Privacy Policy

Version 2026-10-v3 · 2 October 2026

This policy explains what personal information ZimQi handles, why, and how it is protected. We are an Australian service operated by FinderTech (ZimQi) under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Where your data is stored

Today: your data is stored on an encrypted server that is currently located outside Australia (a Malaysian data centre), isolated per organisation. This is temporary: we are migrating to an Australian (Sydney) region, and we will not advertise an Australian data location until that migration is complete. Destination: when the Sydney region is live, Australian customer data will be hosted and processed in Australia by default.

1. What we collect

Only what a workflow needs. At launch that means: your name, email and organisation; the timesheet records you send us to process (crew member names, dates, hours, the work done, and site/attendance details); and billing/usage information to operate your plan. We do not collect information for workflows that are not yet live. As a workflow becomes available we will say what additional information it uses and why before we collect it.

2. Why we collect it

To draft clean records for your confirmation and to act only once you confirm. We never collect information "just in case" (APP 3).

3. How your data is protected

• Encrypted in transit (TLS).
• Stored per organisation with application-level tenant isolation — one client can never see another's data (APP 11).
• Credentials for any service you connect are encrypted and only decrypted at the moment an adapter needs one.
• Consequential actions (money, payroll, external sends) always wait for a named human's confirmation — no AI acts alone.

4. Hosting and cross-border disclosure (APP 8)

We do not sell your data. Our live pilot servers are hosted overseas in Malaysia (Hostinger), and AI models process content in the United States. We state this plainly per Australian Privacy Principle 8 (cross-border disclosure).

Analytics

We use Google Analytics 4 to understand how the site and the Telegram bot are used (which features people use, where people get stuck). This is a cross-border disclosure: the analytics data is processed by Google (US-based). To keep this as small as we can, we (a) anonymise IP addresses, (b) never send names, emails, crew member or site names, or the contents of your timesheets — only feature, plan and page category labels — and (c) for the Telegram bot, send a hashed, non-personal identifier rather than your username. We do not use ad remarketing pixels or share this data with advertisers.

See our consent page for the plain-words notice we record at signup.

5. Access, correction and erasure (APP 12)

You can request access to, correction of, or deletion of your personal information at any time by emailing our privacy contact. We respond within 30 days.

6. Retention and breach readiness

We keep data only while your account is active and delete on request. If a data breach is likely to cause serious harm, we notify the Office of the Australian Information Commissioner and affected individuals as the Notifiable Data Breaches scheme requires.

Questions: contact our privacy team at privacy@findertechau.com.au (Australian privacy contact; ZimQi is a brand of FinderTech).