Privacy policy

Effective date: July 1, 2026

Issued: July 1, 2026

Posted is a product of Xero. In this policy, "Posted", "we", "us", and "our" mean Xero, Inc., the Xero group company that provides Posted in the United States. Posted is a bookkeeping and federal tax preparation tool for US sole proprietors who file Schedule C. It works as a Chrome extension that runs alongside Gmail, reads accounting documents in your inbox such as invoices, receipts, and bills, pulls the financial details out of them, and keeps your books, your profit and loss, your Schedule C, and your estimated tax up to date.

This policy covers two things:

• The Posted product, meaning the Chrome extension and the services behind it.

• The Posted marketing website, landing page, and waitlist, including when you give us your email to join the waitlist or to hear from us.

Xero is a global company. Our group headquarters are in New Zealand and we have offices around the world, including in the United States. Posted data is processed and stored in the United States.

If you have a question about Posted or need help, email us at support@posted.ai. If you have a question about privacy or want to exercise a privacy right, contact Xero at legalnotices@xero.com or write to Xero, Inc., 1615 Platte Street, Floor 4, Denver, Colorado 80202, USA.

We collect the following kinds of information.

• Account information. Your name, email address, and the details you give us when you set up and use a Posted account.

• Waitlist and marketing signups. The email address and any other details you give us when you join the waitlist or ask to hear from us before or after launch.

• Email content and attachments accessed through Gmail. When you connect your Google account, Posted reads your Gmail to find accounting documents such as invoices, receipts, and bills, and the attachments that hold them. Posted looks for accounting-relevant messages and documents. It does not set out to collect the rest of your mail.

• Financial data taken from your documents. The figures and details Posted pulls out of those documents, such as amounts, dates, vendors, and categories, which we use to build your books, your profit and loss, your Schedule C, and your estimated tax.

• Payment data through Melio. If you pay or receive money through the Melio integration, we handle the information needed to set up and track those payments.

• Files you store in Google Drive. With your permission, Posted saves invoices, receipts, and CPA-ready packs to your Google Drive using the drive.file access level, which lets Posted see, create, and edit only the specific files you use with Posted.

• Usage and device data. Information about how you use Posted and the device and browser you use, such as IP address, browser type, and the actions you take in the product, which we use to run and improve the service and to keep it secure.

We use your information to:

• Provide the bookkeeping and tax features, including reading accounting documents in Gmail, extracting financial data, keeping your books, and producing your profit and loss, your Schedule C, and your estimated tax.

• Run recurring jobs that keep your books current, such as book health checks and cash flow and tax updates.

• Store invoices, receipts, and CPA-ready packs in your Google Drive when you ask us to.

• Set up and track payments you make or receive through Melio.

• Answer your questions and give you support.

• Keep Posted secure, prevent abuse, and meet our legal obligations.

• Improve Posted's accuracy and features, within the limits described in the section on Google user data below.

• Send marketing messages to waitlist subscribers and other people who have asked to hear from us. Every marketing email has an unsubscribe link, and you can opt out at any time. Opting out of marketing does not stop the messages we need to send to run the service, such as service and security notices.

Google user data

Posted uses Google APIs to read your Gmail and to store files in your Google Drive. This section explains how we handle that data.

• Limited use disclosure. Posted's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• What Gmail data we access. With your consent through Google sign-in, Posted reads your email content and attachments to find and process accounting documents such as invoices, receipts, and bills, and to keep your books and tax figures current.

• What Google Drive data we access. With your consent, Posted stores invoices, receipts, and CPA-ready packs in your Google Drive using the drive.file access level. This lets Posted see, create, and edit only the specific files you use with Posted. It does not give Posted access to everything in your Drive.

How we protect this data.

• We only use your Gmail and Google Drive data to provide and improve the features you see and use in Posted.

• We never sell your Gmail or Google Drive data.

• We never use it for advertising, and we never use it for retargeting or personalized or interest-based advertising.

• We do not let people read your Gmail or Google Drive data, except in these narrow cases: when you have given us your clear agreement to look at specific messages or files, for example to help you with a support issue; when it is necessary for security, such as investigating a bug or abuse; when it is necessary to comply with the law; or when the data has been aggregated and anonymized and is used for internal operations in line with the law.

• We do not transfer your Gmail or Google Drive data to anyone else, except to provide or improve the features you see in Posted with your consent, for security, to comply with the law, or in connection with a merger, acquisition, or sale of assets with your prior consent.

How we use this data with artificial intelligence

Posted uses artificial intelligence models to read your accounting documents and pull out the financial details. That processing happens only to provide the features you see and use in Posted, such as keeping your books, your Schedule C, and your estimated tax current. Posted does not use your Gmail or Google Drive data, or any data derived from it, to train artificial intelligence or machine learning models. We do not retain data obtained through Google APIs to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.

We do not sell your personal information. We share it only in these situations.

• Service providers and subprocessors. We use trusted companies to help us run Posted, such as cloud hosting and storage providers, Melio for bill payments, and providers that help supply Posted's document reading and data extraction features. They may only use your information to provide services to us and must protect it. Any provider that helps supply artificial intelligence or machine learning features acts as our processor and may not use your data to train its own models.

• Legal and safety reasons. We may share information with regulators, law enforcement, courts, or others when we believe it is needed to comply with the law, to enforce our terms, or to protect the rights, property, or safety of you, us, or others.

• Business changes. If Posted or part of Xero is involved in a merger, acquisition, or sale of assets, your information may be part of that transaction, and any transfer of Google user data will follow the rules described in the Google user data section.
  

We keep your information for as long as you have a Posted account and for a period afterward where we have a business or legal reason to keep it, such as tax, audit, or accounting requirements. After that we delete it or anonymize it.

You can:

• Revoke Posted's access to your Google account at any time through your Google account settings. Once you do, Posted stops reading your Gmail and stops storing new files in your Drive.

• Ask us to delete your account and your data by emailing support@posted.ai. We will delete your information unless we are required to keep some of it by law.

Security is a priority for us. We use technical and organizational measures to protect your information, including encryption in transit and at rest. Posted is built on Xero's security practices. You can read more about how Xero protects data on Xero's security pages. No system is perfectly secure, so please help protect your account by keeping your login details private.

You have choices about your information.

• Access and correction. You can ask for a copy of the personal information we hold about you and ask us to correct it if it is wrong or out of date.

• Deletion. You can ask us to delete your personal information.

• Marketing opt-out. You can unsubscribe from marketing emails at any time using the link in the email or by contacting us.

To make a request, email legalnotices@xero.com or support@posted.ai.

State privacy rights. Depending on where you live, state privacy laws such as the California Consumer Privacy Act and similar laws in other states may give you rights to know what personal information we collect, to access or delete it, to correct it, and to opt out of the sale or sharing of personal information or targeted advertising. We do not sell your personal information. To exercise a state privacy right, contact us using the details above, and we will not discriminate against you for doing so.

Posted is a financial product meant for adults. It is not directed at anyone under 18, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from someone under 18, we will delete it.

Xero is a global company with offices and service providers in several countries. Posted data is processed and stored in the United States. If information is transferred between countries, we put safeguards in place to protect it.

We may update this policy from time to time. If we make a material change, we will let you know, usually by email or by posting a notice in the product or on our website. The date at the top shows when the policy was last updated.

For product help: support@posted.ai.

For privacy questions or requests: legalnotices@xero.com, or Xero, Inc., 1615 Platte Street, Floor 4, Denver, Colorado 80202, USA.