Last updated: 28 May 2026 · Governed by Australian law (Privacy Act 1988).
Vaulco is operated by John Antony, a sole trader registered in Australia (ABN 67 154 348 185), based in Melbourne, Victoria. Throughout this policy “we” and “us” refer to that entity. Contact: hello@vaulco.com.au.
Vaulco is a mobile-first finance and operations app for Australian sole traders and small businesses. Vaulco is an ATO-registered Digital Service Provider (Indirect Connect category) for Single Touch Payroll (STP) Phase 2 lodgement.
Privacy Officer: John Antony, founder. Reach: hello@vaulco.com.au.
When you create an account and use Vaulco, we collect:
We collect only what we need to deliver the product. We do not buy data about you from third parties.
When you use STP lodgement in Vaulco, you may enter Tax File Numbers for your employees so we can lodge to the ATO on your behalf. We treat TFNs under the strict requirements of the Privacy (Tax File Number) Rule 2015:
Note: TFN values embedded inside an STP pay event that has already been lodged form part of the immutable lodgement record and are retained encrypted for the 7-year ATO record-keeping period. Outside that lodgement record, your TFNs are deleted within 30 days of cancellation or on direct request.
We never sell your data. We never share your financial data with third parties for advertising. We never train AI models on your data. AI features (Aurum) call third-party large-language-model APIs at the moment of request, then discard the prompt; no model training contract.
All Vaulco application data is stored on servers located in Sydney, Australia:
All data is encrypted at rest using AES-256 and in transit using TLS 1.3. Daily automated backups are retained for 30 days.
Some operational services — outbound email (Resend, EU / US), inbound email parsing (CloudMailin, UK / EU), and AI inference (Anthropic, US; OpenAI, US) — process specific transient data outside Australia. None of these process STP, TFN, or payroll data; all are bound by Data Processing Agreements that prohibit secondary use of customer data.
We use the following sub-processors to deliver Vaulco. Each is contractually required to handle your data only as instructed by us.
A current list of sub-processors is also published at vaulco.com.au/security/subprocessors.
While your account is active, we retain your data so the product works. If you delete your account, all associated data is purged within 30 days, with the following exceptions required by law:
If we suffer a security incident that meets the Notifiable Data Breach threshold under Part IIIC of the Privacy Act 1988, we will:
Our full incident-response procedure is maintained internally as part of our ATO Operational Security Framework evidence pack and is available to regulators on request.
Under the Privacy Act 1988 and the Australian Privacy Principles, you have the right to:
We respond to written requests within 30 days as required by APP 12.
We use essential cookies only — authentication session, theme preference, and onboarding state. We do not use tracking cookies, advertising cookies, or third-party analytics that track you across sites.
Our security posture, sub-processor list, and incident response process are published at vaulco.com.au/security. Suspected vulnerabilities can be reported to security@vaulco.com.au.
Vaulco is for businesses, not consumers. You must be 18 or older and authorised to act for a business. We do not knowingly collect data from anyone under 18.
We may update this policy as our product changes. Material changes (new sub-processors, new data types collected, changes to retention) are notified at least 14 daysin advance via email to the address on your account, with the previous version archived and linked from this page.
Privacy questions, access requests, or complaints:
Email: hello@vaulco.com.au
Security: security@vaulco.com.au
Postal: available on request — email first
Vaulco is operated by John Antony (sole trader) · ABN 67 154 348 185 · Melbourne VIC.