PRIVACY POLICY

Effective Date: 01/08/2026

Last Updated: 01/08/2026

YadYap Pty Ltd (ABN: 67 634 645 677 / ACN: 634 645 677) ("YadYap", "Company", "we", "us", or "our") operates the FastPay application, website, and related services (collectively, the "Service"). We are committed to protecting the privacy and confidentiality of your personal information and financial data.

This Privacy Policy explains how we collect, use, disclose, store, and protect your information when you access or use FastPay. It is designed to comply with:

• The Australian Privacy Principles (APPs) set out in the Privacy Act 1988 (Cth).
• The General Data Protection Regulation (GDPR) (EU) 2016/679 for users located in the European Union (EU) or European Economic Area (EEA).

1. Data Controller and Contact Information

Under the GDPR, YadYap Pty Ltd acts as the Data Controller for personal data collected directly from users of our website and Service. When processing transaction data synchronized via FastPay between Stripe and QuickBooks on behalf of our business subscribers, YadYap acts as a Data Processor.

Contact Details:

• Full Entity Name: YadYap Pty Ltd
• ABN: 67 634 645 677
• Email: support@yadyap.com.au
• Postal Address: PO Box 11098, Centenary Heights Queensland 4350

2. Information We Collect

We collect information necessary to provide, maintain, and secure FastPay.

A. Information You Provide Directly

• Account Information: Name, email address, phone number, company name, billing address, and account credentials when registering for FastPay.
• Support Communications: Any details or attachments provided when contacting customer support or submitting feedback.

B. Connected Service Data (Stripe & QuickBooks)

• To perform automated financial synchronization, FastPay connects to your Stripe and QuickBooks accounts via API tokens and OAuth protocols. When connected, FastPay reads and processes:
• Stripe Data: Transaction metadata, customer names/emails, invoice line items, gross/net amounts, processing fees, payout schedules, tax mappings, and multi-currency exchange data.
• QuickBooks Data: Chart of accounts, general ledger entries, customer mapping profiles, tax code rules, and bank feed connection status.
• Important: FastPay does not collect, store, or process raw credit card numbers, CVVs, or sensitive payment credentials. Payment processing is handled exclusively by Stripe.

C. Automatically Collected Technical Data

• Log files, IP addresses, browser types, device identifiers, operating systems, session durations, and error logs created when using FastPay.

3. Legal Basis for Processing (GDPR Compliance)

• If you are located in the European Union, UK, or EEA, we process your personal data under the following legal bases pursuant to Article 6 of the GDPR:
• Performance of a Contract: Processing required to fulfill our obligations under our End-User License Agreement (EULA) or Terms of Service (e.g., synchronizing Stripe and QuickBooks data).
• Legitimate Interests: Processing necessary for our business interests, such as securing FastPay, improving platform performance, preventing fraud, and delivering customer support.
• Legal Obligation: Processing required to comply with applicable tax, financial reporting, and statutory obligations.
• Consent: Where explicit consent has been provided (e.g., opting into marketing communications).

4. How We Use Your Information

• We use the collected information for the following specific purposes:
• Core Service Delivery: Synchronizing transactions, payouts, fees, and customer data seamlessly between Stripe and QuickBooks.
• Account Management: Authenticating access, managing subscriptions, and handling billing inquiries.
• System Optimization: Monitoring sync status, identifying integration errors, and resolving software bugs.
• Security & Fraud Prevention: Detecting unauthorized API usage, enforcing system access controls, and preventing security breaches.
• Communication: Sending essential transaction alerts, maintenance notices, security updates, and service announcements.

5. Disclosure of Information to Third Parties

YadYap Pty Ltd does not sell, rent, or trade your personal data or financial records. We disclose data only in the following controlled circumstances:

6. International Data Transfers

As an Australian entity, YadYap Pty Ltd may store or process personal data on secure servers located in Australia, the United States, or other regions where our cloud service providers operate.

• Australian Privacy Principle 8: Where data is transferred overseas, we take reasonable steps to ensure the recipient handles your personal information in accordance with Australian privacy standards.
• GDPR Standard Contractual Clauses (SCCs): For transfers of personal data outside the EEA to countries not deemed to offer an adequate level of data protection, YadYap relies on approved Standard Contractual Clauses or equivalent transfer mechanisms.

7. Data Security and Retention

• Data Security: We employ industry-standard administrative, physical, and technical measures, including SSL/TLS encryption for data in transit and AES-256 encryption for sensitive stored tokens.
• Data Retention: We retain your account information for as long as your FastPay account remains active. Transaction log data synchronized via FastPay is retained only as long as necessary to ensure reconciliation integrity, comply with Australian tax and statutory requirements, or resolve disputes.
• Data Deletion: Upon account cancellation or written request, API connection tokens are revoked immediately, and associated system access credentials are purged from our active databases.

8. Your Privacy Rights

A. Rights under the Australian Privacy Act (APPs)

• Access & Correction: You have the right to request access to the personal information we hold about you and to request corrections if it is inaccurate, out of date, or incomplete.
• Complaints: You may submit a privacy complaint directly to us (see Section 11).

B. Rights under the GDPR (EU/EEA Residents)

• Subject to applicable legal constraints, EU/EEA users hold the following rights:
• Right of Access & Data Portability: Request a copy of your personal data in a structured, commonly used format.
• Right to Erasure ("Right to be Forgotten"): Request deletion of personal data where processing is no longer necessary.
• Right to Restrict or Object: Restrict or object to specific processing activities, including automated profiling or direct marketing.
• Right to Withdraw Consent: Withdraw previously granted consent at any time without affecting lawful processing conducted prior to withdrawal.

To exercise any of these rights, please contact our Privacy Officer at support@yadyap.com.au

9. Cookies and Analytics

We use essential cookies and similar tracking technologies on our website and web portal to maintain session state, authenticate users, and gather aggregate usage statistics. You can control cookie settings through your browser preferences, though disabling essential cookies may impact FastPay’s portal functionality.

10. Direct Marketing

We do not send direct marketing communications unless you have opted in or where permitted by applicable law (such as the Spam Act 2003 (Cth)). You may opt out of promotional emails at any time by clicking the "Unsubscribe" link included in any marketing email or by updating your account preferences.

11. Complaints and Regulatory Recourse

If you believe YadYap Pty Ltd has breached its privacy obligations under Australian law or the GDPR, please contact us first so we can investigate and resolve your concern:

• Email: support@yadyap.com.au

If you are unsatisfied with our response, you may escalate your complaint to the relevant regulatory authority:

Australia: Office of the Australian Information Commissioner (OAIC)

Website: www.oaic.gov.au | Phone: 1300 363 992

European Union: You have the right to lodge a complaint with the Data Protection Authority (DPA) in your local EU Member State.

12. Changes to this Privacy Policy

YadYap Pty Ltd reserves the right to amend this Privacy Policy at any time. We will notify you of material changes by posting the updated policy on our website and updating the "Last Updated" date at the top of this document. Continued use of FastPay following notice constitutes acceptance of the revised policy.