Privacy policy
Last updated: 16 July 2026
x0 (x0.co.nz) is operated from New Zealand. We connect your Xero accounting data to desktop Excel and related tools. This policy explains what personal information we collect, how we use it, and your choices. We aim to collect only what we need to run the service and to keep it secure.
Who we are
For the purposes of the Privacy Act 2020 (New Zealand), the operator of x0 is the service provider behind x0.co.nz (McPond). If you have questions about this policy or your information, contact us at davemc@mcpond.co.nz.
What we collect
Depending on how you use x0, we may hold:
- Account details — such as your name, email address, and login credentials you choose when you sign up.
- Xero connection data — when you authorise x0 in Xero, we receive OAuth tokens and identifiers for your Xero organisation(s), plus accounting data you request through the service (for example accounts, journals, and reports).
- API usage — API keys we issue to you, and basic technical logs needed to operate and troubleshoot the service.
- Support and communications — messages you send us and notes we make while helping you.
- Technical information — standard web logs (such as IP address, browser type, and pages visited) and session cookies required for sign-in and security.
We do not ask for information we do not need. We do not sell your personal information.
How we use your information
We use your information to:
- provide, maintain, and improve x0;
- connect to Xero on your behalf and serve data to tools you configure (such as Excel);
- authenticate you and protect accounts from misuse;
- respond to support requests; and
- meet legal and accounting obligations where they apply.
We process information for the purposes you reasonably expect when using a Xero integration and data API. Where the Privacy Act requires a lawful basis, we rely on your authorisation, our contract with you, and our legitimate interests in operating a secure, reliable service.
Sharing your information
We may share information only where needed:
- Xero — when you use Connect Xero, data flows between Xero and x0 under Xero’s own terms and privacy policy.
- Infrastructure providers — such as hosting and email providers that help us run the service. They are required to handle data appropriately and only for our instructions.
- Professional advisers — where reasonably necessary (for example lawyers or accountants).
- Law and safety — if required by law, court order, or to protect rights, safety, or the integrity of the service.
We do not disclose your Xero accounting data to other customers or to marketers.
Storage and security
Your information is stored on systems we control or engage for hosting. We use reasonable technical and organisational measures to protect it — including access controls, encryption in transit (HTTPS), and careful handling of OAuth tokens and API keys. No online service can guarantee absolute security; we work to reduce risk and to respond promptly if something goes wrong.
Some providers may store or process data outside New Zealand. Where that occurs, we take steps consistent with the Privacy Act 2020 for cross-border disclosures.
How long we keep information
We keep personal information for as long as your account is active and as needed to provide the service, resolve disputes, and meet legal requirements. If you close your account or ask us to delete information, we will delete or anonymise it within a reasonable time, except where we must retain certain records by law or for legitimate business purposes (such as security logs).
Your rights
Under the Privacy Act 2020, you generally have the right to:
- ask whether we hold personal information about you;
- request access to that information;
- request correction if it is inaccurate, incomplete, or misleading; and
- raise a concern with us, and if you are not satisfied, complain to the Office of the Privacy Commissioner.
Contact davemc@mcpond.co.nz to exercise these rights. We may need to verify your identity before responding. The Privacy Commissioner can be reached at privacy.org.nz.
Cookies and similar technologies
We use essential cookies and similar technologies for sign-in, session management, and security (including CSRF protection). We do not use advertising trackers on the x0 portal.
Children
x0 is a business service and is not directed at children. We do not knowingly collect personal information from anyone under 16.
Changes to this policy
We may update this policy from time to time. We will post the current version on this page and adjust the “last updated” date. Material changes may also be notified through the service or by email where appropriate.