of information in accordance with this Privacy Policy.