Privacy
Privacy policy
Who we are
TrueK is operated by Daniel McGrath, ABN 40 217 739 279. You can reach us about privacy at hello@truek.com.au.
What we collect and why
We collect your Square sales and your Xero supplier bills so we can work out the gross profit on each menu item. We collect your name, phone, email, and business name to set up and secure your account, and to send you your daily email and your weekly Keep; your business address and ABN are collected only if you give them, for invoicing. If your cafe uses Square Shifts or Xero Payroll, we also read your wages, so that prime cost does not rest on a figure typed by hand: from each Square timecard we read the start and finish times, unpaid breaks and hourly rate, and store the hours and wage dollars for that shift on that day; from each posted Xero pay run we read and store its dates, total wages and total super. We do not store who worked a shift: no staff name, no staff ID and no contact details. We also hold business figures you enter yourself, such as a weekly wage total you type in.
What we never access
We never access your customers' details or your Square or Xero passwords. Wages are kept as hours and dollars only: we never store a staff member's name, staff ID, contact details or other personal information, and we never read their names or contact details at all.
Where your data lives
Your data is stored and processed in Australia. Any AI processing happens in the Sydney region. All customer business data (sales, bills, recipes, and account information) is stored and processed in Australian data centre regions (Supabase and Amazon Web Services, Sydney). The one exception is email delivery: the emails we send you are delivered via Resend, whose infrastructure is located overseas, so the content of those emails transits overseas systems. Nothing about your business is shared with other cafes, or sold.
Sub-processors
Our service providers are: Supabase (database, Sydney), Amazon Web Services including AWS Bedrock (hosting and AI processing, Sydney), Vercel (application hosting, and page-view analytics with no cookies), Resend (transactional email delivery), Cloudflare (a bot check on the sign-in and join pages), and Stripe (payments, which never sees your sales or bills). Your business data is stored and processed in Australia. Email delivery via Resend involves infrastructure located overseas, meaning the content of emails we send you transits overseas systems. Each is bound to use your data only to provide their service to us.
What the AI sees
The sentences the AI writes are built from figures and item names. Your cafe name, your name, your email, and your address are not in what it is given for that, and a check on the analysis blocks a request if identity slips in. Reading a picture is different: an invoice you upload, or a photo of a shelf you take while counting stock, is sent to the AI as the image itself, so whatever is printed on it goes too, which on an invoice is usually your cafe name and address. That reading happens in Sydney, and is used only to read the lines off the page.
Benchmarking
Supplier prices from your bills go into a shared pool with no cafe attached to them: no business name, no account, no quantities and no spend, just the price, the suburb and the date, which is how we build local price benchmarks. Nothing in that pool can be traced back to you, and we never show a figure until enough different cafes stand behind it that it identifies none of them. Seeing the pool in return is opt-in, and that choice is yours.
Your control
You can disconnect Square or Xero at any time from Settings, which stops syncing immediately. You can ask us for a copy of your data or to delete it.
Marketing emails
Every email we send identifies us and carries a working unsubscribe link. Unsubscribing stops the marketing emails; essential account messages may still reach you.
Publication date
This policy is published 16 July 2026.