Subprocessor Register

Version 2026-10-v1 · Last updated: 4 October 2026

In accordance with the Privacy Act 1988 (Cth) and Australian Privacy Principle 8 (cross-border disclosure), this register lists all third-party entities authorized to process customer personal information on behalf of ZimQi.

Subprocessor	Purpose	Data Processed	Location	Safeguards
Hostinger International Ltd	Cloud VPS server hosting & database execution	All platform data, customer database, application logs	Kuala Lumpur, Malaysia	Standard contractual clauses & encrypted storage
Telegram FZ-LLC / Telegram Messenger Inc	Messaging channel for bot check-in/out and approval cards	Telegram usernames, IDs, messages, shift notes, and photos	Global / Distributed	APP 8 disclosure; no sensitive payroll or card data sent to chat
OpenRouter Inc / OpenAI LLC	Narrow LLM text extraction & voice transcription	Raw shift notes, timesheet photos, voice audio	United States	Zero Data Retention (ZDR) mode; PII pre-redaction filter
Stripe Payments Australia Pty Ltd	Credit billing and subscription payment processing	Billing email, business name, payment identifiers	Australia / United States	PCI-DSS Level 1 certified; hosted checkout
Google LLC (Google Workspace)	Transactional email delivery (reset links, invites)	Recipient email, user name, one-time invitation links	United States / Global	Google Cloud Data Processing Addendum; TLS in transit
Google LLC (Google Analytics 4)	Product performance and aggregated usage analytics	Pseudonymized client IDs (HMAC-SHA256 salted), event types	United States	2-month retention; no names, emails, or raw tenant IDs

Updates and Notifications

We notify company account owners at least 30 days prior to engaging any new subprocessor that handles personal information. You have the right to object to any new subprocessor by contacting us or closing your account before the effective date.

Operated by Findertech Australia Pty Ltd (ABN 42 631 675 673), Sydney NSW. For inquiries: privacy@zimqi.com.au.