隐私政策

Moneki Privacy Policy

Effective date: 21 October 2026
Version: 1.3

This policy explains how Moneki handles personal information. It follows the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). We have tried to keep it short and plain. This policy is also provided in Simplified Chinese; if the versions differ, the English version prevails. If anything is unclear, contact us (section 13).

1. Who we are

Moneki is run by Moneki Pty Ltd (ABN 70 700 338 656), a company registered in Australia. Our address is 33 Riseley Street, Ardross, Western Australia. Moneki is an AI analytics service for restaurant and retail owners. You can use it through our website and web app at moneki.ai, our iOS app, WhatsApp and email.

In this policy, "we", "us" and "Moneki" mean Moneki Pty Ltd. "Merchant" means a business that uses Moneki for its stores.

Two roles. For people who use Moneki (account holders and their staff), we decide how their information is used. For the business data a merchant connects, including any information about that merchant's own customers and staff, we handle it on the merchant's behalf, to provide the service the merchant asked for.

2. What personal information we collect

2.1 People who use Moneki (owners, managers, staff)

• Account details: your email address, the way you sign in (password, Google or Microsoft), your account status and role, which stores and organisations you can access, and when you last signed in. We do not store your password itself, only a one-way scrypt hash. If you sign in with Google or Microsoft, we ask only for basic sign-in details (openid email profile). We keep your email address and which provider you used.
• Security details: authenticator-app sign-in is supported for Moneki's own platform administrators (super-admins). For those who enrol, we store an encrypted authenticator secret and hashed backup codes. Depending on our configuration, you may be asked to confirm a new device by email. When this is on, we store hashed codes and the devices you chose to trust.
• What you ask and receive: your questions to the assistant, its answers, and any feedback you give. We also store short business facts that Moneki learns from your questions, such as how you define a metric. You can pause or turn off this learning.
• Usage: how long you are active in the web app, for each store. If you turn on browser notifications, we store the browser's push subscription and its browser description (user agent).

2.2 Messages and documents you send to Moneki

• WhatsApp: your phone number, your WhatsApp profile name, message text, and any files, photos or voice notes you send. We turn voice notes into text and keep that text. A voice note containing a single question is answered without being filed as a document; its transcript remains stored.
• Email: when you email Moneki, or a Gmail inbox is connected with read-only access as a store's shared intake mailbox, we read the sender, subject, body and attachments (for example supplier invoices). To decide whether to accept an email, Moneki first reads the message. For our hello@moneki.ai mailbox, this read includes the attachments. Only mail from an address verified to belong to a registered owner is accepted into Moneki's document and AI processing. For mail we decline, Moneki's own record keeps only the sender, the subject and the reason, not the body or attachments. The original email stays in the mailbox it was sent to (our hello@moneki.ai mailbox, or your own Gmail inbox); Moneki cannot delete it there. There is currently no fixed deletion period for these originals; they stay in that mailbox until they are deleted there. Documents such as invoices can contain other people's names and contact details, for example a supplier contact. This does not cover the personal assistant's connection to an owner's own Gmail, which section 2.6 describes.

2.3 Business data a merchant connects

A merchant can connect its business systems. The data mainly covers sales, orders, menu items, fees, payouts, stock and labour hours, and accounting records if Xero is connected. Depending on the system, it can include personal information about the merchant's customers or staff:

• Point-of-sale systems (e.g. Square, RestoSuite, StarrPOS, SEMOOR):
  • order records can include a customer's name or phone number for an order, and free-text notes;
  • full POS database copies contain customer, member and staff tables;
  • labour reports contain employee names and hours.
• Membership, booking and staff lists: names, emails, phone numbers, birthdays, membership cards and balances, and booking notes.
• Rosters (e.g. Deputy exports): staff names, roles, shifts and timesheets. Contact details are not included.
• Instagram (if connected):
  • your own business account's posts and statistics;
  • public statistics and recent public posts of other business accounts you choose to compare with.
• Uber Eats menu photos: you can copy dish names, menu sections and photos from your own store's Uber Eats listing. We keep only those fields.
• Accounting (Xero, if the organisation's owner connects it): Moneki reads that Xero organisation's records through a read-only connection. These include the organisation's details and settings, the chart of accounts, invoices and bills, credit notes, quotes, purchase orders, payments, bank transactions and transfers, manual journals, budgets, reports such as profit and loss, balance sheet and aged receivables and payables, published tax reports, fixed assets and projects. Moneki does not read Xero's general ledger journals, or the attachments, history and notes, or PDFs of Xero records. The records include personal information:
  • contacts, which can include customers' and suppliers' names, contact people, email addresses, phone numbers, addresses and business numbers such as an ABN;
  • the people who use the Xero organisation or its projects: their names, email addresses and roles in Xero, and the time they record on projects;
  • payroll: employees' names, contact details, home addresses, dates of birth and gender, job and employment details, pay, payslips, tax declaration details, superannuation memberships, leave and timesheets.
  Before anything from Xero is saved or logged, Moneki removes the fields Xero uses for tax file numbers (including the organisation's own tax number field) and for bank account numbers and BSBs, and the Particulars field of payments, which can hold a bank account number. A number someone has typed into a free-text field in Xero, such as a description or reference, may be kept as written.

We limit this kind of data:

• Some report types that are mainly about identifying people are refused by our collector.
• When we process a POS database copy into the datasets Moneki uses, columns such as passwords, PINs, tax file numbers, bank numbers and card fragments are left out. Other identifying columns are either replaced with a random code or kept in separate restricted storage.
• This filtering applies to those processed datasets only. The raw uploads, and the archived copies we keep of them, are not filtered and may still contain the original fields, including those listed above.
• Membership, booking and staff lists are kept in a separate store that only the organisation's owner can view. The assistant cannot query that store.
• Accounting data from Xero is kept in a separate restricted database. Inside Moneki, only the organisation's owner, the owner of a store the data is linked to (for that store's data only), and Moneki's platform administrators (super-admins) can view it. Managers, the other organisation and store roles, and Moneki's other staff, including its developers, cannot view it through Moneki. The database access Moneki gives its developers does not include that database. The assistant cannot query it.

2.4 Invoices and reports we send

• If you accept an invoice from Moneki through its link, we record the name you enter and your IP address.
• If we share a report with you by link, we record when it is opened, how long each section is viewed, and the viewer's IP address.

