Privacy Policy

1. About this Agreement

This Practitioner Agreement ('Agreement') is between Sampath & Lo Pty Ltd (ABN 50 686 720 016) trading as Safra ('Safra', 'we', 'us', 'our') and you, the practitioner ('Practitioner', 'you', 'your') who accesses the Safra platform to deliver financial services to your clients.

By clicking 'I agree' or otherwise accepting this Agreement within the Safra application, you agree to be bound by its terms. Your acceptance is recorded electronically with a timestamp, version number, and account identifier.

This Agreement should be read alongside Safra's Terms of Use, which applies to the platform generally. Where this Agreement and the Terms of Use conflict on matters specific to practitioners, this Agreement takes precedence.

This Agreement, together with the Terms of Use and any plan-specific terms presented at the time of subscription, constitutes the entire agreement between you and Safra and supersedes all prior representations, discussions, negotiations, and agreements.

2. Who this Agreement applies to

This Agreement applies to you if you are:

• A registered accountant, bookkeeper, BAS agent, tax agent, GST agent, or financial advisor
• An employee or contractor of an accounting or bookkeeping practice operating in Australia or New Zealand
• Any other professional using Safra primarily to service the financial needs of third-party clients

You represent that you hold any licences, registrations, or memberships required by law or your professional body to provide the services you offer to clients, whether under Australian or New Zealand law. Safra does not verify practitioner credentials.

If you are located outside Australia or New Zealand, you may access the Platform but you do so at your own risk and are solely responsible for ensuring your use complies with all applicable local laws and professional obligations.

3. Your practitioner account

As a Practitioner, you operate a single account from which you manage multiple client organisations. You are the subscriber for billing purposes. Your clients are not subscribers and do not have their own Safra accounts unless they separately sign up as business owners.

You are responsible for all activity that occurs under your practitioner account, including activity carried out by your employees, contractors, or any other person you permit to use your account on your behalf. You must ensure that any such person is aware of and complies with this Agreement.

You must not allow clients to access your practitioner account directly.

4. Client onboarding and consent

4.1 Your obligation to obtain consent

Before connecting any client's Xero organisation to Safra, you must obtain the client's explicit, informed consent. This means the client must understand:

• That their Xero financial data will be accessed by Safra
• What Safra does with that data (as described in the Safra Terms of Use)
• That Safra is a third-party platform operated by Sampath & Lo Pty Ltd
• That they can withdraw consent and revoke access at any time

4.2 How consent must be obtained

Consent must be obtained in writing, whether by email, a signed engagement letter addendum, or a client-facing consent form. Verbal consent alone is not sufficient. You must retain records of client consent and make them available to Safra upon request.

4.3 Recording consent in Safra

Safra intends to provide an in-platform consent recording tool to help practitioners document client consent electronically. Where this tool is available, its use is strongly recommended as it creates a timestamped record within your practitioner account. Where you use an alternative consent method, you remain solely responsible for the adequacy of that consent.

4.4 Withdrawal of consent

If a client withdraws consent, you must disconnect that client's Xero organisation from your Safra account within 5 business days of receiving notice of withdrawal. Safra will then handle the client's data in accordance with our data retention policy.

5. Your professional obligations

Nothing in this Agreement limits or overrides your obligations as a registered professional. As a Practitioner, you remain solely responsible for:

• Complying with all applicable professional standards, including APES 110 (Code of Ethics for Professional Accountants) for Australian practitioners, and the equivalent standards issued by Chartered Accountants Australia and New Zealand (CA ANZ) or CPA Australia for New Zealand practitioners
• Maintaining client confidentiality in accordance with your professional obligations and applicable privacy law — including the Privacy Act 1988 (Cth) for Australian clients and the Privacy Act 2020 (NZ) for New Zealand clients
• Exercising independent professional judgement when presenting or relying on Safra outputs
• Ensuring that your use of Safra is consistent with your engagement terms with each client

6. AI-Generated Outputs — Important Limitations

The Platform uses automated AI processes to generate financial insights and analysis based on your client's Xero data. When using these outputs in your practice, you must understand and accept the following:

• Outputs are generated by automated processes and may contain errors, omissions, or inaccuracies
• AI models, including those used by Safra, can produce outputs that are plausible in appearance but factually incorrect or entirely fabricated — a characteristic known as hallucination. This risk is inherent to AI-generated content and is not eliminated by the quality or completeness of the underlying data
• Outputs reflect only the data connected to the Platform at the time of generation and may not account for transactions, events, or circumstances outside that data
• Outputs are for informational purposes only and do not constitute financial, accounting, tax, investment, or legal advice

As a Practitioner, you must:

• Review and apply professional judgement to all outputs before presenting them to clients
• Not present Safra outputs as your own independent analysis without review
• Make clear to clients that insights are generated with the assistance of AI tools where this is material to how the client will use the information
• Not represent that Safra outputs constitute advice of any kind
• Independently verify the accuracy of any output before acting on it or presenting it to a client, using your own professional knowledge, the client's source records, or other reliable references. Reliance on outputs without independent verification is at your sole risk

Safra is a tool to support your practice, not a substitute for your professional expertise or judgement.

