Privacy Policy

Last updated: Nov 3, 2026

This policy says what Kestly does with personal information today.

1. Who we are

Kestly ("we", "us", "our") is a mileage logbook, receipts and invoicing service for Australian sole traders. This policy covers our website at https://kestly.com.au, the iPhone and Android apps, and the services behind them.

Kestly is provided by Cave Sight (ABN 48 587 662 266), a sole trader business.

2. Information we collect

Information you give us:

Account — your email address. You sign in with a one-time code we email to you, so we do not hold a password. Signing in with Google and Apple is planned and not yet available; the email one-time code is the only way to sign in today. We will update this policy before those sign-in buttons go live.
Business records you enter — vehicles (make, model, registration, state, odometer readings), trips and their purpose, expenses, and the business and brand details you add to invoices.
Customers on your invoices — the names, email addresses and invoice details you enter. When you send an invoice we email it to the customer address you gave us.
Receipts — photos you take and the details you confirm (supplier, date, amounts, GST, category).
Assistant messages — what you type or say to the language assistant (see section 6).
Payments — paid plans will be sold on our website when they launch. You will enter card details with our payment provider, not with us, and we will keep your plan, its status and a reference to your payment account.
Support — anything you send us when you contact us.

Information collected automatically:

Location and motion signals from your phone while you use trip recording (sections 3 and 4).
Technical logs — our hosting keeps basic request logs such as time, the page or service called, your IP address and error details. We do not write your trips, locations or receipts into our own logs.

3. Location and trip data

Trip recording uses your phone's precise location. To record a drive without you opening the app, Kestly asks for background location ("Always" on iPhone, "Allow all the time" on Android). You can switch Automatic trips off in Settings, and the app then does not record on its own. Android shows a notification while a trip is being recorded.

For each trip we record the start and end time, the route (GPS points with their times), the distance, and the start and end place names. The app also keeps the trip's data-quality flags, for example that part of the route was a straight line or that a stretch faster than road speed was removed.

Where it goes — trips are saved on your phone and synced to your account, including the route points. Account data is stored in Sydney, Australia. Receipt files are stored in Australia (Cloudflare location hint).
Place names — when a trip ends, the app turns the start and end points into a suburb and state. On iPhone the two points are sent to Apple's address service; on Android the address service of the phone's operating system (Google on most Android phones) is used. We keep only the suburb and state, not the street address.
Maps — the route is shown on Apple Maps on iPhone and Google Maps on Android, so those apps request map tiles for the area you are viewing.
Distance — worked out from your GPS data and stored by us.

4. Motion data and vehicle learning

Motion. The apps use the motion and fitness sensors (Motion & Fitness on iPhone, Physical activity on Android) on your phone to tell when you are driving. The raw sensor readings are used on the phone and are not uploaded.

Learning which vehicle is yours. To suggest the right vehicle, the apps can note the car's Bluetooth connection or audio route and, as a test, the Wi-Fi network your phone is joined to while a trip is recorded. The device or network identifier is turned into a scrambled (hashed) code with a random value made on your phone; the name you would recognise stays on your phone as well. These codes and names never leave your phone: they are not synced, exported or written to logs, and they are removed when you delete your account. The Wi-Fi reading is only used to check how well this works and does not decide anything. You can switch the prompts off in Settings.

Microphone. If you speak to the assistant, speech is turned into text on your phone and the audio is never uploaded.

5. Receipts, expenses and AI reading

When you take a photo of a receipt, the original is saved on your phone and uploaded to your account, whether or not you allow AI reading. The original is saved in private storage that only our servers can open, using short-lived links.

A receipt photo is sent to our AI provider, Anthropic, only after you allow AI reading; you are asked before your first receipt is read. Anthropic reads the text on the photo so we can fill in the details for you, and you check them before they are saved. We send the photo and a fixed instruction, and no name, location or other account data.

You can withdraw your agreement in Settings. Receipts you add afterwards are not sent. A receipt you added while you agreed keeps that agreement, so it can still be read after you withdraw, even if it was still waiting to be uploaded or to be read. Receipts that were already read are not changed.
Each plan has a monthly limit of AI reads. A receipt over the limit is saved and read in a later month.
Anthropic processes what we send outside Australia, in the United States or in any other region it chooses. We use its default global setting and have not limited it to one region. Under its commercial terms Anthropic may not train its models on what we send. Anthropic says it deletes this content within 30 days in most cases, and it may keep it longer only in limited cases, for example if its systems flag a breach of its usage policy, or if the law requires it. We do not claim that Anthropic keeps nothing.

6. Language assistant

The assistant turns what you type or say into a draft trip or expense. After you agree, the text of your message, your vehicle names, the draft you are building and the earlier turns of that conversation are sent to Anthropic (section 7). On the web the assistant can also draft an invoice from your words; the customer is matched against your own list on our servers. On our servers we keep only a count of assistant turns per month, not the text of what you said.