2.5 Technical information

• Our servers log requests. Logs include the IP address and the page requested. Secret links and sign-in codes are removed from the logs.
• We use cookies and similar storage only to run the service: to keep you signed in, remember a trusted device, complete a Google, Microsoft or Gmail sign-in, a Google mail and calendar connection or a Xero connection, remember your selected store, and remember your language and display theme. The cookie that completes a Xero connection is used only to check that the approval at Xero comes back to the browser that started it, and it lasts at most 10 minutes.
• We have not added advertising or third-party analytics trackers to our website, web app or iOS app.
• The iOS app:
  • stores your sign-in token in the iOS Keychain;
  • keeps a cache of your business data on the device; when the app starts, it does not reuse cached data older than 7 days, and the cache is cleared when you sign out;
  • asks for photo library access only when you attach a photo.

2.6 Your own Google mail and calendar (personal assistant)

If your organisation has turned on the personal assistant, an organisation owner can connect their own Google account so that Moneki can help them keep track of what needs their attention.

• What we ask Google for: read-only access to your Gmail and Google Calendar, and your Google account's email address (openid, email, gmail.readonly, calendar.readonly). Moneki never asks for permission to send, change or delete mail or events. Replies Moneki drafts are shown to you in Moneki only; it does not send them.
• What we keep: your Google account's email address and Google's account identifier, which permissions you granted, and the sign-in tokens Google issues, encrypted in our database. For messages: the provider's message identifier, sender, subject, time and category. For calendar events: the provider's event identifier, title, time, location and the attendees' email addresses. Also the items Moneki finds that need your attention; and, for business mail only, a short summary.
• What we do not keep: the body and attachments of your emails. Moneki reads them from Google when it needs them and does not store them. Mail and events Moneki classifies as personal (for example health or family) are kept as metadata only: no summary is made, and they never go into your business memory, documents or Vault.
• Who can see it: only you. Other owners and members of your organisation, store managers and Moneki's own administrators cannot see your mail, events or what the assistant says about them in Moneki. Section 5 says when people at Moneki may access this data.
• How you are told: reminders and the morning summary are messages in your own assistant thread in Moneki. Some of them, including urgent reminders and the morning summary, are also shown with the notification bell and, if you turn on browser notifications, sent as a browser notification (section 6). A notification says the message in one short line, and our code checks each number in that line against what the message is based on. Several urgent reminders found at the same time are sent as one notification. Between 22:00 and 07:00, only urgent reminders are sent as browser notifications; anything else that would have been sent as one still goes into your thread and onto the bell, without a notification, and is not sent as one later. These hours are in the time zone Moneki uses for you: your organisation's (for a member of stores only, the store's; if you belong to several, the one you joined first). If Moneki cannot read that time zone or these hours, it sends the notification as usual. The morning summary is also emailed to you.
• Nothing moves on its own: an email becomes a Moneki document only if you choose "save as document", and a task only if you confirm it.

2.7 Meeting recordings and notes you upload (personal assistant)

An organisation owner can upload a recording or a written transcript of a meeting to the personal assistant, which turns it into meeting notes and a list of to-dos.

• How it is processed: a recording is transcribed by Microsoft's Azure AI Speech service, and the notes and to-dos are written by Azure OpenAI (section 5).
• The recording itself: deleted once it has been transcribed. If transcription fails, it is kept for up to 7 days so it can be tried again, and then deleted.
• The transcript and notes: only you, the person who uploaded them, can see them. You can delete them at any time, and they are erased when your account is deleted.
• The people in the meeting: before you upload a recording, you are responsible for getting the agreement of the people in it. Moneki reminds you of this when you upload.

3. How we collect it

• From you, when you register, use the app, or message or email us.

  • From your own Google account, read only, if you connect it to the personal assistant (section 2.6).
  • Meeting recordings and transcripts you upload to the personal assistant (section 2.7).

• From systems a merchant authorises us to connect. Depending on the system, the merchant gives us one of the following, and we access only the merchant's own data with it:

  • a sign-in;
  • an access token;
  • an OAuth approval;
  • an upload from the merchant's own premises.

• Xero. Only the organisation's owner can connect Xero, by approving Moneki's access at Xero (an OAuth approval). Moneki asks Xero only for permission to read, for permission to keep that access without asking the person again (offline_access), and for the basic sign-in details of the person approving (openid, profile, email). Moneki does not keep those sign-in details. Moneki cannot change the records in Xero. While the connection is active, Moneki reads the data again on a schedule to keep its copy up to date. Only the organisation's owner can disconnect Xero in Moneki's settings, which deletes the Xero data Moneki holds for that connection (sections 9 and 10). A full wipe of the organisation's last store, and deleting the account of the person who approved the connection, also disconnect it (section 10). Moneki can also be removed in Xero's Connected Apps page. That stops Moneki's access, but Moneki keeps the data it has already copied until Xero is disconnected in Moneki.

• Uber Eats. There is currently no Uber Eats Reporting API connection. (Menu photos copied from a store's own Uber Eats listing are described in section 2.3.)

• From public sources, for context:

  • weather, public holidays, school terms, and economic data from the ABS and the RBA;
  • nearby business listings from Google Places;
  • public business websites;
  • public web pages and search results the assistant reads to answer a question (section 5).

  These are mostly about places, dates and businesses. A web page the assistant reads can mention people; Moneki does not keep the text of those pages (section 5).

If someone sends us personal information we did not ask for, we handle it under this policy. If we do not need it, we delete it where the law allows.

4. Why we use it

We use personal information to:

• provide Moneki, including dashboards, answers, reports, forecasts and alerts;
• create and secure accounts, control who can see which store's data, and prevent misuse;
• receive and act on messages, files and invoices that you send;
• send service emails such as invitations, sign-in codes, reports and invoices;
• let a store owner or manager email actions from the store's action list (or its roster) to addresses they type in, such as their staff or suppliers; the email comes from Moneki's address, and replies to an email of actions go to the person who sent it. We record who sent what to which addresses and when, keep that record with the store's data until the store's data is wiped, remove the sender from it when their account is deleted, and use those addresses for nothing else;
• bill for the service and keep records of AI usage costs;
• keep the service running, investigate problems and keep audit records.

