Privacy Policy

1. Who we are

Mona Collects (ABN 78 366 840 023) provides software that helps businesses collect their overdue invoices. This policy explains how we handle personal information across our website, our platform and our service, in line with the Australian Privacy Principles. Privacy questions and requests go to support@monacollects.com.au.

2. What we collect

From our customers: account and contact details such as your name, business name, ABN, email, phone, logo and the payment details you choose to show on letters, plus your login credentials (passwords are stored only in securely hashed form) and your subscription billing history. Card details are handled by our payment provider Stripe and never stored by us.

From the businesses our customers chase (debtors): the information our customers upload or connect for the purpose of collections, such as business and contact names, email addresses, phone numbers, invoice details, amounts owing and payment history. We handle this information on our customer's behalf and at their instruction.

From visitors and leads: details you choose to give us through forms on our website, such as your name, email, mobile and business name when you request a call back or a resource pack.

Automatically: the technical basics needed to run a secure service, such as server logs. We use essential cookies to keep you signed in. We do not use advertising trackers on our website.

3. How we use it

We use personal information to provide the service: sending reminder letters and formal letters in our customer's name, detecting payments, producing reports, providing support, processing billing and keeping accounts secure.

If you leave your details through a form, we use them to do the thing you asked for, such as calling you back or emailing you the resource you requested, and to occasionally say hello about Mona Collects. Every marketing email includes a way to opt out, and asking to stop is always enough.

We do not sell personal information. Ever.

4. Debtor information, specifically

Debtor information is used solely to run collections for the customer who provided it: sending communications, matching payments and reporting back to that customer. We never use debtor information for our own marketing, and we never pool or share one customer's debtor information with any other customer. Each business's data is isolated from every other business's data at the database level.

If you have received a letter sent through our platform, the debt belongs to the business named on the letter, and questions about it should go to them using the contact details on the letter. If you have a privacy question about our handling of your information, you can also contact us directly.

5. Who we share it with

We share personal information only with the service providers needed to run Mona Collects: Stripe (payments), Supabase on Amazon Web Services in Sydney (database and storage), Vercel (application hosting), Resend (email delivery) and Google Workspace (our business email). If a customer connects Xero, we read invoice and contact data from Xero at their instruction, and if a customer configures a CRM webhook, activity is sent to the destination they chose.

Our primary data storage is in Australia, in the AWS Sydney region. Some providers, such as our email delivery and application hosting providers, process data on infrastructure located overseas, including the United States, in the course of delivering email and serving the application. We choose providers that hold recognised security certifications.

If a customer asks us for help escalating a case, we share the relevant case information, such as the debtor's details, the invoices and the communication history, with the third-party provider we introduce for that purpose, as described in our Terms of Service.

We may disclose information where the law requires it.

6. How we protect it

Information is encrypted in transit and at rest. Access is controlled, every business's data is walled off from every other's, accounting connections are read-only, and we run on independently certified infrastructure. No system is perfectly secure, but security decisions here are made carefully and conservatively.

7. How long we keep it

We keep customer data while the account is active. After cancellation, customers may request an export of their key data within 30 days, and we then delete personal information from the live service within a reasonable period, keeping only what the law requires us to retain, such as billing records.

Lead details are kept only as long as they are useful for the purpose you gave them to us, and are deleted on request.

8. Access, correction and complaints

You can ask us at any time what personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing support@monacollects.com.au. We respond promptly and without charge.

If you believe we have mishandled your information, tell us and we will investigate and reply as quickly as we can. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

9. Changes to this policy

If we change this policy we will publish the new version here and update the date below. Material changes affecting customers will be notified by email.