Privacy

Cyril is run by obm.one in Australia. We keep a small business’s records for it, and follow the Australian Privacy Principles in how we handle them.

What we hold

• Your sign-in: your email, your name if you give it, your password (stored only in a form that can’t be read back), and your two-factor (MFA) and passkey details.
• The business’s records: receipts and their images, bank statement lines, invoices, quotes, jobs, contacts, vehicle logbooks and tasks.
• People in those records: the business’s customers, drivers, and the people it gives access to.
• Mail sent to the business’s email-in address, including who sent it.
• Questions and requests you send us through the contact form: emailed to us, not kept in Cyril.
• A little technical detail: server logs kept 14 days, an error log with emails and codes removed, and counts of wrong vehicle PIN tries and contact form messages by internet address, kept a day.
• Location, only for address suggestions and only if your browser allows it, rounded to about 10 km and kept on your device.

How we use it

Only to run Cyril for you. We don’t sell it, advertise with it, send marketing, or track you. We look at a business’s records only to help it or to fix a fault.

If you’re a business’s customer

The business decides what it keeps about you, such as your name and address on an invoice. Ask the business first; we help it answer.

Who can see it

You, and the people you give access to, area by area. Each business sees only its own records, and the database enforces that. obm.one, for support. The suppliers below, each only for its own job.

Suppliers

• Supabase: The database and sign-in.
  Everything in your account. Australia (Sydney).
• SSD Nodes: The server and stored files.
  Receipt images and other files, and the server’s logs. Australia (Sydney).
• Cloudflare: The network in front of the site, delivery of email-in mail, and the contact form’s spam check.
  Everything passing to and from the site, and mail sent to an email-in address. Worldwide.
• Resend: Sending invoices, receipts and quotes by email, and contact form messages to us.
  The document or message, and the names and emails on it. Kept 30 days. USA.
• Tabscanner: Reading receipts.
  Receipt images. How long it keeps them isn’t stated. United Arab Emirates company, on Amazon’s cloud.
• Geoapify: Address suggestions as you type.
  The address typed, and a location rounded to about 10 km. Kept 24 hours. Cyprus company, servers in the European Union.
• Australian Business Register: Business names for ABNs.
  The ABN only. Australia.

Some of these are outside Australia: in the USA, the United Arab Emirates, Cyprus and the European Union, and Cloudflare’s network worldwide. Each gets only what it needs to do its job.

AI

Reading receipts uses AI: Tabscanner, listed above, reads the photo. Searching the help and reading an odometer photo use AI models that run on our own server in Australia, so what you type or photograph for those isn’t sent to an AI company. Matching receipts to bank lines and suggesting categories are our own rules, run inside your account.

Cookies and your device

One cookie, to keep you signed in. Your device keeps copies of pages to work without signal, anything waiting to send, and your light or dark choice. No tracking or advertising cookies.

Keeping and deleting

• Records are kept while the account exists. The ATO expects a business to keep its records for 5 years.
• Anything you delete is gone at once, apart from backups, which hold it for up to 8 days.
• Issued invoices can be voided but not deleted.
• You can export everything at any time, from Settings. To close an account and delete its records, ask us.

Keeping it safe

Encrypted connections throughout, two-factor sign-in and passkeys, and nightly backups with a second copy kept off the server, in Australia. Invoices, receipts and quotes are sent from our own address with SPF, DKIM and DMARC set up, so mail forged in our name can be recognised. A written plan for handling a security incident, including telling you if your information is affected.

Your rights

You can ask to see or correct what we hold about you, ask us to delete it, or complain, using the contact form. If you’re not happy with our answer, you can contact the Office of the Australian Information Commissioner.

Last updated 22 September 2026.