Moneki does not send marketing messages.

We do not sell personal information.

5. AI processing

Moneki's AI features run on Azure OpenAI, a Microsoft service. Our models are deployed in Moneki's own Azure account.

What is sent to the AI models

• your questions, and the results of read-only queries over your store's business data that answer them;
• messages, emails, documents and images you send, so they can be read and filed (for example, extracting invoice details);
• short text passages, which are turned into search vectors so Moneki can find your documents again;
• for "business memory", your own question text, plus up to three of your earlier questions, so the model can suggest business facts to remember. The assistant's answers are not sent for this.
• if you connect your Google account (section 2.6), the emails and calendar events Moneki reads to decide what needs your attention or to answer your question. Their full text is sent for that decision or answer only and is not stored with it.

Limits we apply

• Business memory keeps only facts the model classifies as business facts. Suggestions the model classifies as sensitive or personal (for example health, family, religion, politics or sexuality) are left out of business memory. This depends on the model's classification, which may not always be right, and it does not remove the original conversation.
• For the results of certain checking queries (probe queries), we remove columns whose names match certain contact-detail field names (such as email, phone, address or customer name). This does not detect all personal information, or personal information written into free text.
• The separate membership, booking and staff store is not reachable by the assistant.
• Accounting data from Xero is not reachable by the assistant, and Moneki does not send it to the AI models.

Voice notes are converted to text by Microsoft's Azure AI Speech service.

Meeting recordings you upload to the personal assistant are converted to text by Azure AI Speech, and the transcript is sent to Azure OpenAI to write the meeting notes and to-dos (section 2.7).

Web search

• When the assistant needs public information to answer a question, such as local news, weather warnings or industry prices, it can search the public web through the Brave Search API, up to five searches per answer.
• Brave receives the search terms the AI model writes for the question, and the area the results are for (country, state, city and time zone). The request comes from Moneki's server and carries no account details or other identifier of you.
• Before a search term is sent, Moneki's code checks it against what the assistant was given for that answer. It refuses a term that holds something written like a phone number, an email address, a BSB, or an account or card number, or any run of six or more digits; a number from your business's records, documents, notes or conversation (years and single digits aside); four or more words in a row from your records or notes; or a word that they write only as a name, such as a person's name. Words from your own question, your business's name and location, the names of its dishes, products, categories, sales channels and suppliers, and dates are allowed, so a search term can include them. Words, but not numbers, from the titles and site names of pages this answer's searches returned, or of pages earlier answers in the conversation cited, are allowed too. Chinese text in a search term is refused unless it comes from one of these allowed sources.
• Moneki's server can read up to four of the pages the searches return for an answer, and fetches the icons of the sites an answer cites, directly from those public sites. It identifies itself as MonekiBot/1.0 (+https://moneki.ai; hello@moneki.ai).
• With the answer, Moneki keeps the search terms, the title and site name of the pages each search returned, and the title, link, site name and date of each page the answer cites. It also keeps a copy of each cited site's icon. It does not keep the snippets a search returns or the text of the pages it reads.

Training

• Moneki does not train or fine-tune AI models on your data.
• Data from Xero is never used to train, fine-tune, adapt or enhance any AI model.
• Microsoft states that prompts and outputs sent to Azure OpenAI are not available to OpenAI, and are not used to train foundation models or to improve Microsoft's products without the customer's permission.
• Microsoft runs abuse monitoring on this service. If its systems flag a request, a sample of prompts and outputs may be stored and reviewed by authorised Microsoft staff.

People stay in charge. AI output is advice and analysis. Moneki does not place orders, change prices, make payments or publish anything on your behalf.

Google user data. Moneki's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We use the Gmail and Google Calendar data from your personal assistant connection (section 2.6) only to provide the personal assistant to you, and the Gmail data from a store's shared intake mailbox only to accept and file the mail sent to it and to use it as that store's documents (sections 2.2 and 4). We do not use either for advertising, we do not sell it, and people at Moneki do not read it except with your permission, for security, or as the law requires.

6. Who we share it with

We share personal information only as needed to run Moneki:

We also disclose information if the law requires it.

Some recipients only receive questions about places and dates, for example weather and holiday services. We do not send personal information to them.

Merchants' data is kept separate: one merchant cannot see another merchant's data.

7. Storage outside Australia

Moneki's Azure resources are set up in Microsoft Azure's Southeast Asia region (Singapore). This is where our application, databases and file storage are configured to run.

The AI models we use are set up as Azure "Global Standard" deployments. Microsoft says that with this deployment type, a prompt and its response may be processed in any geography where the model is deployed. Microsoft's commitment for data it stores for this service, including abuse-monitoring data, is to keep it in the Azure geography of our resource, not in a particular region. Microsoft lists the Southeast Asia region (Singapore) in its Asia Pacific geography, together with the East Asia region (Hong Kong).

Our other service providers may also process information outside Australia:

• Microsoft 365 (our hello@moneki.ai mailbox): information may be processed outside Australia, including in countries where Microsoft operates.
• Meta (WhatsApp): Meta says that while WhatsApp Business Platform messages are being processed, their content may be stored in Meta data centres internationally.
• Google: Google says it maintains servers around the world, and that information may be processed on servers outside the country where you live.
• Expo: Expo says it processes data in the United States.
• Browser push services: run by the company behind your browser, and may handle notifications outside Australia.
• Brave (web search): Brave says the Brave Search API is provided by Brave Software Inc, located in the United States. Its privacy notice does not say where search queries are processed or stored.

Microsoft's data processing and security terms for the Microsoft services we subscribe to are set out in the Microsoft Products and Services Data Protection Addendum.

8. How we protect it

• Connections are encrypted (HTTPS only; storage requires TLS 1.2 or later; the database requires encrypted connections).
• Stored files are encrypted at rest by Azure.
• Passwords for connected systems and other secrets are kept in Azure Key Vault.
• Sign-in tokens for connected accounts (e.g. Gmail, Google Calendar, Instagram, Xero) and authenticator secrets are encrypted in our database.
• The database accepts only Microsoft Entra identity sign-ins, from approved network addresses.
• Access inside Moneki is role-based. Each store's data is kept apart from every other store's.
• Authenticator-app two-step sign-in is supported for Moneki's own platform administrators (super-admins). With enforcement enabled, enrolled super-admins must complete a second-factor challenge; the admin console prompts unenrolled super-admins to enrol. Email verification for other users' new devices depends on a setting that is off unless we turn it on (see section 2.1).