7. Who processes your information

We use these service providers to run Kestly. Each handles data under its own terms and privacy policy:

Supabase — Hosts our database and sign-in. Company based in the United States.
Resend — Sends emails such as sign-in codes, and the messages you send us through the contact form. Company based in the United States.
Anthropic — Reads receipt images and assistant messages, only when you use AI receipt reading or the assistant. Company based in the United States; processing happens outside Australia.
Google and Apple sign-in — Planned for launch, not live yet. When you choose to sign in with Google or Apple, that company confirms your identity to us and shares your email address (Apple can hide it behind a private relay address). Companies based in the United States.
Stripe — Will take web payments once web checkout launches (not live yet). Company based in the United States.
Apple and Google (on your phone) — Show maps and turn the start and end of a trip into a suburb name, using the map and address services of your phone's operating system. Companies based in the United States.
Cloudflare — Serves the website and runs our application code. Company based in the United States.

What each one receives:

Sign-in and database — your email address and all the records you sync.
Email — your email address and the content of the email: sign-in codes, account notices, and invoices you send to customers.
AI reading and assistant — only what sections 5 and 6 describe.
Payments (when paid plans launch) — your email address, a reference to your account and the plan you chose. Your card details go straight to the payment provider.
Maps and address lookup — the area you view and the start and end points of a trip, on your phone.
Website and app hosting — every request you make to the service.

We do not sell your personal information, and we do not use advertising trackers.

8. Where your data is stored and sent

Account data is stored in Sydney, Australia. Receipt files are stored in Australia (Cloudflare location hint). A few services outside Australia process some data for us. Each provider in section 7 is based in the United States, and Anthropic works from its own systems, outside Australia, when it reads a receipt or an assistant message. Where a provider processes data is set by that provider's terms.

If you allow AI reading or use the assistant, the photo or text is sent to Anthropic, which processes it outside Australia (see section 5). We send only what is needed: the photo and a fixed instruction, or your message and the draft you are working on. Our contract with Anthropic includes its data processing terms, and we rely on it to protect your information. For people in the EU and the UK, those terms include the standard contractual clauses approved for sending personal data outside those regions. Even so, a company in another country may be asked by its authorities for information, and we cannot control that. We ask for your agreement before the first receipt is read or the first assistant message is sent, and you can withdraw it in Settings. If you would rather not, enter receipts by hand and do not use the assistant; the rest of Kestly keeps working.

9. How long we keep it

GPS route points — until the first anniversary of the trip start. After that the points are deleted from our servers and from your phone. The trip record stays: dates, distance, odometer link, place names and the simplified route used for display.
GPS points that belong to no trip — deleted from your phone after 7 days.
Trip records, vehicles, odometer readings, expenses, invoices — kept while your paid plan runs. After a paid plan lapses we keep them for up to 3 months, viewable and exportable, and remind you to export before they are removed from your account. Files are then deleted from storage, and copies in backups expire as the backups rotate out. Free accounts that stay inactive for 6 months are reminded and then removed in the same way.
Receipt originals — kept on the same schedule as your other records. If you delete a receipt in the app it disappears from your account, but the original file stays in storage until the account's data is removed.
Vehicle-learning codes and names — on your phone only, until you delete the account or the app.
Sign-in and email logs — kept by our providers under their own retention rules.

The Australian Taxation Office expects you to keep your own business records for 5 years (ATO record keeping rules, checked 31 Oct 2026). That duty is yours, not ours, so export your data before you delete your account or let a plan lapse.

10. Deleting your account

You can delete your account on the web at /account (both apps also have it in Settings). Your account is scheduled for deletion in 30 days and you are signed out on all your devices. During those 30 days you can sign in again and choose "Restore my account". After 30 days a daily job deletes your trips and GPS tracks, vehicles, odometer readings, receipts and receipt images, expenses and AI-read results, sync history, and your sign-in account and profile. Database backups kept by our hosting provider are deleted when they rotate out, and are not restored into the live service. See how deleting your account works.

To get a copy of your data first, sign in at /account and choose "Export all my data": a zip file with your records as CSV files and your receipt originals.

11. Teams

Teams lets a business add staff who record trips under one team. This is the rule that decides what the team Owner and Admins can see:

Trips a member has marked as business are visible to the Owner and Admins.
Private trips are never shown to them.
Trips that have not been classified yet are visible only to the member who recorded them.
Private kilometre totals can be shown without trip details.

Because the member classifies each trip, the member controls what the employer sees. Kestly still records and stores the member's location data whatever the classification.

12. Website analytics

Our website is served through Cloudflare, and we use Cloudflare Web Analytics on it. Its script reads page-load timing from your browser and sends it to Cloudflare, so we can see page views and speed. According to Cloudflare, it does not use cookies or local storage, it does not follow individual visitors across sites or over time, and it removes IP addresses at the edge of its network before the figures reach its core systems. Like any website served through Cloudflare, our pages are delivered through its servers, which receive your IP address when your browser asks for a page. Cloudflare keeps the detailed figures for 7 days and then keeps summarised figures; we can look at the previous six months. We do not use advertising scripts and we have not added any other analytics tool. We do not put analytics or advertising tools in the iPhone and Android apps.

