WorkApproved Privacy Policy
Last updated: 22 October 2026
This policy explains what personal information WorkApproved collects, why, where it's kept, who sees it, and your rights. We've tried to keep it plain. If something is unclear, ask us at [email protected].
Who we are. Stone Pritchard Limited, a New Zealand company, trading as WorkApproved ("we", "us"). Our privacy officer is Matt Pritchard, reachable at [email protected]. Security problems go to [email protected].
1. Two roles
We handle personal information in two different roles.
- As a service provider for our customers (the "approval data"). A customer connects its Xero organisation. We then hold information about its approvers, its suppliers and its customers, and the documents they're involved in. The customer decides why and how that information is used. We process it on the customer's behalf and only for them. If you want to see, correct or delete information of this kind, ask the customer first. We'll help the customer answer you. The data processing terms are Schedule 1 of our Terms of Service.
- As the organisation responsible for our own records (the "account data"). Information about the people who sign up, administer an account, pay, or contact us. We decide how that is used, and this policy covers it.
2. What we collect
| Information | Where it comes from | Why we use it | Role |
|---|---|---|---|
| Name, email address, role, language of each person in an organisation (administrators, approvers, auditors, viewers, email approvers) | The customer, or Xero | To route documents, send emails, and show who can do what | Approval data |
| Decisions, comments, queries and answers; time; IP address; browser/device details; whether a decision was by a login, an email link, a delegate, a rule or an AI connection | Generated when people act | To keep the audit record and certificates, and to detect misuse | Approval data |
| Supplier and customer details in Xero documents: names, contact details, tax numbers, addresses, bank account details; the documents, lines, amounts and attachments | Xero | To run approval workflows and risk indicators (for example duplicate and bank-change checks) | Approval data |
| Public business-register data (NZBN) about suppliers and customers, for organisations in New Zealand: the NZBN, the entity's legal and trading names, its type and its register status (for example registered, in liquidation or removed), with the date and time we fetched it from the register or last refreshed it | The Companies Register and the NZBN Register, run by MBIE (New Zealand's Ministry of Business, Innovation & Employment), looked up from the NZBN or the name on the customer's Xero contact | To show the customer what the register records about a supplier or customer, as one of the risk indicators. It is information, not advice or a credit check | Public business-register data we display (see section 6) |
| Up to 12 months of past bill details (no attachments), if the customer switches on duplicate checking | Xero | To spot duplicates and unusual patterns from day one. Kept up to date from Xero while switched on | Approval data |
| The list of Xero users (name, email) | Xero | To work out who submitted a document | Approval data |
| Xero connection tokens | Xero | To read from and write back to the customer's Xero organisation (stored encrypted) | Approval data |
| Name, email, password (kept only as a one-way hash), two-factor secrets (encrypted), passkey public keys, login activity (time, IP address, device) | You, or Xero when you sign up with Xero | To create and secure your login | Account data |
| Company or firm name, billing contact, address, tax number, plan, invoices, payment status; card brand and last four digits as reported by Stripe | You, and Stripe | To bill you, issue tax invoices and meet tax law. We never hold your full card number. | Account data |
| Messages to hello@ or security@, and our replies | You | To help you | Account data |
| Technical logs: IP address, time, pages and requests, errors | Your browser | To run, secure and fix the service. Our logs are filtered to remove emails, tokens and bank account numbers | Account data |
| Firm staff details and client relationships, for accounting firms that are partners | The firm | To run the partner console and billing | Account data |
We don't collect special categories of information on purpose, and we don't knowingly collect information about children. WorkApproved is for businesses.
3. How we use it
- To provide the service: sync from Xero, route approvals, send emails, write back to Xero, make certificates, run risk indicators (for organisations in New Zealand, including checking suppliers and customers against public business registers).
- To secure the service and prevent misuse.
- To bill, support and communicate with you, including service emails (approvals, alerts, invitations, receipts).
- To meet our legal obligations (tax, accounting, responding to lawful requests).
- To improve the service, using counts and measurements about usage, not the content of your data.
- Marketing emails. If you ask to hear from us, for example by joining our mailing list, we use your email address to send news and updates about WorkApproved. Every message has an unsubscribe link, and you can stop at any time. We don't send marketing emails to people who haven't asked for them.
