Privacy Policy: Accounting Sync for Xero

A supplement to the Adaptive Pace Pty Ltd Privacy Policy

Effective date: 20 July 2026 · Last updated: 4 November 2026

This page covers the details specific to Accounting Sync for Xero (the "App"). It supplements our main Privacy Policy, which sets out how Adaptive Pace Pty Ltd handles data across all of our Apps — including our legal bases, data transfers, security, your rights, retention principles, and contact details. Read the two together. Where this page gives more specific detail for this App, it governs for this App.

1. About this App and our role

Accounting Sync for Xero synchronises data between a customer's monday.com account and their Xero organisation. It is installed by a monday.com account administrator and connects to one Xero organisation per install; data flows are directed by the customer.

Our role: we act as a processor for the business data synced between the customer's monday boards and Xero organisation, on the customer's documented instructions; and as a controller for the installer/support contact details and billing information described in the main policy.
Hosting region: the United States (the App runs on monday "monday code", on Google Cloud infrastructure).

2. Data this App synchronises

Depending on which features the customer enables and how they map their columns, the App may process:

Contacts: names, email addresses, phone numbers, postal and physical addresses, and business tax identifiers (for example an ABN/ACN, or the equivalent GST/VAT number).
Products and services: item codes, names, descriptions, prices and tax settings.
Invoices: customer reference, line items, amounts, dates and payment status (draft, awaiting payment, partially paid, overdue, paid, voided).
Bills (accounts payable): supplier reference, line items, amounts, dates and status.
File attachments, where enabled: files attached to a monday item that the customer chooses to upload to the corresponding Xero invoice.

This business data may contain personal data of the customer's own customers, suppliers and staff. The customer determines what data is included and is responsible for having a lawful basis to sync it.

2.1 Account and authentication data

monday identifiers: the monday account ID, user ID and user role (admin, member, guest) contained in the signed session token.
Xero organisation identifiers: the Xero tenant ID and the organisation's display name, currency and timezone.
OAuth tokens: a long-lived monday access token and a Xero refresh token, used to perform sync on the customer's behalf, including scheduled background sync.
Configuration: the customer's sync settings and column mappings, and internal link records that map a monday item to its corresponding Xero record.
Contact display names. To show a readable customer name on your board and in the receivables dashboard, the App stores the Xero contact’s display name in three places: internal invoice link records, the receivables dashboard snapshot, and a short-lived (24-hour) name cache. These are the only contact personal data the App stores. Contact email addresses, phone numbers, postal and physical addresses and tax identifiers are processed in transit only and are never written to our storage. Stored contact display names are encrypted with AES-256-GCM before being written, in addition to the encryption monday.com applies to its own storage layer.

3. Permissions this App requests

monday.com: identify the connected account; read board and item data; write sync results back to items; list and create the boards and workspaces used for sync; create and manage the App's own webhooks for live sync; and post status comments on items.
Xero: maintain a refresh token for background access; read and write Contacts; create invoices and read invoice and bill status; read organisation currency and tax settings and manage Products & Services; and, where enabled, upload invoice attachments.

A per-permission justification is available on request.

4. Sub-processors for this App

monday.com — the platform the App runs on and is hosted by (monday "monday code", on Google Cloud infrastructure). Region: the United States.
Xero — the accounting platform the App integrates with, per the customer's connection.
Content delivery network (jsDelivr) — the App's in-product interface loads the official monday JavaScript SDK from a public CDN, which may receive your IP address as part of serving that script.

This is in addition to the general categories of recipient listed in the main policy. A current list of sub-processors is available on request.

5. Retention and deletion for this App

The retention principles in the main policy apply. Specific to this App:

While installed: we retain OAuth tokens, configuration and internal link records for as long as the App is installed and connected, so sync can operate.
Contact display names (see section 2.1): the display names held in internal invoice link records and the receivables dashboard snapshot are retained and deleted as described below. The name cache expires after 24 hours.
On disconnecting Xero: the App deletes the stored Xero tokens and the related per-organisation data it holds.
On uninstalling the App: the App purges the account's stored tokens, configuration, sync link records and dashboard snapshots.
Data in your own systems: records the App has already written into your monday boards or your Xero organisation remain in those systems and are controlled by you.

6. Operational data and browser storage

Diagnostic logs: operational logs (event type, record identifiers, error reasons, timestamps) used to run, monitor and debug the service. Access tokens, refresh tokens and signing secrets are redacted and never written to logs.
Local browser storage: the App's dashboard temporarily caches its last results in your browser's sessionStorage to avoid flicker. This is cleared when the session ends and is not used for tracking.

7. Contact

For anything about this App or your data, contact support@adaptivepace.com. Our full contact details and your rights are set out in the main Privacy Policy.