Privacy.

Leak is me: Mel Cox. I run it from Perth, Western Australia. There is no team, no offshore contractor and no junior analyst. If you email Leak, I read the email. If you send Leak a payroll export, I am the person who opens it.

You can reach me any time at hello@getleak.com.au. Privacy questions, access requests and deletion requests all come to the same inbox, and they come to me.

As at 30 July 2026, most Australian businesses turning over less than $3 million a year are exempt from the Privacy Act 1988. Leak is under that threshold, so on paper the Act does not apply to me. The second tranche of the Government’s privacy reform is expected across 2026 and 2027, and is widely expected to remove that exemption with a transition period.

I am not going to sit behind the exemption in the meantime. I hold other people’s payroll. Telling a café owner “the Privacy Act does not apply to me” would be an honest sentence and a useless one.

So I have chosen to be treated as an organisation covered by the Act. That is the opt-in available under section 6EA of the Privacy Act, and I intend to be bound by the thirteen Australian Privacy Principles as if the exemption did not exist. In practice that means you can hold me to the same standard as a large business: tell me what you want done with your information, and I have to do it.

Only what an audit actually needs. Usually this:

• Your contact details. Name, business name, email, phone if you give it to me, and whatever you tell me about your business in the enquiry form or on a call.
• POS sales exports. Item level sales out of Square, Lightspeed or whatever you run. Usually about three months.
• Payroll and rostering exports. Wage summaries, timesheets and rosters. This is the sensitive one, and there is more on it below.
• Supplier invoices. PDFs or photos, as they came from the supplier.
• Menus, recipes and costings. Whatever you have, even if it is a photo of a whiteboard.
• My notes from our conversations. What you told me about the business, so I do not have to ask twice.

I do not ask for bank logins, accounting software logins, customer lists or anything about your customers. If a file you send me happens to contain something I do not need, I do not use it and I do not keep a copy of it beyond the file itself.

A wage report is other people’s personal information, not just yours. It usually carries names, hours worked, pay rates, and sometimes employee numbers or superannuation details. Your staff did not choose to send it to me, so I treat it as the most sensitive thing you will ever hand over.

If your system can export with names replaced by initials or staff numbers, please do that. I do not need to know who anyone is to see that a Saturday is over-rostered by four hours. Ask me and I will show you how to pull it that way from most of the common systems.

I never contact your staff. I never use anything in a payroll file for anything other than your audit.

To find the money leaking out of your business, price it, write it up, and talk you through it. That is the entire purpose.

I use your contact details to reply to you, send you your audit, and send you an invoice. I do not build a marketing profile on you, I do not sell leads, and I do not add you to a list you did not ask for. If I ever want to use your business as an example in a case study, I will ask you in writing first, and you can say no without it affecting anything.

Me. That is the whole list. No staff, no contractors, no offshore analysts, no interns.

Your information is never:

• sold, rented or traded to anyone, for any amount
• shared with another client, another café, or anyone in your market
• shared with your suppliers, your landlord, your accountant or your bank unless you ask me in writing to talk to them
• used to train an artificial intelligence model
• published, quoted or put on Instagram without your written permission, and that includes screenshots with the numbers still readable

If I am ever legally compelled to hand something over, for example by a court order, I will tell you unless I am prohibited from telling you.

Your files and the working behind your audit live in a Supabase project hosted in the Sydney region, which means the data sits in Australia. The Leak website and application run on Vercel, which serves pages from servers around the world, so a request you make to the site may be handled outside Australia even though your files stay in Sydney.

Email reaches me through my email provider. If you email me a payroll export, a copy of it sits in my inbox until I move it and delete the email, which I do once I have the file where it belongs.

Some supplier invoice PDFs are read automatically to pull out the supplier, the date, the invoice number and the total. When a PDF is too messy for that, I may send a cut-down extract to an external AI service to read the header for me. Before anything goes, bank and account numbers, email addresses, phone numbers and tax file numbers are stripped out, and only the few lines needed to identify the invoice are sent. It is minimisation, not anonymity: an invoice header still names your supplier. If you would rather I never do that, say so and I will type those invoices in by hand instead.

There are no advertising trackers or analytics pixels on this site. No Google Analytics, no Facebook pixel, nothing following you around after you leave.

I keep your raw files for twelve months after I deliver your audit, so that if you ring me in month nine with a question I can actually answer it from your numbers rather than my memory. Then I delete them.

I keep your finished audit document and my invoice to you for seven years, because the ATO requires me to keep business records for that long. If you want the raw files gone earlier than twelve months, say the word and they go, the same day if I am at my desk.

My hosting provider takes automatic backups. That means a deleted file can sit inside a backup for a short window after I have deleted the live copy, until that backup ages out on its own. I cannot reach into those backups to pull a single file out, and I am not going to pretend otherwise.

Email me at hello@getleak.com.au and ask. You do not need a reason and you do not need to explain yourself.

• Deletion: I will acknowledge within one business day and have it done within five, then confirm in writing what was deleted.
• A copy: ask and I will send you everything I hold about you and your business, in whatever format is most useful to you.
• A correction: if something I hold about you is wrong, tell me and I will fix it.

The only thing I will hold back from a deletion request is the audit document and the invoice, for the seven year record-keeping reason above. I will tell you that is what I am doing rather than quietly keeping it.

If your information is exposed or accessed by someone who should not have it, and it could cause you or your staff serious harm, I will tell you promptly and in plain language: what happened, what was in it, what I have done, and what I think you should do. I will also notify the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme requires it.

I will not sit on it while I work out how to word it nicely. You would hear from me the same day I understood what had happened.

Come to me first. Email me, tell me what I have done, and give me a chance to fix it. I will reply within five business days and tell you what I am doing about it.

If I do not fix it, or you are not happy with my answer, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992. Because I have opted in to being covered by the Privacy Act, that avenue is genuinely open to you. That is the point of opting in.

If I change how I handle your information, I will change this page and move the date at the top. If the change is significant and you are a current client, I will email you rather than making you notice it.

There are two companion pages worth reading: how I handle your data walks through the exact journey your file takes, and the terms cover the audit itself.