What we don't do. We don't sell personal information. We don't use it for advertising. We don't use approval data, including anything from Xero, to train AI or machine-learning models. Our risk indicators are rule-based. If a customer connects its own AI agent to WorkApproved, that is the customer's choice and responsibility.
4. Who sees it
- People in the customer's organisation, according to the roles the customer sets. If an accounting firm pays for an organisation, the firm's staff can see and manage everything in it, and they appear in the organisation's People list.
- WorkApproved staff. A small number of staff can see inside customer organisations to give support and fix problems. A support agent looks inside an organisation only while the customer has switched support access on. Our owner and technical staff may also access an organisation where that is needed to fix a fault or protect the service. Staff use their own secured logins with two-factor authentication, can't approve, reject or change a workflow, and their actions are logged inside WorkApproved.
- Our service providers (sub-processors), listed below and on our public list at workapproved.app/subprocessors.
- Xero, because that's the system we connect to for the customer.
- Others only if the law requires it, for example a court order, or to protect people from serious harm. We'll tell the customer first where we're allowed to.
5. Where it's held and who we use
| Provider | What for | Where |
|---|---|---|
| Laravel Cloud | Application hosting platform | Runs on Amazon Web Services in Sydney, Australia |
| Amazon Web Services | Infrastructure under Laravel Cloud, including the database | Sydney, Australia (ap-southeast-2) |
| Cloudflare | Delivery and security in front of the service, DNS, bot protection, website hosting, file storage (attachments, certificates, partner logos), email forwarding | Cloudflare's network runs worldwide. Files are stored in Cloudflare R2, whose location Cloudflare doesn't guarantee |
| Resend | Sending our emails (approvals, alerts, invitations, password resets) | United States company. Emails are sent through Amazon SES in Tokyo, Japan. Open and click tracking are off |
| Stripe | Card payments, subscriptions, tax calculation | Stripe processes in several countries, including the United States |
| Microsoft (Outlook.com) | Receives and stores support emails sent to our hello@ and security@ addresses | Microsoft's data centres. We don't choose the location |
| MBIE (Ministry of Business, Innovation & Employment) | Public business-register lookups for organisations in New Zealand (the Companies Register and the NZBN Register). We send it the NZBN or business name we look up. It is a source we query, and holds nothing for us | New Zealand |
| Xero | The customer's own accounting system | As Xero's own terms say |
We're in New Zealand. Our staff work from New Zealand.
Cross-border disclosure (New Zealand Privacy Act, IPP 12). Information about people may be sent to the countries above (Australia, the United States, Japan and others in Cloudflare's network). We only send personal information to a provider overseas if one of these is true: the provider holds or processes it only to provide a service to us, as our agent; we reasonably believe the provider is subject to privacy laws or terms that give comparable protection to New Zealand's; or the person has been told and agrees. We've signed or accepted data-processing terms with our providers.
Australian law and the US. Australia has its own privacy law. Amazon, Cloudflare, Resend and Stripe are US-owned companies and can be required by US law to give information to US authorities, wherever the data is stored.
6. How long we keep it
| What | How long |
|---|---|
| Attachment copies (working copies of files from Xero) | Default 18 months from approval; the customer can choose shorter. Plus plan: longer. Afterwards we keep the file's name, size and fingerprint (a hash), so certificates still verify. The originals stay in Xero. |
| Approval decisions, comments, certificates (a certificate includes the pages of PDF and image attachments, so those pages are kept with it) | While the customer's organisation is on WorkApproved |
| Audit log | 3 years on Standard; longer on Plus |
| After an organisation is deleted | We delete its data 90 days after the paid period ends, after emailing the account owners 30 days and 7 days before. Its audit rows are kept for a further 12 months, can be read only by WorkApproved support, and are then deleted automatically. |
| Past-bill history for duplicate checking | While duplicate checking is switched on. Deleted if the customer withdraws consent. |
| Public business-register data (NZBN) | The link between a customer's contact and a register record is kept while the customer's organisation is on WorkApproved and deleted with it. The register record itself is public information that we keep once for all customers and refresh from the register. A record that no customer's organisation refers to any more is removed, and all register records are deleted if MBIE ends our access to the register. |
| Billing and tax records | As long as the law requires, currently 7 years in New Zealand |
| Backups | Up to 7 days after a deletion, as old backups expire |
| Emails sent through Resend | Kept by Resend for its own delivery log, currently for up to 30 days |
Other information, such as support emails and internal logs, is kept only as long as we need it.