No system is perfectly secure. If a data breach is likely to cause serious harm, we will notify affected people and the OAIC as the law requires.

9. How long we keep it

When an account is deleted, we delete its content. We keep some records with the person's identity removed, for example AI usage totals that a merchant is billed for. Audit records keep only an internal account number.

10. Access, correction and deletion

You can ask us for the personal information we hold about you, and ask us to correct it or delete it.

• Store owners can export, in the app, the store-attributed application and analytics data that the export feature covers. Member personal information is included only for the organisation's owner. Other users' conversations and documents are included only for the store's direct owner; anyone else gets their own.

• Store owners can wipe their store's data in the app. Collection then stops until they reconnect. A full wipe removes:

  • the store's settings, learned rules, notifications and decision history;
  • its business data in Moneki's application and analytics databases, and in the PostgreSQL copy;
  • store-scoped assistant conversations, Moneki's replies for the store, and the documents filed for the store;
  • the store's member records.

  A wipe does not remove the messages you sent to Moneki or their voice-note transcripts; these go when the sending account is deleted. A wipe also does not currently remove the raw uploads and archived source copies (section 9). Deleted files and backups also follow the recovery periods in section 9.

  A full wipe removes only the store's links to accounting data from Xero; the organisation's Xero data stays. Once every store of the organisation has been fully wiped, the last full wipe also disconnects every Xero connection of the organisation and deletes its Xero data, as disconnecting does (below).

• Accounting data from Xero: only the organisation's owner can disconnect Xero, in Moneki's settings. Disconnecting asks Xero to end Moneki's access, and deletes all the data Moneki copied from Xero for that connection, even if Xero does not answer or refuses (section 9). Removing Moneki in Xero's Connected Apps page stops Moneki's access, but Moneki keeps the data it has already copied until Xero is disconnected in Moneki. Deleting the account of the person who approved a Xero connection disconnects it in the same way.

• Your Google mail and calendar: you can disconnect your Google account at any time in Moneki's settings. Disconnecting stops Moneki reading your mail and calendar at once, asks Google to withdraw Moneki's access, and deletes everything the personal assistant kept for you, except its audit records and, if Google cannot be reached, the connection's record and encrypted token, which Moneki keeps, unused, for up to 30 days only to ask Google again (section 9). You can also remove Moneki's access from your Google account's settings; Moneki finds this the next time it uses the connection and asks you to reconnect, and if you do not reconnect within 30 days the connection ends in the same way.

• Your meeting notes: you can delete a meeting's transcript and notes in the personal assistant at any time. They are erased with your account.

• To delete an account, contact us. Account deletion is done by Moneki on request.

• For anything else, contact us (section 13).

  • We may need to confirm your identity first.
  • We will reply within 30 days.
  • If we refuse a request, we will tell you why and how to complain.

If you are a customer or staff member of a merchant that uses Moneki: the merchant controls that data. Please contact the merchant first. If you contact us, we will pass your request to the merchant and help them respond.

You can contact us without giving your name for general questions. We cannot provide the service anonymously, because an account needs an email address.

11. Complaints

If you have a privacy concern, contact us first (section 13). We will try to resolve it within 30 days.

If we do not respond within 30 days, or you are not happy with our response, you can complain to the Office of the Australian Information Commissioner (OAIC). Complaints to the OAIC must be made in writing, for example using the online form on its website.

• website: www.oaic.gov.au
• email: oaicintake@oaic.gov.au
• post: GPO Box 5288, Sydney NSW 2001
• enquiries line (for questions, not complaints): 1300 363 992

12. Changes to this policy

We will update this policy when our practices change. The latest version will always be at moneki.ai/privacy, with its effective date at the top. If a change materially affects how we use your information, we will tell account holders by email or in the app.

13. Contact us

Moneki Pty Ltd — Privacy
Email: hello@moneki.ai
Post: 33 Riseley Street, Ardross, Western Australia

Moneki 隐私政策（简体中文）

本政策同时提供简体中文版本；如两个版本有任何不一致，以英文版本为准。

生效日期：2026年10月21日
版本：1.3

本政策说明 Moneki 如何处理个人信息。它依照澳大利亚《1988 年隐私法》（联邦）中的澳大利亚隐私原则（APPs）编写。我们尽量写得简短易懂；如有不清楚之处，请联系我们（第 13 节）。

1. 我们是谁

Moneki 由 Moneki Pty Ltd（ABN 70 700 338 656）运营，是一家在澳大利亚注册的公司。我们的地址：33 Riseley Street, Ardross, Western Australia。Moneki 是面向餐饮与零售经营者的 AI 经营分析服务。你可以通过网站及网页应用 moneki.ai、iOS 应用、WhatsApp 和电子邮件使用它。

本政策中的"我们"和"Moneki"指 Moneki Pty Ltd。"商户"指为其门店使用 Moneki 的企业。

两种角色。对于使用 Moneki 的人（账户持有人及其员工），由我们决定其信息的用途。对于商户接入的经营数据，包括其中涉及该商户自己的顾客和员工的信息，我们是代表商户处理，用于提供商户所要求的服务。

2. 我们收集哪些个人信息

2.1 使用 Moneki 的人（老板、经理、员工）

• 账户信息：你的电子邮箱、登录方式（密码、Google 或 Microsoft）、账户状态与角色、你可以访问的门店和组织，以及最近一次登录时间。我们不保存密码本身，只保存不可逆的 scrypt 哈希值。如果你通过 Google 或 Microsoft 登录，我们只请求基本登录信息（openid email profile），并保存你的邮箱以及你使用的登录服务。
• 安全信息：Moneki 自己的平台管理员（超级管理员）可以使用验证器应用登录。对于已注册验证器的管理员，我们会保存加密后的验证器密钥和哈希处理后的备用码。视我们的配置而定，你从新设备登录时可能需要通过邮件确认该设备。开启时，我们会保存哈希处理后的验证码以及你选择信任的设备。
• 你的提问与收到的回答：你向助手提出的问题、助手的回答，以及你给出的任何反馈。我们还会保存 Moneki 从你的提问中学到的简短经营事实，例如你如何定义某个指标。你可以暂停或关闭这项学习。
• 使用情况：你在网页应用中、按门店计的活跃时长。如果你开启浏览器通知，我们会保存该浏览器的推送订阅及其浏览器描述（user agent）。

