What I do with your data
Never Miss an Invoice reads a Xero file and looks for work that was done and never invoiced. That means connecting it to a real accounting file, sometimes a client's, so the honest thing is to say plainly what happens to that data before anybody is asked to hand it over.
Every claim below is enforced in code, and where it is, the file that enforces it is named. Claims nobody can check are worth nothing on a document like this.
Last updated: 2026-07-28. Bolt On Ops is a trading name of Stribley Ventures Pty Ltd, ABN 51 697 053 633, Woodend, Victoria.
What I read
Four collections, and nothing else:
- Contacts, including archived ones (an archived contact is how I know a customer left, which stops me telling you a departed client owes you money)
- Invoices, including drafts and their line items
- Repeating invoice templates
- Quotes, accepted only
What I cannot do
The connection is read only. I request four read scopes from Xero and no others. I cannot create, edit, send, void or delete anything in your file, and this is not a policy I am promising to follow, it is the limit of what Xero will let the connection do. You can see the scopes on the Xero consent screen before you approve, and revoke them from your Xero account at any time without asking me.
No bank feeds. No payroll. No employee data. Not requested, not accessible.
Where it lives
Australia. The database is in Sydney (ap-southeast-2). Your client's financial data does not leave the country.
Who can see it
- You, and anyone you have added to your account. Nobody else.
- Not other customers. Isolation is enforced by the database itself, not by application code remembering to check. Every table denies access by default and grants it only through account membership. This is tested against the live database rather than asserted:
scripts/verify-rls.mjsdrives it with two real accounts and proves one cannot read the other's findings even when handed the exact record id. - Me, only when you ask. I have administrative access to the infrastructure, as any operator does. Support access is not routine and I will tell you if it happens.
Your Xero credentials
The token that lets me read your file is encrypted before it is stored, with a key held outside the database. A copy of the database on its own is useless against your Xero.
No part of the application can read a credential except the process that refreshes it. This is structural: the credentials table has no access policy at all, so every ordinary request, including yours, is refused. scripts/verify-rls.mjs asserts that even the account that owns a connection cannot read its own stored token.
The audit trail
Every read, every scan, every dismissal is recorded, including the automatic ones. You can see all of it in the app.
You cannot edit it, and neither can I through the application. The audit table is writable only by the system process, so a log you could alter is not a log worth showing you.
It records that a book was read, never what was in it: no finding contents, no contact names, no amounts. A verbose audit trail would just be a second copy of your data with weaker protection around it.
Stopping
Two separate things, deliberately:
- Disconnect revokes the Xero connection and deletes the stored credential. Your findings history stays, because disconnecting is not the same as asking to be forgotten and I should not destroy your record of what was recovered without being asked.
- Delete everything removes the connection, every finding and the entire run history for that organisation. It cannot be undone. The audit entry recording the deletion survives, because a deletion nobody can see afterwards is indistinguishable from one that never happened.
Both are self-serve in the app. Neither requires emailing me.
What I will not do
- I will not sell, share or licence your data, or your clients', to anyone.
- I will not train anything on it.
- I will not use one customer's book as an example to another, named or anonymised.
What this cannot tell you
Stated because a tool that hides its limits is one you find out about later:
- I only see what is in the accounting file. A job that never made it into the system at all is invisible to me.
- A customer who stopped being a customer but was never archived in Xero looks identical to one who is still live. I cannot tell those apart from the ledger, and I will not guess.
- Every figure is ex GST, taken from the invoice itself.
- Estimates are labelled as estimates, always, and are never added to the figures I state as fact.
Breach
If customer data is exposed, I will tell every affected account within 72 hours of knowing, with what happened, what was reached and what I have done. Notifiable breaches also go to the OAIC as the Privacy Act requires.
Asking
brad@boltonops.com. A person, not a ticket queue.