Private business records
Company workspaces are used to provide Xreference, not to sell advertising profiles or data brokerage products.
Australian hosted platform
The production environment is hosted in Microsoft Azure Australia Central under Protosoft’s infrastructure model.
Transparent usage signals
Xreference may show storage, user, portal, AI report and capacity usage inside the subscription area so customers can stay informed.
Your operational records are private by nature.
This Privacy Policy explains how Protosoft Pty Ltd collects, uses, stores and discloses personal information through xreference.com, Xreference customer workspaces, portals, subscription tools, support and related services.
In this policy, “Xreference”, “the Service”, “we”, “us” and “our” refer to Protosoft Pty Ltd. “You” and “your” refer to a person or business that accesses or uses the Service.
Xreference stores information that businesses rely on to operate: customers, suppliers, sales, jobs, projects, stock, accounting, payroll, portals, reports, files and related activity. We treat that information as private company records.
We do not sell personal information or operational data to advertisers. We use information to provide, secure, support, improve and administer Xreference, including subscriptions, usage visibility and customer workspaces.
1. Changes to this Privacy Policy
We may update this Privacy Policy from time to time by publishing the revised version on this page. The updated policy applies from the date it is published, unless otherwise stated.
If a change materially affects how personal information or operational data is handled, we will take reasonable steps to notify affected customers through the website, application, email, support notice or another practical method.
2. Information we collect
We collect information reasonably necessary to provide, maintain, secure, support and improve Xreference. This may include:
- account information such as name, email address, mobile number, password credentials, verification activity and login activity;
- company information such as business name, ABN, settings, workspace preferences, subscription details, staff access and permission records;
- support and enquiry information you send to us, including emails, contact forms, attachments and issue history;
- billing and subscription administration details such as plan, active user count, renewal date, access status, invoice status, Stripe reference numbers and transaction metadata;
- usage information such as file storage, record activity, portal activity, AI report activity, active users, capacity signals and feature usage; and
- technical information such as IP address, browser type, device information, pages visited, cookies, session details, error logs, security events and server logs.
3. Company and operational data
Xreference stores operational data entered, uploaded, imported or generated by company users. This may include customers, suppliers, employees, service personnel, jobs, projects, quotes, invoices, expenses, stock, purchase orders, payroll, reports, notes, files, images, documents and related business records.
This data may contain personal information about customers, staff, contractors, suppliers, portal users or other people connected to your business.
Privacy position: customer records, supplier records, job records, payroll records, payment notes, files, reports and other operating records are treated as private company records. They are used to provide Xreference and related support, not to build advertising profiles.
4. Your responsibility for information you enter
If you enter, upload or import personal information about other people, you are responsible for making sure you have the right to do so and that your collection and use of that information is lawful.
This is especially important for customer records, employee records, payroll information, service personnel details, portal access, identity documents, sensitive notes, banking references, attachments and reports.
5. Users, staff access and portals
Xreference may include controlled internal users, employee access, service personnel access, customer portal access and other portal-style access depending on the plan and features enabled for the workspace.
We collect and process portal-related information to authenticate users, show the correct records, maintain activity history, send notifications, support access control and protect the workspace.
Portal access is part of the company workspace. The account owner or authorised administrators are responsible for adding, removing and maintaining access for staff, service personnel, employees, customers and other authorised users.
6. Subscription page, usage meters and capacity signals
Xreference may collect, calculate and display usage information inside the subscription page or account area. This may include active internal users, storage usage, file counts, portal activity, AI report usage, plan features, add-ons, renewal dates and other capacity indicators.
These usage meters or fuel gauges are used to help customers understand current use, administer subscriptions, manage fair use, plan capacity, identify unusual activity and avoid unexpected service issues.
Public pricing pages may remain simple, while detailed plan status, usage and renewal information is shown inside the customer workspace or Stripe checkout flow.
7. Stripe payments and billing information
Xreference uses Stripe for subscription payments and payment processing. We do not accept PayPal, cash, cheque, direct transfer or other payment methods unless Protosoft Pty Ltd expressly agrees in writing.
Payment card details are handled by Stripe. We do not intentionally store full credit card numbers, complete payment card details or card security codes on our own servers.
We may store limited payment and subscription information such as customer identifiers, Stripe identifiers, invoice references, payment status, access period, renewal date, plan, user count, amount charged, transaction metadata and billing contact details.
