Privacy Policy

1. Who we are

Trovar is a SaaS platform operated by Matthew Arnott (trading as Trovar) based in New Zealand. We provide automated invoice collection services for accounting firms in New Zealand and Australia.

Contact: support@trovar.co.nz

2. What data we collect

We collect the following data when you use Trovar:

• Account data: Your name, email address, and accounting practice name when you sign up.
• Client data: Names and email addresses of clients you add to your practice account.
• OAuth tokens: Access tokens from connected platforms (Meta Ads, Google Ads, Adobe, Shopify) used solely to retrieve billing invoices on your behalf. We do not store passwords.
• Invoice data: Billing invoices retrieved from connected platforms including invoice ID, date, amount, currency, and description.
• Usage data: Basic usage information such as login times and feature usage to improve the product.

3. How we use your data

• To provide the Trovar service: retrieving and displaying invoices from connected platforms
• To push invoices to your Xero account (when connected)
• To send you service notifications and product updates
• To improve the product based on usage patterns

We do not sell your data to third parties. We do not use your data for advertising purposes.

4. Meta Platform data

When you connect a client's Meta Ads account, Trovar requests the following permissions:

• ads_read: To retrieve billing invoices and ad account information
• business_management: To access business-level invoice data

We access only billing and invoice data. We do not read, store, or process ad creative, audience data, or personal data of people who have seen or interacted with ads.

Meta platform data is used solely to retrieve invoices for accounting purposes. Data obtained through Meta APIs is not shared with third parties except as required to provide the service (e.g. pushing invoices to Xero at the user's direction).

Users can revoke Meta access at any time by disconnecting the platform in Trovar or through their Meta Business Settings.

5. Data storage and security

Your data is stored in Supabase (PostgreSQL) hosted on AWS in the Asia Pacific region. OAuth access tokens are stored encrypted. We use industry-standard security practices including HTTPS encryption for all data in transit.

6. Data retention

We retain your data for as long as your account is active. If you cancel your account, we will delete your data within 30 days upon request. Invoice data may be retained for up to 7 years to comply with NZ IRD record-keeping requirements, unless you request earlier deletion.

7. Your rights

Under the New Zealand Privacy Act 2020, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your data
• Withdraw consent for data processing

To exercise these rights, email support@trovar.co.nz.

8. Cookies

Trovar uses essential cookies only, for authentication and session management. We do not use tracking or advertising cookies.

9. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes by email. Continued use of Trovar after changes constitutes acceptance of the updated policy.

10. Contact

For any privacy questions or concerns: support@trovar.co.nz