How we handle your data

Who we are

AnnualsAI ("we", "us") prepares accounting work for accounting firms. We work with firms in New Zealand and Australia.

Our role

We act for the accounting firm that engages us. We handle your clients' information only to do the work your firm asks for. We do not use it for any other purpose. We do not sell it, and we do not use it for marketing.

Information we handle

• Your firm's details: names, email addresses and phone numbers you give us, including through our enquiry form.
• Your clients' information: accounting records, bank and loan statements, tax returns, and other documents in the software or storage you give us access to. This can include names, addresses, IRD numbers or tax file numbers, and financial details.

Systems we use

• Your firm's software and storage. We work in the accounting software and document storage your firm gives us access to, such as Xero, MYOB, QuickBooks Online, Dropbox, Google Drive or SharePoint.
• Our AI provider. We use a third-party AI provider to prepare and review the work. Information needed for each job is sent to that provider for processing.
• Our website. Our website and enquiry form are hosted by Squarespace.

Overseas storage and processing

Information may be processed overseas. To prepare and review each job, the information needed is processed by our AI provider, which may be outside New Zealand and Australia. Some of your firm's own software and storage providers may also hold data overseas.

Before we send information overseas, we take reasonable steps to make sure it will be protected in a way that is comparable to New Zealand and Australian privacy law.

How access is controlled

• You choose what we can access. We use only the access your firm gives us.
• Your firm can remove our access to its software and storage at any time.

Where your data stays

We do not store your firm's or your clients' data on our own servers, PCs or laptops. We work inside your portal: the accounting software and document storage your firm already uses. The finished work is saved back there too.

Your data stays in your firm's own systems, which your firm controls. Once you remove our access, we can no longer see it. The information needed for each job is sent to our AI provider for processing. The AI provider may keep it for a limited time under its own terms.

If something goes wrong

If we become aware of a privacy breach that affects your firm's information, we will tell your firm promptly. We will give you the information you need to meet your own obligations, including notifying the Office of the Privacy Commissioner in New Zealand or the Office of the Australian Information Commissioner (OAIC) where required.

Privacy laws

New Zealand

We comply with the Privacy Act 2020 and its information privacy principles, including the rules on sending information overseas (IPP 12).

Australia

We comply with the Privacy Act 1988 and the Australian Privacy Principles (APPs) as they apply to us, including the rules on cross-border disclosure (APP 8).

Your firm's obligations

Your firm is responsible for its clients' information. Before you share it with us, your firm should:

• have authority from your clients to share their information with a service provider
• tell your clients, in writing, that the work is prepared by an AI service provider and that their information may be processed overseas. Your engagement letter is a good place to do this.
• meet the professional rules that apply to your firm in New Zealand and Australia.

New Zealand

• Your authority to act from each client should allow Inland Revenue information to be shared with a service provider like us, to the extent needed for the work. Inland Revenue sets out its expectations for authorities to act in its operational statement OS 25/03.
• Inland Revenue does not take responsibility for how client information is used once it is outsourced. Your firm remains responsible for it.
• If your firm or its members belong to a professional body, such as Chartered Accountants Australia and New Zealand (CA ANZ) or CPA Australia, follow its code of ethics on confidentiality and outsourcing.

Australia

• Follow the Tax Practitioners Board's Code of Professional Conduct, including its rules on confidentiality and on supervising third-party providers.
• APES 305 Terms of Engagement requires members of the professional bodies to tell clients in writing when work is outsourced, including where the work is done overseas.
• Your firm's registered tax or BAS agent remains responsible for anything lodged with the ATO.
• Follow the rules of any professional body your firm or its members belong to, such as CPA Australia or Chartered Accountants Australia and New Zealand (CA ANZ).

Our website

When you send an enquiry, we use your details to reply and to prepare a quote. Our website host may use cookies and collect basic visitor statistics.

Contact and complaints

To ask about, access or correct personal information we hold, or to make a complaint, email hello@annualsai.co.nz.

If you are not happy with our response, you can contact the Office of the Privacy Commissioner in New Zealand (privacy.org.nz) or the OAIC in Australia (oaic.gov.au).

Last updated: 2026.