2.2 你发给 Moneki 的消息和文件

• WhatsApp：你的手机号码、WhatsApp 资料名称、消息文字，以及你发送的文件、照片或语音。我们会把语音转成文字并保存这些文字。如果一条语音只包含一个问题，我们会直接回答，不会把它归档为文件；但它的转写文字仍会被保存。
• 电子邮件：当你给 Moneki 发邮件，或某个 Gmail 收件箱以只读权限接入、作为门店的共享收件邮箱时，我们会读取发件人、主题、正文和附件（例如供应商发票）。为判断是否接收一封邮件，Moneki 会先读取这封邮件；对于我们的 hello@moneki.ai 邮箱，读取时包括附件。只有来自"已验证属于注册老板"的邮箱的邮件，才会进入 Moneki 的文件处理和 AI 处理流程。对于未被接收的邮件，Moneki 自己的记录只保留发件人、主题和原因，不保留正文或附件。邮件原件仍留在收件的邮箱中（我们的 hello@moneki.ai 邮箱，或你自己的 Gmail 收件箱），Moneki 无法在那里删除它。这些原件目前没有固定的删除期限，会一直留在该邮箱中，直到在那里被删除。发票等文件中可能含有其他人的姓名和联系方式，例如供应商联系人。本节不涉及个人助理对 owner 本人 Gmail 的连接，那部分见第 2.6 节。

2.3 商户接入的经营数据

商户可以接入自己的经营系统。这些数据主要是销售、订单、菜品、费用、结算款、库存和工时；如已接入 Xero，还包括会计记录。视系统不同，其中可能含有商户的顾客或员工的个人信息：

• 收银（POS）系统（如 Square、RestoSuite、StarrPOS、SEMOOR）：
  • 订单记录可能含有某张订单的顾客姓名或电话，以及自由填写的备注；
  • 完整的 POS 数据库副本含有顾客、会员和员工表；
  • 工时报表含有员工姓名和工时。
• 会员、预订和员工名单：姓名、邮箱、电话、生日、会员卡及余额，以及预订备注。
• 排班（如 Deputy 导出文件）：员工姓名、职位、班次和考勤，不含联系方式。
• Instagram（如已接入）：
  • 你自己商业账户的帖子和统计数据；
  • 你选择对比的其他商业账户的公开统计数据和近期公开帖子。
• Uber Eats 菜品图片：你可以从自己门店的 Uber Eats 页面复制菜品名称、菜单分类和图片。我们只保存这几项。
• 会计数据（Xero，如组织所有者接入）：Moneki 通过只读连接读取该 Xero 组织的记录。其中包括组织信息和设置、会计科目表、销售发票和供应商账单、贷项通知单、报价单、采购订单、付款、银行交易和转账、手工分录、预算、利润表、资产负债表、应收和应付账龄等报表、已发布的税务报表、固定资产和项目。Moneki 不读取 Xero 的总账分录，也不读取 Xero 记录的附件、历史记录和备注或 PDF。这些记录中含有个人信息：
  • 联系人，可能含有顾客和供应商的姓名、联系人员、邮箱、电话、地址，以及 ABN 等商业编号；
  • 使用该 Xero 组织或其项目的人员：他们的姓名、邮箱、在 Xero 中的角色，以及他们在项目上记录的工时；
  • 薪资：员工的姓名、联系方式、住址、出生日期和性别、职位与雇佣信息、工资、工资单、税务申报信息、养老金（superannuation）成员资格、休假和考勤。
  在保存或记录任何来自 Xero 的内容之前，Moneki 会去掉 Xero 用于税号（TFN）的字段（包括组织自身的税号字段）、用于银行账号和 BSB 的字段，以及付款记录中可能含有银行账号的 Particulars 字段。如果有人在 Xero 的自由填写字段（例如描述或参考信息）中输入了这类号码，它可能会按原样保存。

我们对这类数据加以限制：

• 收集程序会拒绝某些以识别个人为主的报表类型。
• 当我们把 POS 数据库副本处理成 Moneki 使用的数据集时，会去掉密码、PIN、税号、银行账号和卡号片段等列；其他可识别个人的列，要么替换为随机代码，要么单独保存在受限存储中。
• 这种过滤只适用于上述处理后的数据集。原始上传文件以及我们保留的归档副本未经过滤，可能仍包含原有字段，包括上面列出的字段。
• 会员、预订和员工名单单独存放，只有该组织的所有者可以查看；助手无法查询这部分数据。
• 来自 Xero 的会计数据单独存放在一个受限数据库中。在 Moneki 内部，只有该组织的所有者、这些数据所关联门店的所有者（仅限该门店的数据），以及 Moneki 的平台管理员（超级管理员）可以查看。经理、组织和门店的其他角色，以及 Moneki 的其他工作人员（包括开发人员），都无法通过 Moneki 查看这些数据。Moneki 给予开发人员的数据库访问权限不包括该数据库。助手无法查询这些数据。

2.4 我们发出的发票和报告

• 如果你通过链接接受 Moneki 的发票，我们会记录你填写的姓名和你的 IP 地址。
• 如果我们通过链接与你分享报告，我们会记录打开时间、各部分的浏览时长，以及浏览者的 IP 地址。

2.5 技术信息

• 我们的服务器会记录请求日志，内容包括 IP 地址和所请求的页面；其中的私密链接和登录代码会被移除。
• 我们只为运行服务而使用 Cookie 及类似存储：保持登录、记住受信任设备、完成 Google、Microsoft 或 Gmail 登录、Google 邮箱和日历的连接或 Xero 连接、记住你选择的门店，以及记住你的语言和显示主题。用于完成 Xero 连接的 Cookie 只用来核对在 Xero 中的授权是否回到发起连接的同一浏览器，最长保留 10 分钟。
• 我们没有在网站、网页应用或 iOS 应用中加入广告或第三方分析追踪工具。
• iOS 应用：
  • 将登录令牌保存在 iOS 钥匙串中；
  • 在设备上缓存你的经营数据；应用启动时不会再使用超过 7 天的缓存数据，退出登录时会清除缓存；
  • 只在你添加照片附件时请求相册权限。