8. AI analytical reports and assisted features
Xreference may offer AI analytical reports, business analysis tools, advisor chat or other assisted features. These features are designed to help authorised users understand business activity inside their own company workspace.
For generated analytical reports, Xreference is designed to prepare anonymised or aggregated business summaries before sending report inputs to an AI or technology provider. Those summaries may include report periods, business totals, category totals, trends, comparisons, counts, percentages, stock or purchasing figures, accounting figures, payroll totals and other non-identifying measures needed to write the report.
Generated analytical reports are not intended to send customer names, supplier names, employee names, personal addresses, phone numbers, email addresses, payroll identity details, bank details, uploaded files, private notes, passwords or other personal information to the AI provider. Where a report appears personalised, Xreference may add the company name, user name, headings, dates or presentation details inside Xreference after the AI-generated commentary is returned.
If a user types information directly into an advisor chat or free-text prompt, that message may be processed to generate a response. Users should not enter personal information, sensitive business information, passwords, payment card details, tax file numbers, payroll identity details or confidential customer information into any chat or prompt field unless they are comfortable with it being processed for that response.
Recent report inputs, generated reports or advisor responses may be stored temporarily or permanently in the company workspace so authorised users can view, audit, reuse or follow up the information later. AI reports are provided as operational commentary and must be reviewed by the customer. They are not legal, financial, accounting, taxation, payroll compliance or professional advice.
10. How we use information
We may use information to:
- create, verify, authenticate and secure user accounts;
- provide Xreference features, company workspaces, portals, reports, files and operational tools;
- process subscriptions, renewals, cancellations, billing records and access status;
- display subscription status, plan access, usage meters and capacity signals;
- respond to support requests, troubleshoot errors and communicate service notices;
- generate reports, AI analytical commentary and business summaries where enabled;
- protect the Service against fraud, misuse, unauthorised access, security threats and infrastructure abuse;
- maintain backups, audit trails, logs, compliance records and business records; and
- improve Xreference, test features, monitor reliability and plan infrastructure capacity.
12. Hosting location and third-party processing
The Xreference production environment is hosted in Microsoft Azure Australia Central. Some third-party services used for payments, email, SMS, support, security, analytics, AI report generation or technical operations may process or store information in other locations depending on their infrastructure.
Where we use third-party providers, we choose providers for practical business reasons such as reliability, security, capability, compliance support and availability.
13. Storage and security
We use reasonable technical, administrative and organisational measures to protect information, including access controls, password hashing, verification checks, server security, backups, monitoring, logging and controlled staff access.
No online service can guarantee perfect security. You are responsible for keeping login details confidential, using secure passwords, managing users carefully and removing access when people no longer need it.
14. Retention and inactive accounts
We retain information for as long as reasonably necessary to provide the Service, maintain business records, support account access, resolve disputes, comply with legal obligations, protect the Service, enforce our terms and maintain backups.
If a subscription is cancelled, expires or becomes inactive, we may retain workspace information for a reasonable period before deletion, restriction, archival or removal, unless a longer period is required or permitted by law.
Backup copies may remain in secure backup systems for a limited period after information is changed, deleted or removed from active systems.
15. Access, correction and deletion requests
You may contact us to request access to personal information we hold about you, correction of inaccurate personal information, or deletion of your account or personal information. We may need to verify your identity and authority before actioning a request.
Some requests may be limited by legal obligations, business record requirements, security needs, backup retention, dispute handling, billing records or the rights and privacy of other people.
16. Service communications
We may send account, security, subscription, billing, support, service availability and operational notices by email, SMS, application notice or other practical method.
We may also send product information or update notices related to Xreference. Where marketing-style communications are used, we will provide a practical way to unsubscribe where required by law. Essential service, billing and security notices may still be sent even if marketing communications are declined.
17. Children
Xreference is a business administration system and is not intended for children. You should not provide access to children or enter personal information about children unless it is lawful, appropriate and necessary for your business use of the Service.
18. Contact
If you have questions about this Privacy Policy, privacy requests, account information or Xreference data handling, contact Protosoft Pty Ltd at support@protosoft.com.au.
You can also review our Terms & Conditions for subscription, fair-use, cancellation, AI reports and service-use terms.