13. Cookies and similar technologies

We use only what is needed to run the service:

Sign-in cookie — when you sign in on the web, our sign-in provider (Supabase) sets a cookie whose name starts with sb- and ends with -auth-token (long values may be split into numbered parts). It keeps you signed in. It can last up to 400 days, and it is removed when you sign out.
Bot check on forms — the sign-in, contact and waitlist forms use Cloudflare Turnstile to tell people from bots. Turnstile checks signals from your browser, such as your IP address, browser type and connection details, and Cloudflare says it cannot use them to identify you. Cloudflare does not say in its documentation whether Turnstile keeps anything in your browser, other than an optional cookie for a feature we do not use. Cloudflare's Turnstile privacy addendum applies.
A saved choice — the web app remembers in your browser's local storage (key stb.invoice-branding-prompt-dismissed) that you closed the invoice branding prompt. It stays on your device.
Analytics — Cloudflare Web Analytics (section 12) sets no cookies, according to Cloudflare.
Payments — when you pay on the web, you pay on a page hosted by Stripe, and Stripe sets its own cookies there, under its own policy.
No advertising or cross-site tracking cookies. We do not use them.

We will update this section before we add any new analytics or other tool that uses cookies or similar technologies. We do not use advertising or tracking cookies. The sign-in cookie and the bot check are there to keep you signed in and to protect our forms, so we do not show a cookie banner. If we add anything that needs your consent, we will ask first.

14. Security

Data between your device and our servers is encrypted with HTTPS (TLS). Receipt files sit in private storage that has no direct public access. Access to records is limited by organisation and by role. No system is completely secure, so we cannot guarantee absolute security.

15. Your rights and choices

You can:

see and export your data, from /account on the web;
correct your records in the app or on the web;
delete your account (section 10);
stop location recording by switching Automatic trips off or removing the location permission in your phone's settings;
withdraw your agreement to AI reading in Settings.

To ask for anything else, including a copy of the personal information we hold about you, email hello@kestly.com.au.

16. Children

Kestly is a business tool and is not intended for children. We do not knowingly collect personal information from children. If you think we have, please contact us and we will look into it and delete the account if we confirm it.

17. Changes to this policy

We may update this policy. We will post the new version at https://kestly.com.au and change the date.

18. Contact and complaints

If you write to us through the contact form, we use your name, email address and message only to reply to you and keep a record of the conversation. The form is sent by email through Resend.

Questions or requests: hello@kestly.com.au.

Kestly is run by a small business. The Privacy Act 1988 does not apply to every small business, and we do not rely on that. We handle your personal information as this policy describes, whether or not the Act applies to us.

If you have a privacy question or complaint, email hello@kestly.com.au. Please tell us first so we can try to fix it. We aim to reply within 30 days. If you do not hear from us in 30 days, or you are not happy with our reply, you can complain to the Office of the Australian Information Commissioner (OAIC). A complaint must be in writing. You can use the OAIC's online form at webform.oaic.gov.au, email oaicintake@oaic.gov.au, or post it to GPO Box 5288, Sydney NSW 2001. The OAIC's enquiries line is 1300 363 992 (Monday to Thursday, 10 am to 4 pm). The OAIC can only deal with a complaint if the Privacy Act applies to us. Details: OAIC, lodge a privacy complaint (checked 1 Nov 2026).

If you are in the EU or the UK, you can also complain to the data protection authority in the country where you live or work. In the UK this is the Information Commissioner's Office (ico.org.uk). For the EU, the European Data Protection Board lists each country's authority at edpb.europa.eu.

19. Waitlist

If you join the waitlist on our website, we collect your email address and nothing else. We first email you a confirmation link and add you to our email list only after you click it. The waitlist uses the same list as our newsletter, so we may send you news about Kestly, including a message when it opens. Every message has an unsubscribe link. We keep your address until you unsubscribe or we close the list. The confirmation email and the messages are sent through Resend, and the form uses Cloudflare Turnstile to tell people from bots (section 13).

20. If you are in the EU or the UK

We use your personal information on these grounds. To give you the service you signed up for (your account, trips, receipts, invoices, payments): because it is needed to carry out our contract with you. To keep the service secure and to protect our forms from bots: because we have a legitimate interest in doing so. To read a receipt or an assistant message with AI, and to record trips in the background: because you agree, in the app, and you can withdraw that agreement.

Your account data is stored in Sydney, Australia, your receipt files are stored in Australia (Cloudflare location hint), and our providers (Supabase, Cloudflare, Resend, Stripe and Anthropic) may process your information in the United States and other countries. Where the law requires it, we rely on the standard contractual clauses approved for the EU and UK that are part of our providers' data processing terms, and on the providers' certification under the EU-US Data Privacy Framework where they have one. You can ask us for details by email.

You also have the right to ask us to restrict how we use your information, to object to uses based on our legitimate interests, and to receive your data in a common format (the export on your account page does this). To use any of these rights, email us. We will reply within one month.