Privacy Policy

This policy explains how we collect, hold, use and disclose personal information when you use OnloZap, our website and related services. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

We deal with personal information in two roles:

• For our own purposes. This covers account holders, website visitors and people who contact us. We decide how that information is used.
• On behalf of our Customers. Businesses that use OnloZap store information about their own clients, contacts and staff in their workspace (for example, names on invoices, or client portal contacts). The business decides what to collect and how to use it. We process it to provide the service. If you are one of their clients, please also read that business's privacy policy, and contact them first about their handling of your information.

• Account information: name, email address, password (stored only as a secure hash by our authentication provider), workspace and role. If you sign in with Google, we also receive your name, email address and profile picture from Google.
• Workspace content: client records, quotes, invoices, projects, tasks, time entries, messages, files, documents and settings that you and your team enter.
• Client portal information: names and email addresses of client contacts, and their activity, such as viewing documents, accepting quotes, paying invoices and sending messages.
• E-signature records: signer names and email addresses, signatures, consent, IP addresses, device and browser information, and timestamps, kept as the audit trail for signed documents.
• Billing information: plan, subscription status and payment references. A card is required to start a Freelancer or Studio trial. Card details are collected and held by Stripe. We never see or store full card numbers.
• Terms and privacy acceptance records: your account identifier, the document versions you accepted, the acceptance time and method, and limited IP address and browser information. We keep these records to show which documents you accepted and to investigate account, security or legal disputes.
• AI interactions: prompts you send to Zapling, the workspace context needed to answer them, and the responses.
• Technical information: IP address, browser and device type, pages and actions requested, error reports, and security logs.
• Communications: messages you send to support, and your email preferences.

We collect personal information directly from you, from your organisation when it invites you (as a User or client contact), from Google if you choose Google sign-in, from Stripe about payment status, and automatically when you use the service. You can visit our public website without giving us your name. You cannot use the application anonymously, because we need to identify you to secure your account.

• to provide, operate and secure OnloZap and the client portal;
• to authenticate you and enforce permissions and workspace boundaries;
• to send transactional messages, such as invitations, quotes, invoices, signing requests, reminders, security notices and billing notices;
• to process subscriptions and payments;
• to provide AI features when you use them;
• to provide support, investigate problems and prevent abuse or fraud;
• to maintain and improve reliability and features, using aggregated information where possible;
• to send product news, only where the law permits it. Every marketing email includes an unsubscribe link;
• to meet our legal obligations and resolve disputes.

When you use Zapling, the relevant workspace content is sent to our AI provider to generate a response, and content is checked for safety. We request that providers do not use your content to train their models. Zapling only accesses data you have permission to see, and it asks for confirmation before taking actions.

We do not use Customer workspace content to train AI models. We do not sell personal information, and we do not use Customer workspace content for advertising.

We disclose personal information to service providers who help us run OnloZap, only for that purpose and under contractual confidentiality and security obligations:

• Provider

  Supabase

  Purpose

  Database, authentication and file storage

  Location

  Australia (Sydney)

• Provider

  Vercel

  Purpose

  Application hosting (Sydney region) and AI Gateway routing

  Location

  Australia, United States

• Provider

  Stripe

  Purpose

  Subscription billing and payments to Customers

  Location

  Australia, United States

• Provider

  Resend

  Purpose

  Transactional email delivery

  Location

  United States

• Provider

  OpenAI (through Vercel AI Gateway)

  Purpose

  Zapling AI features and content safety checks

  Location

  United States

• Provider

  Sentry

  Purpose

  Error monitoring (no default personal data, URLs redacted)

  Location

  United States

• Provider

  Upstash

  Purpose

  Rate limiting and abuse protection

  Location

  Region of our configured database

• Provider

  Inngest

  Purpose

  Background job scheduling

  Location

  United States

• Provider

  Google

  Purpose

  Sign-in, if you choose "Continue with Google"

  Location

  United States

We may also disclose personal information:

• within a Customer's workspace and portal, as that Customer configures it (for example, showing an invoice to the client it is addressed to);
• to professional advisers, such as lawyers and accountants, under confidentiality;
• when required or authorised by law, or to protect rights, safety or property;
• to a buyer or successor if our business is sold or restructured, subject to this policy.

Our main database and file storage are in Australia (Sydney). Some providers listed above process information in the United States, including for email delivery, AI features, error monitoring and job scheduling. Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs, including through contractual obligations.

We use workspace isolation enforced in the database, role-based access control, encryption in transit, hashed access tokens, validation and restrictions on uploaded files, rate limiting, audit logs and monitoring. Access by our personnel is limited to what is needed to operate and support the service. No method of transmission or storage is completely secure. If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

• Account and workspace information is kept while the account is active.
• After a workspace is closed, Customer Data is available for export for 30 days, and is then deleted from live systems. Backup copies expire on their normal cycle.
• Billing, tax and e-signature audit records are kept for as long as the law requires or as needed to establish and defend legal claims. This is usually up to seven years.
• Terms and privacy acceptance records may remain after an account closes when needed to establish which documents were accepted, resolve disputes or meet legal obligations.
• Security logs are kept for as long as they are useful to protect the service.

• You can view and correct most information directly in the application, and you can ask us for a copy of your personal data in a portable format (JSON).
• You can request access to, or correction of, the personal information we hold about you, or ask us to delete it, by emailing privacy@onlozap.com. We will verify your identity and respond within 30 days. We do not charge for making a request.
• We may keep information we must retain by law, or need for security, billing or legal claims. If we refuse a request, we will tell you why and how to complain.
• If the information is held in a Customer's workspace (for example, you are their client), we will refer your request to that Customer where appropriate, because they control that information.

We send marketing emails only with your consent or where the Spam Act 2003 (Cth) otherwise permits it. You can unsubscribe at any time using the link in the email or your notification settings. Transactional and security messages about your account are not marketing, and they continue while you have an account.

We use cookies and browser storage that are needed for sign-in, security and your preferences. We do not use advertising or cross-site tracking cookies. See our Cookie Policy.

OnloZap is a business service and is not directed to children. Account holders must be at least 18 years old.

If you have a question, or believe we have breached the APPs, email privacy@onlozap.com with details. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

We may update this policy as the service or the law changes. We will change the date at the top and, for significant changes, tell account holders by email or in the application before the change takes effect.

Privacy Officer, Aerdox Group Pty Ltd trading as OnloZap (ABN 23 695 032 109), Victoria, Australia. Email privacy@onlozap.com.