7. Subscriptions and Billing

Practitioner subscriptions are billed based on the plan selected at the time of signup. Plan features, pricing, and client seat limits are presented at the time of subscription. The following terms apply:

• Subscriptions are billed in advance for the selected billing period (monthly or annual)
• Fees are charged in Australian Dollars (AUD) for Australian subscribers and New Zealand Dollars (NZD) for New Zealand subscribers, inclusive of applicable taxes (GST in Australia; GST in New Zealand) where applicable
• You authorise us to charge your nominated payment method on a recurring basis until you cancel
• You may cancel your subscription at any time through the account management section of the Platform. Cancellation is not effective until acknowledged by Safra through the Platform. Cancellation takes effect at the end of the current billing period and no partial refunds are provided unless required by law or as set out in Section 2 of the Terms of Use
• Safra will issue a tax-compliant invoice for each billing period, sent to the email address associated with your account

Where you have paid for an annual subscription in advance, for the purposes of calculating the liability cap in Section 12.1, the fees paid in the three months preceding the event will be calculated as the monthly equivalent of your annual fee multiplied by three, not the lump sum amount paid.

8. Privacy Act obligations and data responsibilities

8.1 Allocation of privacy obligations

For the purposes of applicable privacy law:

• Safra is responsible for personal information it collects directly — including your account details and usage data — and for handling that information in accordance with the Privacy Act 1988 (Cth) (for Australian users) or the Privacy Act 2020 (NZ) (for New Zealand users), as applicable
• You are responsible for ensuring that your collection and use of client personal information via the Safra platform is lawful, properly authorised, and consistent with your own privacy obligations to those clients under applicable law
• You must ensure that your clients are aware of how their personal information and financial data will be handled by Safra, as described in the Terms of Use, before you connect their Xero organisation

8.2 Safra's processing of client data

Safra processes client financial data for the sole purpose of generating insights and analysis within your practitioner account and identifying and fixing technical issues, errors, and bugs in the Platform. Safra does not use client data for AI model training or any other purpose without separate explicit consent.

8.3 Data breach notification

In the event of a notifiable data breach involving client data accessible through your practitioner account, Safra will:

• For Australian clients: comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth), including notification to the OAIC
• For New Zealand clients: comply with the mandatory breach notification requirements under the Privacy Act 2020 (NZ), including notification to the NZ Privacy Commissioner
• Notify you as the practitioner as soon as reasonably practicable following our assessment of the breach, so you can meet any obligations you may have to your clients
• Take reasonable steps to contain the breach and prevent further unauthorised access

You remain responsible for any notification obligations you have directly to your clients under applicable law or your professional obligations.

8.4 Storage locations

Client data is stored on secure cloud infrastructure located in Australia, New Zealand, or other jurisdictions that maintain data protection standards equivalent to Australian and New Zealand law. You may request disclosure of the specific jurisdictions in which client data is stored by submitting a written request to hello@safraai.io. We will respond within 10 business days of receiving your request.

8.5 Client offboarding

When you remove a client from your practitioner account — whether because the engagement has ended, consent has been withdrawn, or for any other reason — you must disconnect that client's Xero organisation within 5 business days. Following disconnection, Safra will retain data only as required by law or our data retention policy, after which it will be deleted.

9. Subcontracting and staff access

You may permit your employees and contractors to use your practitioner account on your behalf, provided that:

• Each such person is made aware of the obligations in this Agreement and complies with them
• You remain solely responsible for all actions taken under your account, regardless of who takes them
• You do not permit clients to access your practitioner account under any circumstances

You must not subcontract access to your practitioner account to a third-party practice or individual outside your organisation without Safra's prior written consent.

10. Confidentiality

You agree to keep confidential any non-public information about the Safra platform, its features, roadmap, or pricing that you learn through your use of the platform. This obligation does not apply to information that is publicly available or that you are required to disclose by law or your professional body.

11. Acceptable use

In addition to the acceptable use obligations in the Terms of Use, as a Practitioner you must not:

• Connect a client's Xero organisation without that client's written consent
• Use one client's data or insights in connection with another client
• Allow clients to access your practitioner account directly
• Misrepresent to clients the source, nature, or reliability of Safra outputs

12. Warranties and Limitation of Liability

12.1 Safra's liability to you

The warranties and limitation of liability in Section 10 of the Terms of Use apply to your use of the platform as a Practitioner. Safra's total aggregate liability to you under or in connection with this Agreement is limited to the total fees paid by you to Safra in the three months immediately preceding the event giving rise to the claim. For annual subscribers, this cap is calculated on the monthly equivalent of your annual fee multiplied by three.

