Privacy Policy

1. INTRODUCTION

This document sets out the privacy policy of Greene Auto Pty Ltd ABN 54 691 236 647 (referred to in this privacy policy as ‘we’, ‘us’, or ‘our’). We operate Drawr, a mobile application and website that allow you to capture, store, organise, search and manage your receipts, warranties and purchase records (Drawr or the App).

We take our privacy obligations seriously. We have created this privacy policy to explain how we collect, store, use and disclose personal information, and how we comply with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs) in that Act.

By providing personal information to us, you consent to our storage, maintenance, use and disclosing of personal information in accordance with this privacy policy.

We may change this privacy policy from time to time by posting an updated copy in the App or on our website. Where a change is significant, we will take reasonable steps to notify you. We encourage you to check the current version regularly so that you are aware of our most current privacy policy.

2. TYPES OF PERSONAL INFORMATION WE COLLECT


The kinds of personal information we collect depend on how you use Drawr. They may include:

  1. identity and contact information, such as your name, email address and mobile phone number;
  2. account and authentication information, such as your password (stored in encrypted form), one-time passcodes sent to your mobile number, and, if you choose to use them, your Apple or Google sign-in identifiers;
  3. receipt and purchase information, being the images of receipts, warranties, invoices and similar documents that you capture or send to Drawr, and the information extracted from them, such as the merchant, the date, the items purchased, the amounts and any GST (Receipt Data);
  4. information contained in emails and text messages you forward to the App, including the content of those messages and any attachments (this is dealt with in more detail below);
  5. subscription and billing status, such as whether you hold a free or paid subscription and your purchase and renewal history. Your payment card details are collected and processed by the Apple App Store, Google Play and our subscription management provider, and are not collected or stored by us;
  6. technical and usage information, such as your device type and identifiers, IP address, app and website usage, and standard log information; and
  7. any other information you choose to provide to us, including when you contact our support team or respond to a survey.

Because a receipt is a photograph of a document created by someone else, Receipt Data may occasionally contain incidental personal information that we do not ask for, such as a partial payment card number, a signature, or information about another person. We do not use that incidental information for any purpose other than providing Drawr to you, and clause 12 explains how you can ask us to remove it. You can also delete a receipt from your account at any time, including where you have uploaded something by mistake.

We do not seek to collect sensitive information (such as health, biometric or similar information) through Drawr. Please do not use Drawr to store documents whose main purpose is to record sensitive information. Drawr is intended for use by individuals who are at least 18 years old, and we do not knowingly collect personal information from anyone under that age.

3. HOW WE COLLECT PERSONAL INFORMATION


We collect personal information in a number of ways, including directly from you and, in some cases, from third parties. We collect personal information when you:

  1. create an account, or sign in using Apple or Google;
  2. capture a receipt using your device camera;
  3. forward a receipt email to the unique inbound email address we assign to your account;
  4. forward or share a receipt text message to the dedicated number we make available;
  5. subscribe to a paid tier through the Apple App Store or Google Play;
  6. contact us, respond to a survey, or otherwise communicate with us by email, telephone or SMS; and
  7. use or access the App or our website, including through cookies and similar technologies.

When you use our website, we may collect personal information through cookies and similar tracking technologies. Our Cookies Policy explains what cookies we use and how you can control them.

We use Google Analytics to help us understand how our website is used. To find out how Google uses data when you use our partners’ sites or apps, see google.com/policies/privacy/partners.

4. EMAIL AND TEXT MESSAGE FORWARDING

A core feature of Drawr is that you can forward receipt emails and receipt text messages into your account. When you do so, we receive and process the content of those messages so that we can create a record in your account.

Emails and text messages that you forward may contain personal information about people other than you, such as the name and contact details of a sender, an email signature, or unrelated content further down a message thread. We collect this information only because you have chosen to send it to us, and we use it only to provide Drawr to you.

Where we collect personal information about someone other than you in this way, it is generally not practicable for us to notify that person that we have collected their information. By forwarding a message to Drawr, you confirm that you are entitled to provide us with the personal information it contains, and that you have made any disclosures to, or obtained any consents from, other people that the law requires of you. If you do not want us to receive personal information about another person, please remove it before you forward the message.

We keep the original email or text message you forward, together with any attachments, so that you can access it in your account and check the information we have extracted from it. How long we keep it is set out below.