2.6 你自己的 Google 邮箱和日历（个人助理）

如果你所在的组织开启了个人助理，组织 owner 可以连接自己的 Google 账号，让 Moneki 帮你留意需要你处理的事。

• 我们向 Google 申请什么：以只读方式访问你的 Gmail 和 Google 日历，以及你的 Google 账号邮箱地址（openid、email、gmail.readonly、calendar.readonly）。Moneki 从不申请发送、修改或删除邮件和日程的权限。Moneki 代拟的回复只在 Moneki 里给你看，不会替你发出。
• 我们保存什么：你的 Google 账号邮箱地址和 Google 的账号标识、你授予了哪些权限，以及 Google 签发的登录令牌（加密保存在我们的数据库中）。对邮件：服务商的邮件编号、发件人、主题、时间和分类。对日程：服务商的日程编号、标题、时间、地点和参会人的邮箱地址。此外还有 Moneki 找出的需要你处理的事项；以及仅限经营类邮件的简短摘要。
• 我们不保存什么：邮件正文和附件。Moneki 需要时向 Google 实时读取，用完不保存。被 Moneki 归为私人类的邮件和日程（例如健康、家庭）只保存元数据：不生成摘要，也不会进入你的经营记忆、资料库或 Vault。
• 谁能看到：只有你本人。你所在组织的其他 owner 和成员、店长，以及 Moneki 自己的管理员，在 Moneki 里都看不到你的邮件、日程，也看不到助理对它们说了什么。Moneki 的工作人员在什么情况下可以接触这些数据，见第 5 节。
• 怎么通知你：提醒和晨间汇总是发在 Moneki 里你自己的助理线程中的消息。其中一部分（包括急事提醒和晨间汇总）还会在铃铛里提示；如果你开启了浏览器通知，也会作为浏览器通知发出（第 6 节）。浏览器通知用一句简短的话概括这条消息，其中的每个数字都由我们的代码对照这条消息所依据的内容核对。同时发现的几件急事，合成一条通知发出。22:00 到 07:00 之间只有急事提醒会作为浏览器通知发出；其他本来会发浏览器通知的消息照样进线程、在铃铛里提示，但不发浏览器通知，之后也不补发。这个时段按 Moneki 为你采用的时区计算：你所在组织的时区（只属于门店的，按门店的；属于多个的，按最早加入的那个）。Moneki 读不到这个时区或时段时，照常发送通知。晨间汇总还会通过邮件发给你。
• 不会自动流转：只有你点「存为资料」，一封邮件才会成为 Moneki 里的资料；只有你确认，才会变成待办。

2.7 你上传的会议录音和纪要（个人助理）

组织 owner 可以把会议录音或文字记录上传给个人助理，由助理整理出会议纪要和待办清单。

• 如何处理：录音由微软 Azure AI Speech 服务转成文字，纪要和待办由 Azure OpenAI 生成（第 5 节）。
• 录音原件：转写成功后删除。转写失败的录音最多保留 7 天，用于重试，之后删除。
• 转写文字和纪要：只有上传者本人看得到。你可以随时删除；删除账户时一并擦除。
• 参会的人：上传录音之前，由你负责征得参会人员的同意。上传时 Moneki 会提示你这一点。

3. 我们如何收集

• 由你提供：在你注册、使用应用，或给我们发消息、发邮件时。

  • 来自你自己的 Google 账号（只读），前提是你把它连接到个人助理（第 2.6 节）。
  • 你上传给个人助理的会议录音和文字记录（第 2.7 节）。

• 来自商户授权我们接入的系统。 视系统不同，商户会向我们提供以下其中一种方式，我们只用它访问该商户自己的数据：

  • 登录账号；
  • 访问令牌；
  • OAuth 授权；
  • 从商户自己的门店上传。

• Xero。 只有组织所有者可以接入 Xero，方式是在 Xero 中批准 Moneki 的访问（OAuth 授权）。Moneki 只向 Xero 申请读取权限、无需再次询问批准人即可保持这项访问的权限（offline_access），以及批准人的基本登录信息（openid、profile、email）。这些登录信息 Moneki 不会保存。Moneki 无法更改 Xero 中的记录。连接有效期间，Moneki 会按计划定期重新读取数据，使其副本保持最新。只有组织所有者可以在 Moneki 的设置中断开 Xero，断开后会删除 Moneki 为该连接保存的 Xero 数据（见第 9 节和第 10 节）。完全清除该组织最后一个门店，或删除批准该连接的人的账户，也会断开该连接（见第 10 节）。也可以在 Xero 的 Connected Apps（已连接应用）页面移除 Moneki。这样会停止 Moneki 的访问，但 Moneki 已经复制的数据会一直保留，直到在 Moneki 中断开 Xero。

• Uber Eats。 目前尚未接入 Uber Eats Reporting API。（从门店自己的 Uber Eats 页面复制的菜品图片，见第 2.3 节。）

• 来自公开来源，用于提供背景信息：

  • 天气、公共假日、学校假期，以及澳大利亚统计局（ABS）和澳洲储备银行（RBA）的经济数据；
  • Google Places 上的周边商家信息；
  • 公开的商家网站；
  • 助手为回答问题而读取的公开网页和搜索结果（见第 5 节）。

  这些数据主要关于地点、日期和商家。助手读取的网页可能提到个人；Moneki 不保存这些网页的正文（见第 5 节）。

如果有人向我们发送了我们并未要求的个人信息，我们会按本政策处理；不需要的，我们会在法律允许的范围内删除。

4. 我们为何使用这些信息

我们使用个人信息来：

• 提供 Moneki 服务，包括看板、问答、报告、预测和提醒；
• 创建并保护账户，控制谁能查看哪个门店的数据，防止滥用；
• 接收并处理你发来的消息、文件和发票；
• 发送服务邮件，例如邀请、登录验证码、报告和发票；
• 让店主或经理把门店行动清单里的行动（或排班表）用邮件发给他们填写的地址，例如员工或供应商；邮件从 Moneki 的地址发出，行动邮件的回复直接寄给发送人。我们记录谁在什么时候把哪些内容发给了哪些地址，这份记录随门店数据保存，直到门店数据被清除；发送人删除账户后，记录中不再保留其身份；这些地址不用于其他任何用途；
• 为服务收费，并记录 AI 使用成本；
• 维持服务运行、排查问题，并保留审计记录。