12.2 Specific exclusions

To the maximum extent permitted by applicable law, Safra is not liable for:

• Any loss or damage arising from your failure to obtain proper client consent
• Any professional liability claim made against you by a client arising from your use or presentation of Safra outputs
• Any loss arising from a client's reliance on outputs you present to them without exercising independent professional judgement

12.3 Mutual indemnity

Each party ('Indemnifying Party') indemnifies the other party ('Indemnified Party') against any third-party claim, loss, damage, cost, or expense (including reasonable legal costs) suffered or incurred by the Indemnified Party arising directly from the Indemnifying Party's breach of this Agreement or negligent act or omission in connection with it.

For clarity:

• You indemnify Safra against claims by your clients arising from your failure to obtain proper consent, your misrepresentation of Safra outputs, or your breach of your professional obligations
• Safra indemnifies you against claims arising from Safra's negligent processing of client data. For the purposes of this clause, 'negligent processing' means technical failures in Safra's handling of data — including loss, corruption, or unauthorised disclosure of data — and does not extend to errors, omissions, or inaccuracies in AI-generated outputs, which are governed by Section 6 and Section 12.2 of this Agreement

Each party's indemnity obligation is subject to: (a) the Indemnified Party promptly notifying the Indemnifying Party of any claim; (b) the Indemnifying Party being given reasonable opportunity to participate in the defence of the claim; and (c) the Indemnified Party not making any admission of liability without the Indemnifying Party's prior written consent.

12.4 Consumer guarantees

Nothing in this Agreement excludes any rights either party may have under applicable consumer protection legislation that cannot be excluded, restricted, or modified by agreement, including the Australian Consumer Law and the Consumer Guarantees Act 1993 (NZ).

13. Suspension and Termination

In addition to the termination provisions in the Terms of Use, Safra may suspend or terminate your practitioner account immediately if:

• We become aware that you have connected client Xero organisations without proper written consent
• A client notifies us that they have not authorised access to their data
• You breach your professional obligations in a way that brings Safra into disrepute

You may cancel your subscription at any time through the account management section of the Platform. Cancellation is the exclusive method of termination available to you and is not effective until acknowledged by Safra through the Platform. Upon termination, you must ensure all client Xero connections are disconnected within 5 business days. Safra will handle remaining data in accordance with our data retention policy.

14. Dispute Resolution

If a dispute arises in connection with this Agreement, the party raising the dispute must give written notice to the other party specifying the nature of the dispute. Notice runs from the date of receipt by the other party.

Both parties must attempt to resolve the dispute in good faith through negotiation. For disputes involving a claim of $5,000 or less, the negotiation period is 10 business days. For disputes involving a claim above $5,000, the negotiation period is 20 business days. Good faith negotiation requires each party to engage substantively with the other's position and not merely assert its original position without consideration of the other's response.

If the dispute is not resolved within the applicable negotiation period, either party may commence proceedings in accordance with Section 15.

Nothing in this clause prevents either party from seeking urgent interlocutory relief from a court where necessary to protect its rights.

15. Governing Law

This Agreement is governed by and construed in accordance with the following:

• For Australian practitioners and clients: the laws of New South Wales, Australia. Both parties submit to the non-exclusive jurisdiction of the courts of New South Wales
• For New Zealand practitioners and clients: the laws of New Zealand. Both parties submit to the non-exclusive jurisdiction of the courts of New Zealand
• For practitioners in other jurisdictions, the laws of New South Wales, Australia apply by default, without prejudice to any mandatory protections available under your local law

16. General

16.1 Entire agreement

This Agreement, together with the Terms of Use and any plan-specific terms presented at the time of subscription, constitutes the entire agreement between you and Safra with respect to the Platform and supersedes all prior representations, discussions, negotiations, and agreements.

16.2 Severability

If any provision of this Agreement is found to be invalid, illegal, or unenforceable by a court of competent jurisdiction, that provision will be severed to the minimum extent necessary, and the remaining provisions will continue in full force and effect.

16.3 No waiver

A failure or delay by either party to exercise any right under this Agreement does not constitute a waiver of that right.

16.4 Changes to this Agreement

We may update this Agreement from time to time. A change is 'material' if it removes a substantive right or obligation, increases pricing, or materially reduces the scope of data processing. We will provide at least 14 days' written notice of any material change via email or in-app notification. Non-material changes — including clarifications, formatting updates, and additions that do not reduce existing rights — may be made without prior notice. Continued use of the platform after the notice period for a material change constitutes acceptance. If you do not agree to a material change, you may cancel your subscription through the account management section of the Platform before the change takes effect.

Acceptance

This Agreement is accepted electronically. When you click 'I agree' in the Safra application, your acceptance is recorded with:

• The date and time of acceptance (UTC)
• The version of this Agreement accepted
• Your account identifier

A record of your acceptance is available upon request by contacting hello@safraai.io.