Xero’s privacy notice now describes collecting government-issued identification, facial imagery and biometric data for identity verification, plus sanctions screening and sharing with security and compliance partners that may act as independent data controllers. It also adds guidance on requesting review of automated decisions, clarifying customers’ options and the expanded handling of sensitive data.
Machine-written from the diff below (Sol; type: terms change). Check the diff before relying on it.
What changed
Struck in red is what Xero removed; blue is what they added. Muted text is unchanged context.
BeforeAfter
Changed#1
Before: …Offer ends ‹date› . Terms apply. Buy now 1 4 Days 1 1 Hours 2 7 Mins 5 1 Secs Pricing Features Popular features Accounting Software Manage…
After: …Offer ends ‹date› . Terms apply. Buy now 0 8 Days 1 0 Hours 3 1 Mins 3 6 Secs Pricing Features Popular features Accounting Software Manage…
Changed#2
Before: …get it How we use your personal data ’ Cookies and similar tracking technologies How we share…
After: …get it How we use your personal data Automated decision-making Cookies and similar tracking technologies How we share…
Added#3
Before: …our services. We source this directly from you. nothing here We source this directly from you or from…
After: …our services. We source this directly from you. Verification and identification data to verify your identity and the details of your business, we collect government-issued identification documents such as passports and driver's licenses. We also may collect facial imagery and biometric data (including facial recognition templates) to match you to your identity documents and ensure it really is you when accessing our services through your login. We source this directly from you or from…
Changed#4
Before: …you, our business and people, we may use malware and other monitoring tools to detect suspicious activity…
After: …you, our business and people, we may use anti-malware and other monitoring tools to detect suspicious activity…
Changed#5
Before: …and uploaded content. For legal and regulatory compliance. For example, to comply with any legal and regulatory obligations which apply to us.…
After: …and uploaded content. For legal and regulatory compliance. To comply with all legal and regulatory obligations which apply to us.…
Changed#6
Before: …all legal and regulatory obligations which apply to us, including responding to requests under data protection or other applicable laws.…
After: …all legal and regulatory obligations which apply to us. This includes sanction screening, where we use your identity and business data to screen against international and domestic sanctions lists to ensure we are not providing services to prohibited individuals or entities in compliance with laws in the jurisdictions where we operate. Legal and regulatory compliance may also require us to respond to information requests under data protection or other applicable laws.…
Added#7
Before: …data, communications data, device data, service usage data, nothing here To manage legal claims. For example, to preserve…
After: …data, communications data, device data, service usage data, uploaded content, and verification and identification data. To manage legal claims. For example, to preserve…
Added#8
Before: …Please contact us using the details in the nothing here Cookies and similar tracking technology We use cookies…
After: …Please contact us using the details in the 'How to contact us' section. You can give us information you'd like us to take into account, ask us to explain the decision in general terms, and ask us to review it. There are limits on what we can tell you — for example, where the law prevents us from doing so, or where explaining the details would undermine the prevention or detection of crime. 7. Cookies and similar tracking technology We use cookies…
Changed#9
Before: …control them, please see our cookie notice . 7. How we share your personal data There will…
After: …control them, please see our cookie notice . 8. How we share your personal data There will…
Added#10
Before: …their own marketing purposes without your explicit consent. nothing here Third party services that you integrate with on…
After: …their own marketing purposes without your explicit consent. Security and compliance partners: We share personal data with specialized partners, who provide identity verification, sanctions screening, and fraud detection services. These partners may act as independent data controllers for certain activities, such as verifying your identity against global databases. They may also use anonymised or aggregated data across their network to improve fraud detection models and platform security for all users. Third party services that you integrate with on…
Changed#11
Before: …your use of our services with that subscriber. 8. Personal data retention We'll retain your personal data…
After: …your use of our services with that subscriber. 9. Personal data retention We'll retain your personal data…
Changed#12
Before: …that, we'll make sure it’s deleted or anonymised. 9. Security Security is a priority for us when…
After: …that, we'll make sure it’s deleted or anonymised. 10. Security Security is a priority for us when…
Changed#13
Before: …from them, sign up to our security noticeboard. 10. International transfers When we share personal data, it…
After: …from them, sign up to our security noticeboard. 11. International transfers When we share personal data, it…
Changed#14
Before: …safeguards in place to protect your personal data. 11. Your rights It’s your personal data and you…
After: …safeguards in place to protect your personal data. 12. Your rights It’s your personal data and you…
Changed#15
Before: …to advise you how to submit a complaint. 12. Updates to this notice We may update this…
After: …to advise you how to submit a complaint. 13. Updates to this notice We may update this…
Changed#16
Before: …notice on our websites and in our apps. 13. How to contact us We’re always keen to…
After: …notice on our websites and in our apps. 14. How to contact us We’re always keen to…
Changed#17
Before: …else, you can contact us at legalnotices@xero.com . 14. Additional information if you’re in the EEA or…
After: …else, you can contact us at legalnotices@xero.com . 15. Additional information if you’re in the EEA or…
Changed#18
Before: …(for a description of each purpose, see the ‘ section): Contractual necessity. We need certain personal data…
After: …(for a description of each purpose, see the ‘How we use your personal data’ section): Contractual necessity. We need certain personal data…
Compared with the previous archived version (#3622 to #7949). Text is normalized before comparing: dates, counters and tokens show as ‹date›, ‹count›, ‹tok›, and noise-only edits are hidden. Rewindex shows changed passages with a few words of context, not a copy of the page. View the live page (opens in new tab).
Archive proof
Rewindex commits each page capture it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.
Xero’s promotional banners reduced the discount from 90% to 80% off for the first 3 months, while another banner shortened the 80%-off period from 6 months to 3 months. These are promotional offer changes on the privacy page, advertising less introductory savings rather than changes to privacy terms.
Xero’s Privacy page changed only the promotional countdown near “Buy now,” from 7 Days 12 Hours 07 Mins 54 Secs to 5 Days 11 Hours 07 Mins 59 Secs. No privacy terms, prices or features changed in the shown diff.
Xero’s privacy page changed only the promotional countdown timer near “Buy now”; no privacy terms or customer-facing features changed in the provided diff.
Monday, October 26
1 page change
Content changed
Page change
Privacy policychangedthis change
Xero’s privacy notice now describes collecting government-issued identification, facial imagery and biometric data for identity verification, plus sanctions screening and sharing with security and compliance partners that may act as independent data controllers. It also adds guidance on requesting review of automated decisions, clarifying customers’ options and the expanded handling of sensitive data.
The privacy page’s promotional text changed from 80% to 90% off and from the first 3 to 6 months. Navigation removed “Refer a friend,” and the footer replaced “Do Not Sell My Personal Information” with “Manage cookies”; the diff shows marketing and navigation changes, not privacy-policy terms.
Cite this
Privacy (legal) page changed on Xero’s Privacy (legal) page, changed 2026-10-26 08:45 UTC (change 3 of 6).