Moneki 不发送营销信息。

我们不出售个人信息。

5. AI 处理

Moneki 的 AI 功能运行在微软的 Azure OpenAI 服务上，模型部署在 Moneki 自己的 Azure 账户中。

会发送给 AI 模型的内容

• 你的问题，以及为回答问题而对你门店经营数据做的只读查询结果；
• 你发送的消息、邮件、文件和图片，以便读取和归档（例如提取发票信息）；
• 简短的文字片段，会被转换成检索向量，方便 Moneki 之后找回你的文件；
• 用于"经营记忆"时，发送你自己的提问文字，以及最多三条你之前的提问，让模型提出值得记住的经营事实；这一步不发送助手的回答。
• 如果你连接了 Google 账号（第 2.6 节）：Moneki 为判断哪些事需要你处理、或为回答你的问题而读取的邮件和日程。它们的全文只为这一次判断或回答发送，不随回答保存。

我们采取的限制

• 经营记忆只保留模型归类为经营事实的内容。模型归类为敏感或个人信息的建议（例如健康、家庭、宗教、政治或性取向）不会存入经营记忆。这取决于模型的归类，未必总是准确；而且这不会删除原始对话。
• 对于某些核查查询（probe 查询）的结果，我们会去掉列名符合特定联系方式字段名的列（例如邮箱、电话、地址或顾客姓名）。这并不能识别所有个人信息，也无法识别写在自由文本中的个人信息。
• 单独存放的会员、预订和员工数据，助手无法访问。
• 来自 Xero 的会计数据，助手无法访问，Moneki 也不会把它发送给 AI 模型。

语音由微软 Azure AI Speech 服务转成文字。

会议录音：你上传给个人助理的会议录音由 Azure AI Speech 转成文字，转写文字发送给 Azure OpenAI 生成会议纪要和待办（第 2.7 节）。

网络搜索

• 当助手回答问题需要公开信息（例如本地新闻、天气预警或行业价格）时，可以通过 Brave Search API 搜索公开网络，每个回答最多搜索五次。
• Brave 收到的是 AI 模型为该问题写出的搜索词，以及搜索结果所针对的地区（国家、州、城市和时区）。请求由 Moneki 的服务器发出，不附带你的账户信息或其他可识别你的标识。
• 每个搜索词发出前，Moneki 的代码都会将它与助手在该回答中获得的内容进行核对。含有以下内容的搜索词会被拒绝：形似电话号码、邮箱、BSB、账号或卡号的内容，或任何连续六位及以上的数字；你的经营记录、文件、备注或对话中出现的数字（年份和一位数除外）；连续四个及以上取自你的记录或备注的词；在这些内容中只以名称形式出现的词，例如人名。你本次提问中的词语、你商家的名称和所在地、其菜品、商品、分类、销售渠道和供应商的名称，以及日期，都允许使用，因此搜索词中可能包含这些内容。本次回答的搜索所返回网页、以及本对话中先前回答所引用网页的标题和网站名称中的词语（数字除外）也允许使用。搜索词中的中文必须来自上述允许的内容，否则会被拒绝。
• Moneki 的服务器可以为一个回答读取搜索返回的最多四个网页，并获取回答所引用网站的图标，均直接从这些公开网站获取。访问时以 MonekiBot/1.0 (+https://moneki.ai; hello@moneki.ai) 表明身份。
• Moneki 会随回答保存搜索词、每次搜索返回的网页的标题和网站名称，以及回答所引用的每个网页的标题、链接、网站名称和日期，并保存所引用网站图标的副本。Moneki 不保存搜索返回的摘要，也不保存所读取网页的正文。

训练

• Moneki 不使用你的数据训练或微调 AI 模型。
• 来自 Xero 的数据绝不会用于训练、微调、调整或增强任何 AI 模型。
• 微软表示，发送到 Azure OpenAI 的提示和输出不会提供给 OpenAI；未经客户许可，也不会用于训练基础模型或改进微软的产品。
• 微软会对该服务进行滥用监测。如果其系统标记了某个请求，部分提示和输出可能会被保存，并由经授权的微软员工审核。

最终由人决定。 AI 的输出是建议和分析。Moneki 不会代你下单、改价、付款或发布任何内容。

Google 用户数据。Moneki 使用从 Google API 获得的信息，遵守《Google API 服务用户数据政策》（Google API Services User Data Policy），包括其中的「有限使用」（Limited Use）要求。我们只把来自你个人助理连接（第 2.6 节）的 Gmail 和 Google 日历数据用于向你本人提供个人助理，只把来自门店共享收件邮箱的 Gmail 数据用于接收和归档发给它的邮件，并作为该门店的资料使用（第 2.2 节和第 4 节）；两者都不用于广告，不出售；除非经你同意、出于安全需要或法律要求，Moneki 的工作人员不会查看这些数据。

6. 我们与谁共享

我们只在运行 Moneki 所需时共享个人信息：

如法律要求，我们也会披露信息。

有些接收方（例如天气和假日服务）只收到关于地点和日期的查询，我们不会向它们发送个人信息。

不同商户的数据相互隔离：一个商户看不到另一个商户的数据。

7. 在澳大利亚境外存储

Moneki 的 Azure 资源设置在微软 Azure 的东南亚区域（新加坡）。我们的应用、数据库和文件存储都配置在这个区域运行。

我们使用的 AI 模型采用 Azure "Global Standard"（全球标准）部署方式。微软表示，采用这种部署方式时，一次提示及其回复可能在部署了该模型的任何地理区域（geography）处理。对于微软为该服务存储的数据（包括滥用监测数据），微软的承诺是保存在我们资源所在的 Azure 地理区域内，而不是某个特定区域（region）。微软将东南亚区域（新加坡）列入其亚太（Asia Pacific）地理区域，该地理区域还包括东亚区域（香港）。

