Last updated: 16 October 2026
This policy explains how Comma5 Pty Ltd (“we”, “us”) handles personal information in Doshpup (the “Service”), an assistant that helps businesses collect overdue invoices. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
It covers two groups of people: our customers (businesses that use Doshpup, and their staff), and their customers (people and businesses who receive payment reminders sent through Doshpup). If you received a reminder, the business that sent it is responsible for your account with them; Doshpup handles your information on its behalf.
1. What we collect
- Your account: your name, email address and the sign-in identity from Google or Microsoft if you use it, plus two-factor authentication settings.
- From Xero, when a business connects it: overdue sales invoices (invoice number, amount due, due date, status) and the customer contact details on them (name, email addresses, phone numbers).
- From the business’s mailbox (Microsoft 365 or Google Workspace/Gmail): only the reminders Doshpup sends and the replies in those same email conversations. Doshpup ignores all other email; it is not stored, logged or sent to AI.
- SMS: mobile numbers, the text messages Doshpup sends and any replies, when a business uses SMS as a back-up to email.
- Activity records: what Doshpup drafted, who approved it, what was sent and when, and sign-in records, kept for security and so the business has a full history.
2. How we use it
- To find overdue invoices and draft payment reminders.
- To send reminders only after a person at the business approves them, from the business’s own mailbox or SMS number.
- To read replies to those reminders (for example a promise to pay, “already paid”, a dispute or a request to stop) and update the case.
- To add a short note to the invoice’s history in Xero recording what Doshpup did. These notes contain no message text.
- To keep the Service secure and working.
We do not sell personal information, use it for advertising, or use it to train AI models.
3. How Doshpup uses AI
Doshpup uses Claude, an AI model made by Anthropic, through Google Cloud’s Vertex AI. It sends the text of a reply (without attachments, signatures or earlier messages) and the minimum invoice details needed, so the AI can suggest what the reply means and how the reminder should be worded. This AI processing takes place in the United States. Amounts, dates and invoice details in reminders always come from Xero, never from the AI. The information is not used to train AI models.
4. Google and Microsoft mailbox data
When a business connects a Google Workspace or Gmail mailbox, Doshpup requests permission to send email and to read replies in the conversations it started. The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The same limits apply to Microsoft 365 mailboxes. We use mailbox data only to provide the features described above. We don’t transfer it to others except as needed to provide the Service, to comply with law or to protect security. We don’t let our staff read email content unless the business asks us to for a specific message, or it is needed for security or required by law.
5. Where it’s stored and who processes it
Doshpup and its data are hosted on Google Cloud in Sydney, Australia, including backups. Service providers that process information on our behalf:
- Google: hosting, sign-in, and AI processing through Vertex AI (in the United States).
- Anthropic: maker of the Claude model, provided through Google Cloud.
- Xero, Microsoft and Google: the accounting system and mailbox that the business chooses to connect.
- Texto: SMS delivery, hosted in Australia.
We only share what each needs to do its job.
6. Security
Connections use HTTPS. Access tokens for Xero and mailboxes are encrypted at rest. Each business’s data is kept separate from every other business’s. Two-factor authentication is required for account owners and administrators. Every action Doshpup takes is recorded in an audit log that cannot be edited.
7. Keeping and deleting information
- Reminder and reply content is kept for 12 months after a case is closed, then deleted.
- Activity records (what happened and when, without message content) are kept for 7 years.
- Disconnecting Xero or a mailbox deletes its stored access tokens.
- A business can ask us to delete its account and data at any time by emailing team@comma5.au; we’ll do so within 30 days, apart from records we must keep by law.
8. If you received a reminder
You can ask not to be contacted by replying to the email (for example “please stop emailing me”), replying STOP to an SMS, or contacting the business directly. Doshpup stops contacting you straight away. For questions about your account or invoice, contact the business that sent the reminder.
9. Your rights
You can ask to access or correct your personal information, or to have it deleted, by emailing team@comma5.au. If you’re unhappy with how we’ve handled a privacy matter, contact us first. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au).
10. Changes
We’ll update this page when things change, and let customers know of significant changes.
team@comma5.au