5. USE OF YOUR PERSONAL INFORMATION


We collect, hold and use personal information for the following purposes:

  1. to provide Drawr to you, including to capture, extract, store, organise and make searchable your Receipt Data;
  2. to operate the email and text message import features and route forwarded content into your account;
  3. to calculate estimated warranty expiry dates and send you warranty reminders;
  4. to create and administer your account, verify your identity and manage your subscription;
  5. to provide customer support and respond to your enquiries;
  6. to send you service messages, such as security alerts, receipt processing notifications, reminders and administrative notices;
  7. to send you marketing and promotional messages where you have consented, or we are otherwise permitted by law to do so, in accordance with the Spam Act 2003 (Cth). You can opt out at any time using the unsubscribe facility in the message;
  8. to improve and optimise Drawr, including by using de-identified and aggregated information from which you cannot reasonably be identified;
  9. to keep Drawr secure and to detect and prevent fraud and misuse; and
  10. to comply with our legal obligations, resolve disputes and enforce our agreements.

6. DISCLOSURE OF YOUR PERSONAL INFORMATION

We may disclose your personal information to third parties who help us provide Drawr. These include the technology providers described in the table below, our professional advisers, and government or law enforcement bodies where we are required or authorised by law to do so. We may also disclose your personal information to a purchaser of our business, subject to appropriate confidentiality arrangements.

We do not sell your personal information, and we do not disclose your Receipt Data to third parties for their own marketing purposes.

7. DISCLOSURE TO OVERSEAS RECIPIENTS

Some of the third parties we use to provide Drawr are located overseas, or are Australian entities of overseas groups that may access personal information from overseas. We currently store the core of your Drawr data, including your Receipt Data, in Australia. However, the providers set out in the table below may process personal information in, or access it from, the countries indicated.

The main providers we use, and the personal information they process, are:

ProviderWhat they doWhere
Amazon Web ServicesCloud hosting, database and file storage, and inbound email processing for the email import featureData stored in Australia (Sydney region). AWS is a United States group and its personnel may access data from overseas for support.
GoogleProcessing of receipt images to extract Receipt DataUnited States and other countries in which Google operates
TwilioInfrastructure for receiving and forwarding receipt text messagesUnited States and other countries in which Twilio operates
RevenueCatManagement of subscription and billing status (no full payment card details)United States
Apple App Store and Google PlayApp distribution and payment processing for paid subscriptionsUnited States and other countries in which they operate

Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure that the recipient handles it consistently with the APPs, or we rely on an exception in the Privacy Act. You consent to these overseas disclosures. If an overseas recipient handles your personal information in breach of the APPs, you acknowledge that we may not be accountable under the Privacy Act and you may not be able to seek redress under the Privacy Act.

8. HOW LONG WE KEEP YOUR INFORMATION

We keep personal information only for as long as we need it for the purposes set out in this privacy policy, or for as long as the law requires. In particular:

  1. if you are on our free tier, the amount of Receipt Data we store and how long we store it for depend on the limits applying to that tier, as described in the app, and Receipt Data that exceeds those limits is deleted;
  2. if you are on a paid tier, we store your Receipt Data for as long as your paid subscription continues, and, if your paid subscription or a free trial ends, we retain the Receipt Data you uploaded while it was active, or during the trial, on a read only basis;
  3. we keep forwarded emails and text messages, and any attachments, for the same period as the Receipt Data created from them, so that you can access the original;
  4. if you ask us to delete your account, we delete or de-identify the personal information we hold about you within 30 days of your request, unless we are required by law to keep it for longer; and
  5. backup copies are overwritten in the ordinary course within 90 days.

We may keep de-identified and aggregated information, from which you cannot reasonably be identified, for longer.

9. USING drawr FOR BUSINESS EXPENSES

Drawr. lets you keep a business expense profile within your personal account. Your account, and this privacy policy, always relate to you as an individual, whether you use Drawr for personal or business purposes. If you record the expenses of a business you operate, you are responsible for meeting any privacy or record-keeping obligations that apply to that business, including where the receipts you store contain personal information about your own customers or staff.

10. SECURITY

We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include storing data in access-controlled cloud infrastructure, encrypting passwords, and using a range of administrative and technical measures. However, no method of transmission or storage is completely secure, and we cannot guarantee the security of your personal information.

11. LINKS

Our website may contain links to other websites. Those links are provided for convenience and may not remain current or be maintained. We are not responsible for the privacy practices of those linked websites and we suggest you review the privacy policies of those websites before using them.

12. REQUESTING ACCESS OR CORRECTING YOUR PERSONAL INFORMATION

You may request access to the personal information we hold about you, and ask us to correct it, by contacting us using the details below. We may need to verify your identity first. We will respond within a reasonable time, generally within 30 days. In some cases we may decline access or correction as permitted by the Privacy Act, and if we do, we will tell you why in writing and explain how you can complain.

13. COMPLAINTS

If you wish to complain about how we have handled your personal information, please contact us using the details below. We will investigate your complaint and respond within a reasonable time, generally within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

14. CONTACT US

For further information about this privacy policy or our privacy practices, or to access or correct your personal information or make a complaint, please contact us using the details below:

Attention: Privacy Officer

Email: support@drawr.com.au

This privacy policy was last updated on 8 September 2026.