我们的其他服务商也可能在澳大利亚境外处理信息：

• Microsoft 365（我们的 hello@moneki.ai 邮箱）：信息可能在澳大利亚境外处理，包括在微软开展业务的国家。
• Meta（WhatsApp）：Meta 表示，WhatsApp Business Platform 的消息在处理期间，其内容可能存储在 Meta 位于世界各地的数据中心。
• Google：Google 表示，其服务器遍布全球，信息可能在你所居住国家以外的服务器上处理。
• Expo：Expo 表示，其在美国处理数据。
• 浏览器推送服务：由你的浏览器背后的公司运营，可能在澳大利亚境外处理通知。
• Brave（网络搜索）：Brave 表示，Brave Search API 由位于美国的 Brave Software Inc 提供。其隐私声明没有说明搜索查询在何处处理或存储。

对于我们订阅的微软服务，微软的数据处理与安全条款载于《Microsoft Products and Services Data Protection Addendum》（微软产品和服务数据保护附录）。

8. 我们如何保护信息

• 连接经过加密（只用 HTTPS；存储要求 TLS 1.2 或以上；数据库要求加密连接）。
• 存储的文件由 Azure 进行静态加密。
• 已接入系统的密码及其他密钥保存在 Azure Key Vault 中。
• 已接入账户（如 Gmail、Google 日历、Instagram、Xero）的登录令牌和验证器密钥，在我们的数据库中加密保存。
• 数据库只接受来自许可网络地址的 Microsoft Entra 身份登录。
• Moneki 内部按角色控制访问；每个门店的数据与其他门店相互隔离。
• Moneki 自己的平台管理员（超级管理员）可以使用验证器应用进行两步登录验证。在强制验证开启时，已注册的超级管理员必须完成第二步验证；管理后台会提示尚未注册的超级管理员进行注册。其他用户新设备的邮件验证取决于一项默认关闭的设置（见第 2.1 节）。

没有任何系统是绝对安全的。如果发生可能造成严重损害的数据泄露，我们会依法通知受影响的人和 OAIC。

9. 我们保留多久

账户被删除时，我们会删除其内容。有些记录会去掉个人身份后保留，例如商户被计费的 AI 使用量汇总。审计记录只保留一个内部账户编号。

10. 查阅、更正与删除

你可以要求查阅我们持有的你的个人信息，并要求我们更正或删除。

• 门店所有者可以在应用内导出导出功能所涵盖的、归属于该门店的应用数据和分析数据。会员个人信息只对该组织的所有者包含在导出中。其他用户的对话和文件只对门店的直接所有者包含在内，其他人只能导出自己的内容。

• 门店所有者可以在应用内清除门店数据；之后会停止采集，直到重新接入。完全清除会删除：

  • 该门店的设置、已学习的规则、通知和决策记录；
  • 它在 Moneki 应用数据库、分析数据库以及 PostgreSQL 副本中的经营数据；
  • 门店范围内的助手对话、Moneki 对该门店的回复，以及为该门店归档的文件；
  • 该门店的会员记录。

  清除不会删除你发给 Moneki 的消息及其语音转写文字，这些会在发送账户被删除时删除。清除目前也不会删除原始上传文件和归档的数据源副本（见第 9 节）。已删除的文件和备份也适用第 9 节所列的恢复期限。

  完全清除只会删除该门店与来自 Xero 的会计数据之间的关联；该组织的 Xero 数据仍会保留。当该组织的每个门店都已完全清除时，最后一次完全清除还会断开该组织的所有 Xero 连接，并像断开连接一样删除其 Xero 数据（见下文）。

• 来自 Xero 的会计数据：只有组织所有者可以在 Moneki 的设置中断开 Xero。断开时，Moneki 会请 Xero 结束 Moneki 的访问，并删除 Moneki 为该连接从 Xero 复制的全部数据，即使 Xero 没有答复或拒绝也是如此（见第 9 节）。在 Xero 的 Connected Apps 页面移除 Moneki 会停止 Moneki 的访问，但 Moneki 已经复制的数据会一直保留，直到在 Moneki 中断开 Xero。删除批准某个 Xero 连接的人的账户，也会以同样方式断开该连接。

• 你的 Google 邮箱和日历：你可以随时在 Moneki 的设置里断开 Google 账号。断开后 Moneki 立即停止读取你的邮件和日程，请 Google 撤销 Moneki 的访问权限，并删除个人助理为你保存的全部内容；例外是审计记录，以及联系不上 Google 时这个连接的记录和加密的令牌：Moneki 会保留它们、不再使用，最长 30 天，只用于再次请求撤销（第 9 节）。你也可以在 Google 账号的设置里移除 Moneki 的访问权限；Moneki 会在下一次使用这个连接时发现，并请你重新连接；如果你 30 天内没有重新连接，连接也会这样结束。

• 你的会议纪要：你可以随时在个人助理里删除一场会议的转写文字和纪要；删除账户时一并擦除。

• 如需删除账户，请联系我们，账户删除由 Moneki 按请求处理。

• 其他请求，请联系我们（第 13 节）：

  • 我们可能需要先核实你的身份；
  • 我们会在 30 天内答复；
  • 如果我们拒绝，会说明原因以及投诉方式。

如果你是某个使用 Moneki 的商户的顾客或员工：这些数据由该商户控制，请先联系该商户。如果你联系我们，我们会把你的请求转给该商户，并协助其答复。

一般性问题可以匿名咨询。但使用本服务无法匿名，因为开设账户需要电子邮箱。

11. 投诉

如有隐私方面的疑虑，请先联系我们（第 13 节），我们会尽量在 30 天内解决。

如果我们在 30 天内没有答复，或你对我们的答复不满意，可以向澳大利亚信息专员办公室（OAIC）投诉。向 OAIC 投诉必须以书面形式提出，例如使用其网站上的在线表格。

• 网站：www.oaic.gov.au
• 邮箱：oaicintake@oaic.gov.au
• 邮寄：GPO Box 5288, Sydney NSW 2001
• 咨询热线（用于咨询，不受理投诉）：1300 363 992

12. 政策变更

当我们的做法发生变化时，我们会更新本政策。最新版本始终发布在 moneki.ai/privacy，生效日期列于页首。如果变更会实质影响我们使用你信息的方式，我们会通过邮件或应用内通知告知账户持有人。

13. 联系我们

Moneki Pty Ltd — 隐私事务
邮箱：hello@moneki.ai
邮寄地址：33 Riseley Street, Ardross, Western Australia