Privacy Policy
Last updated: 13 October 2026
This policy explains how Simon Beard and Beard Capital ("Beard", "we", "us") handle information when you use the Beard Growth Audit and the Beard Capital Audit app. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Plain English, because you should know exactly what we touch.
What we do
The Growth Audit is a paid review of how your business is performing across sales, finance, retention, products and paid marketing. You connect the accounts you choose. We read the data and use it to prepare your audit brief and recommendations.
What we access
With your permission, and read-only, from the accounts you connect:
- Xero: financial reports, invoices, bills and account summaries.
- Shopify: orders and reports, customers, products and inventory, price rules, marketing events and analytics.
- Stripe: charges, subscriptions, refunds and payout summaries.
- Meta (Facebook) Ads: ad accounts and advertising performance (
ads_read,business_management). - Google Ads: campaign, ad group, keyword, creative and performance reporting via the
https://www.googleapis.com/auth/adwordsscope. We use this scope for reading and reporting only.
We never create, edit, pause or delete anything in your accounts. We never post, change campaigns, move money or place orders for you.
We also collect the contact and billing details you give us (name, business name, email, phone) to deliver and invoice the audit.
How we use it
We use connected-account data only to prepare and deliver your audit brief and to answer your questions about it. We do not use it for advertising, we do not sell it, and we do not share it with data brokers.
Google user data and Limited Use
Beard's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, we use Google Ads data only to provide the audit you asked for. We do not transfer it to others except as needed to provide that service, to comply with law, or as part of a merger or acquisition with notice to you. We do not use it to serve ads. We do not use it to train generalised AI or machine-learning models. No person reads it unless you agree, it is needed for security or legal reasons, or it has been aggregated and anonymised.
Where it is stored and for how long
- Audit data is stored in a private, access-controlled Supabase database and storage bucket. Access is limited to our server, with no public access.
- Raw data pulled from your accounts is deleted automatically on a schedule once your audit is prepared. We keep the summarised metrics and findings that make up your audit so we can deliver it and track results with you.
- Access tokens are encrypted (AES-256-GCM) at rest, kept on the server, and never sent to your browser.
- All data moves over encrypted HTTPS connections.
Benchmarks
We may combine metrics across businesses into aggregated, anonymised benchmarks, for example a typical return on ad spend for a category. A benchmark is only produced when a group contains at least five businesses. Benchmarks never identify you, your customers or your business.
Who we use
We use Cloudflare (hosting), Supabase (database and storage), and Resend (email). These providers process data on our behalf under their own security commitments and may store it outside Australia, including in the United States. We take reasonable steps under APP 8 to make sure they protect it.
Revoking access and deleting your data
- Revoke any time: disconnect us inside the platform (Xero, Shopify, Stripe, Meta or your Google Account permissions), or ask us to do it.
- Request deletion: email [email protected] and we will delete your connected-account data and tokens within 30 days, except records we must keep by law, such as tax invoices.
- Shopify uninstall: when you remove the app, Shopify notifies us and we delete your store connection and token, then again on Shopify's follow-up redaction signal.
- Meta data-deletion requests: if you remove the app in Facebook settings, we verify Meta's signed request, delete your Meta connection and token, and return a confirmation code.
Your rights
Under the APPs you can ask to see or correct the personal information we hold about you. Email [email protected]. If you are unhappy with how we handled a privacy matter, tell us first and we will respond within 30 days. If it is still not resolved, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Changes
If we update this policy, the date above changes. If a change materially affects how we use connected-account data, we will tell you before it applies.
Contact
Simon Beard, Beard Capital, Queensland, Australia. [email protected]