Privacy policy

This covers mervio.com.au, the Mervio app that accounting organisations and their teams use, the client portal, and the signing links we email. It explains what we collect, why, who else sees it and how long we keep it.

Who we are

Mervio is a product of ACSC Group Pty Ltd (ABN 53 700 528 061), based in Melbourne, Australia. Questions, requests and complaints about privacy go to [email protected].

Two kinds of information

Some of what we hold is about you as someone who uses Mervio: a member of an organisation's team, a client with a portal login, someone signing a document, or someone on the waitlist. We decide what happens to that, and this policy is our commitment about it.

The rest is what accounting organisations keep in Mervio about their own clients. The organisation collected it and decides what it is for, and its own privacy policy applies to it. We store and process it for the organisation, under our agreement with them, and for nothing else. If you are one of their clients and want to see, correct or remove what they hold, ask them. If you ask us, we will pass it on and help them answer.

What we collect about you

• Your account. Name, email address, and optionally a photo and a saved signature. Your password is stored only as a one-way hash and your authenticator secret is encrypted.
• Signing in. Your IP address, your browser and device, a cookie that identifies the browser, and the time of each sign-in and failed attempt. We use these to keep your account safe: a session presented from a different browser is ended, and we email you when a device or network you have not used before signs in.
• What you do in the app. Every change you make to a client record, and every time you reveal a tax file number, goes into an audit trail with who, what, when, your IP address and your browser.
• Signing a document. Your name, email address, IP address, browser, the time of each step and your signature. While the document is open we also record how you move through it: scrolling, pointer movement, clicks and what you type into its fields. That lets the session be replayed if the signature is ever questioned, and it is kept with the document's evidence.
• The waitlist. Your email address, when you joined, your IP address, your browser and which version of the consent wording you agreed to. The address is how we tell you when we open. The rest is evidence that you consented, which the Spam Act 2003 requires us to be able to show.
• Email you send us. Whatever you choose to put in it.

You can read mervio.com.au without telling us who you are. Using the product needs at least a name and an email address.

What organisations keep about their clients

Depending on what an organisation uses, this can include names, dates of birth, contact details, addresses, tax file numbers, ABNs and ACNs, how people and entities relate to each other (directors, trustees, shareholders, beneficiaries), ATO correspondence and other documents, tax figures, billing details, and the AML/CTF risk assessments, sanctions screening results and identity records the organisation keeps.

It reaches Mervio from the organisation's team, from platforms the organisation connects such as Xero and BGL, from the ATO when the organisation authorises us to collect its correspondence, from clients through the portal, and from the Australian Business Register for ABN details.

Tax file numbers get extra handling, in line with the Privacy (Tax File Number) Rule 2015. They sit behind a team permission of their own, every reveal is logged, they are masked before any document goes near an AI model, and they are struck out of every copy of a document sent to a client.

What we use it for

Running the service: signing people in, storing and showing records, filing documents, filling in email templates, collecting payments, and sending the email the product needs, such as invitations, signing requests, reminders and security notices. We also use it to keep the service secure, to look into misuse and to meet our legal obligations.

We do not sell or rent personal information, use it for advertising, or use client records to train AI models. The only email we send you is what the service needs. If we ever want to send anything else, we will ask first.

AI models

Our AI model runs through AWS in Sydney, and nothing sent to it leaves Australia. It only sees documents after tax file numbers, payment reference numbers and EFT codes are masked, and from an organisation's storage it sees folder and file names, never their contents. Client imports are not sent to a model.

Automated decisions

Mervio uses rules to match documents to clients, file them and fill in email templates, and it screens new clients against sanctions lists. None of it decides anything about a person by itself. An email to a client is read and sent by someone at the organisation, anything the rules are unsure of goes to a named team member, and a sanctions match is a flag for the organisation to act on.

Who else sees it

• Amazon Web Services runs our servers, database, document storage, email and the AI model, all in Sydney.
• Cloudflare carries traffic between your browser and us through its nearest location, which may be outside Australia. Nothing is stored there.
• Stripe handles payments when an organisation bills its clients through Mervio. Card and bank details go straight to Stripe and never reach us. Stripe processes in several countries, including the United States.
• Platforms an organisation connects, such as Xero, BGL, Microsoft, Google or its document system, receive what the organisation chooses to sync or file there.
• The ATO and the Australian Business Register, when we collect correspondence or look up an ABN.

We also disclose information where the law requires it. The full supplier list, with what each one could see, is on our security page.

Where it lives and how we protect it

Everything we store is in the AWS Sydney region and is not copied to another country. It is encrypted in transit and at rest, every sign-in needs an authenticator code, and the database itself keeps each organisation's records apart from every other organisation's. The security page has the detail.

How long we keep it

• Account details stay while the account is open. Ask us to close it and we will delete them, though your name can still appear in the audit and signing records below until those expire.
• Client records stay until the organisation deletes them. Anything deleted can be restored by the organisation for 30 days and is then gone.
• When an organisation closes its account, everything it holds is deleted after 30 days. We keep a closed record of the organisation's name, ABN and owner.
• Audit trail entries expire 18 months after they are written.
• History on compliance register items is kept for seven years after the item closes.
• A signed document and its evidence, including the session recording, are kept for five years after the last signature. They go earlier only if the organisation and every signer agree.
• Waitlist entries stay until you unsubscribe or ask us to remove them.
• Copies in our backups and versioned storage roll over within 35 days of the original going.

Seeing and correcting your information

Most of your account details can be changed in your settings. For anything else, or for a copy of what we hold about you, email [email protected]. We answer within 30 days and do not charge. If you are an organisation's client, see "Two kinds of information" above.

Cookies

The app and the portal use cookies to keep you signed in and to recognise the browser your session belongs to. They carry no advertising and do not follow you to other sites. mervio.com.au uses cookies to measure traffic, and you can block those in your browser.

If something goes wrong

If a data breach is likely to cause someone serious harm, we tell the people affected and the Office of the Australian Information Commissioner. Where it touches an organisation's client records we tell the organisation straight away, so it can meet its own duties to its clients.

Complaints

Email [email protected] and we will reply within 30 days. If you are not happy with the answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

When this policy changes we update this page and the date at the top. If a change affects how we use information we already hold, we email account holders before it takes effect.