How I handle your data.

We have a conversation first, and you decide what to send. If you want an NDA in place before a single file moves, say so and I will sign yours or send you mine that day.

I will tell you exactly which files I need and why each one is on the list. If you would rather not send one of them, tell me. I would rather work with less and tell you what I could not check than have you hand over something you are uncomfortable about.

If your payroll system can export with names replaced by initials or staff numbers, do that. I do not need to know who anyone is to find an over-rostered shift.

You email them to me at hello@getleak.com.au, or we get on a call and I walk you through exporting them while you share your screen. There is nothing to install and no account to create.

For a short time your files sit in my email inbox, because that is what an email attachment does. Once I have moved them into the audit workspace, I delete the email and empty it from my deleted items so the only copy is the one in Australia.

Your files go into a storage area set aside for your business, inside a Supabase project hosted in the Sydney region. Your data sits in Australia. Every business is kept separate: your files are never mixed into a shared pool with anyone else’s.

They travel there over an encrypted connection. Access is limited to my own account, and I am the only person who holds it. There is no shared login, and nobody else has a key to hand out.

I run your files through the analysis tool I built for my own cafés. It reads every sales line, every shift and every invoice line, and compares them against your own targets and your own trading history rather than against some industry average.

Most supplier invoices are read automatically to lift out four things: the supplier, the date, the invoice number and the total. When a PDF is too messy for that, I may send a cut-down extract to an external AI service to read the header. Before anything leaves, bank and account numbers, email addresses, phone numbers and tax file numbers are stripped out, and only the handful of lines needed to identify the invoice is sent. If you would rather I never do that, tell me and I will key those invoices in by hand.

Nothing you send me is used to train an AI model, and nothing you send me is used to build anything for anyone else.

This is the part I will not shortcut. Every flag the tool raises, I read personally. I throw out the ones that are technically true and practically useless. I check the ones that survive against what I know about running a café on a Saturday.

It is me doing this, at my desk, on your numbers. Not a reviewer, not a contractor, not a model writing your report.

I write the audit in plain English, price every finding with the working shown, and rank the roadmap by what pays back fastest. It is delivered within 5 business days of receiving your complete files, and then we spend 90 minutes going through it together.

You get the finished document. You can send it to your accountant, your business partner, your manager or your bank. It is yours.

Once your audit is with you:

• Your raw files stay in your workspace in Sydney for twelve months, so that if you ring me in month nine I can answer from your actual numbers instead of my memory.
• At twelve months I delete the raw files: the POS exports, the payroll and rostering exports, the invoices, the menus.
• I keep your audit document and my invoice to you for seven years, because the ATO requires me to keep business records that long.
• If you want the raw files gone before then, email me and they go. Same day if I am at my desk, within five business days at the outside, and I confirm in writing what was deleted.

My hosting provider takes automatic backups, so a deleted file can linger inside a backup for a short window before that backup ages out on its own. I cannot reach into a backup and pull a single file out, and I am not going to claim I can.

• I am the only person with access to your files. Not a team, not a contractor, not an offshore analyst.
• Your files are stored in Australia, in Sydney.
• I do not share them with any third party. Not another client, not a supplier, not a competitor, not your landlord.
• I never publish your numbers without your written permission. No Instagram screenshots, no case study, no anonymous example, unless you have said yes in writing.

I would rather be believed than impressive, so here is what I am not claiming. Leak has no ISO certification and no SOC 2 report. I have not had a third party audit my security. I am one person being careful with good tools, hosted in Australia, with a short list of people who can see your files that has exactly one name on it.

If you need a vendor with a certification wall, I am not that vendor yet, and I will tell you so on the phone.

If you want to know where a specific file is, who has touched it, or whether I still hold something, email me at hello@getleak.com.au and I will tell you straight.

The formal version of all this is on the privacy page, including my decision to hold myself to the Australian Privacy Principles, and the audit itself is covered by the terms.