7. How we protect it
HTTPS everywhere. Xero tokens and two-factor secrets are encrypted by the application. Passwords are never stored, only a one-way hash. Our hosting providers encrypt data at rest. Each organisation's data is kept apart by design, and automated tests check that one organisation can't reach another's. Our staff console needs two-factor authentication and logs everything staff do. Logs strip out personal information and secrets. We check our software for known vulnerabilities on every change. No system is perfect, and we can't guarantee absolute security.
If something goes wrong. If a breach of security is likely to cause serious harm, we'll tell the customers affected and help them tell the people affected, and where we're responsible we'll notify the NZ Privacy Commissioner. We also tell Xero if Xero data is involved.
8. Your rights
You can ask what information we hold about you, and ask us to correct it. For account data, write to [email protected]. We'll answer within 20 working days, and may need to check who you are. For approval data, we'll pass your request to the customer who controls it, because they decide what happens to it.
You can also ask us to delete your account data. We may have to keep some for legal reasons (such as tax records).
Children. WorkApproved is for businesses. People under 13 must not access the site or the service, and we don't knowingly collect information from them. If we learn that we have, we'll delete it.
If you think we've mishandled your information, contact us first. You can also complain to the privacy regulator in your country (see below).
9. Cookies
We use only the cookies needed to run the service: to keep you signed in, protect forms, and remember choices such as language. Cloudflare's bot check and Stripe's payment pages may set their own. We don't use advertising or tracking cookies. Our marketing website uses Cloudflare Web Analytics to count visits. It doesn't use cookies and doesn't track you across other sites. For that reason our website doesn't change what it does when your browser sends a 'Do Not Track' signal.
10. New Zealand
We follow the Privacy Act 2020 and its information privacy principles. In particular: we collect only what we need (principle 1); much approval data reaches us from Xero and the customer rather than from you, so the customer is responsible for telling you (principles 2 and 3); we keep it secure (5); you may ask for access and correction (6 and 7); we don't keep it longer than needed (9); we use and disclose it only for the purposes above (10 and 11); and we send it overseas only as described in section 5 (12). Complaints: Office of the Privacy Commissioner, privacy.org.nz.
11. Australia
If the Australian Privacy Act 1988 applies to us, we'll handle personal information in line with the Australian Privacy Principles, including APP 8 on disclosure overseas (we remain responsible for our providers' handling) and the Notifiable Data Breaches scheme. We follow these principles whether or not the small business exemption would apply to us. Australian customers' data is stored in Sydney. Complaints: Office of the Australian Information Commissioner, oaic.gov.au.
12. United Kingdom and European Union customers
This section explains where UK and EU law may apply.
- If UK or EU law applies. Where it does, the customer is the controller of approval data and we are the processor (Schedule 1 of our Terms of Service), and we are the controller of account and billing data. Our lawful bases for account and billing data are performing our contract, our legitimate interests in running and securing the service, legal obligations such as tax records, and consent where we ask for it.
- Transfers. Your data is held in Australia, processed in New Zealand, and passes to providers in the United States, Japan and elsewhere (section 5). New Zealand has an adequacy decision from the EU and the UK. Australia does not.
- Your rights. You may ask for access, correction, deletion, restriction and portability, and object to processing based on our legitimate interests. For approval data, ask the customer; we'll help. Contact us at [email protected].
- Complaints. To your local supervisory authority (in the UK, the Information Commissioner's Office).
13. Changes
We'll post changes here. For changes that matter, we'll email account administrators at least 30 days ahead.
14. Contact
[email protected]. Security: [email protected]. Stone Pritchard Limited, 2 Navigation Drive, Whitby, Porirua 5024, New Zealand (NZBN 9429053953216).