What we hold, and why.

Effective 2 September 2026

1. 01Who we are and what this covers

   Ledger Map is operated by Northstack LLC. This policy covers the Ledger Map website and application at ledgermap.tech, and the practice, bookkeeper, and payment data the service handles on a practice's behalf.

   Ledger Map helps allied health practices and their bookkeepers map practice management and payment data into accounting records, reconcile deposits, review questions, and process remittance files. The practice decides which people may use its workspace and which connected systems provide data.

2. 02Information we handle

   Depending on the features a practice turns on, we can handle:

   • Practice names, user names, roles, and sign-in email addresses.
   • Xero, Zanda, and Stripe connection details, stored as encrypted credentials.
   • Client and payer names, vendor ids, invoice references, service items, dates, amounts, payment status, and reconciliation results.
   • Remittance files and bank files you upload or forward to your practice's drop zone address.
   • Configuration, questions, approvals, audit events, and service diagnostics.

3. 03What we do not need

   Ledger Map does not need clinical notes, diagnoses, referral detail, dates of birth, Medicare numbers, DVA numbers, or NDIS participant numbers in its accounting records, and the database rejects those fields where it can check for them. A remittance or report you send us can still contain one of those values while the original file is kept. We treat the file as restricted source material and keep it only for the retention period described below.

4. 04Why we handle it

   We use the information to:

   • Connect and synchronise the systems the practice has selected.
   • Prepare accounting proposals and carry out the writes the practice has approved.
   • Match remittances, payments, and bank deposits.
   • Show questions, activity, and audit history to the people the practice authorises.
   • Secure, operate, troubleshoot, and improve the service.
   • Send the service messages the practice has chosen, such as invitations, daily summaries, and connection alerts.

5. 05Document reading and AI

   Known document layouts are read by deterministic parsers that send nothing outside our systems. For an unfamiliar text document, we remove common direct identifiers and sensitive labels before any request to a model provider, check the result for residual sensitive content, and stop rather than send it if the check fails. Model output has to match a fixed schema and is shown to a person for review before anything is recorded.

   Images and PDFs can contain information that text redaction cannot remove. Sending visual content to a model is off by default and only happens if a practice turns that setting on. Each such event is recorded in the practice's audit history.

   Data obtained from Xero is not used to train or fine-tune an AI model.

6. 06Where information is stored

   Practice records, financial data, connector state, and dropped files are stored in Supabase's Sydney region. Sign-in identity and browser sessions are handled by Clerk in the United States, so a user's name, sign-in email, and session are held there. The web application runs on Vercel and the background worker on Render. When a related feature is used, connected data also moves to Xero, Zanda, Stripe, Resend, and the model provider.

   Provider support, routing, logging, and backup systems can involve other regions. The data location page lists each provider and what it sees.

7. 07Who else sees it

   Information is shared with:

   • People the practice has authorised in its workspace.
   • Connected providers, when the practice enables a connector or approves a write.
   • The hosting, storage, email, error reporting, and model providers needed to operate the features the practice uses.
   • Advisers or authorities where a lawful and appropriately scoped request applies.

8. 08We do not sell practice data

   Northstack LLC does not sell practice data and does not use it for advertising. We use aggregate, non-identifying measures of how the service is used to improve it.

9. 09Security

   Every practice's records are separated by row level security in the database. Background work runs under a constrained database role. Connector credentials are encrypted at rest with keys held outside the database. Text is redacted before any model request. Uploaded files carry a retention date. Changes to configuration, connections, approvals, and go-live decisions are recorded in an audit history the practice can read.

   Security also depends on how a practice manages access to its own accounts and devices. Please give access only to the people who need it and tell us promptly if you suspect unauthorised access.

10. 10Retention and deletion

    Uploaded and forwarded files are kept for 90 days by default. A practice can shorten or lengthen that within the supported range, and a nightly job deletes files past their date and records that it did so.

    Disconnecting a connector revokes our access at the provider and marks the connection as disconnected. Records we already hold for the practice stay until the practice asks for them to be removed.

    Self-serve export and deletion are not yet built into the product. During the pilot period, export and deletion are carried out by hand on request, on a turnaround agreed with the practice in writing, and the completion is recorded.

    Copies kept in Xero, Zanda, Stripe, a mailbox, or another provider follow that provider's relationship with the practice. Some accounting records can need to be kept under Australian tax and corporations law.

11. 11Your requests

    A practice can ask for an export, a correction, or the deletion of the data we hold for it by emailing shane@cleverops.com.au. We will verify the requester and work with the practice's administrator. Individuals whose information appears in a practice's records should contact the practice first, as the practice controls those records; we help the practice respond.

    If you believe we have handled information in a way that breaches the Australian Privacy Principles, email us at shane@cleverops.com.au and we will respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner.

12. 12Changes and contact

    When this policy changes in a material way we will tell practices through the product or their nominated contact, and this page will show the new effective date.

    Ledger Map is operated by Northstack LLC. Contact: Shane, shane@cleverops.com.au.