Privacy Policy

Version 2026-10-v5 · 15 October 2026

This policy explains what personal information ZimQi handles, why, and how it is protected. We are an Australian service operated by Findertech Australia Pty Ltd trading as ZimQi Online (ABN 42 631 675 673) under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Early access. ZimQi is in early access. Features, wording and this policy may change as we learn. We will keep this page current and record material consent changes against your account.

Where your data is stored

Your data is kept separate per company (database-level isolation) on a server in Malaysia (Hostinger). It is encrypted in transit.

1. What we collect

Only what timesheets need. For company accounts that means: your name, email and organisation; billing and plan usage; and the timesheet records you and your crew create (crew names, dates, hours, work done, site or attendance details, optional notes).

For workers, ZimQi may record: name, check-in and check-out times, optional location at check-in and check-out when the company turns location on (asked once in Telegram at each of those two moments), the accuracy the phone reports, distance from the site pin, and notes they type. We do not collect information for workflows that are not yet live. As a workflow becomes available we will say what additional information it uses and why before we collect it.

2. Collection notice for crew

When someone joins your company they see a plain collection notice in the Telegram join or welcome message, and again in the footer of their personal check-in link page. It covers: name, check-in and check-out times, optional location when the company has turned location on, and notes. Location is not continuous tracking — if enabled, the worker shares location once at check-in and once at check-out in Telegram, and anything outside the site radius (or not shared) is flagged for review. Live location is never accepted. The company's owners and approving supervisors see the result; ZimQi staff only access it for support.

3. Why we collect it

To draft clean records for your confirmation and to act only once you confirm. We never collect information just in case.

4. How your data is protected

  • Encrypted in transit (TLS).
  • Stored per organisation with database-level isolation — one company cannot see another's data.
  • Credentials for any service you connect are encrypted and only decrypted at the moment an adapter needs one.
  • Consequential actions (money, external sends, irreversible exports) always wait for a named human's confirmation — no AI acts alone.
  • The company audit log cannot be edited or deleted by users. We keep a timestamped record of approvals, edits, exports and admin changes (who did it and when) for the life of the company account, and it is deleted with the account.
  • Before a model call, common personal identifiers in free text (emails, phone numbers, ABNs, known names) are tokenised so they are not sent to the model in clear text.
  • Platform administration screens mask personal details by default; unmasking requires a reason and is logged.

5. Hosting and overseas processing

We do not sell your data. Your data is hosted overseas (Malaysia) and some AI processing happens outside Australia. See the subprocessor register for every overseas recipient we use today, and the purpose of each.

If you connect an AI assistant such as Claude or ChatGPT to ZimQi, the ZimQi data that assistant reads through the connector is sent to its provider (Anthropic or OpenAI) and handled under that provider's terms.

Analytics

We may use Google Analytics 4 to understand how the site and the Telegram bot are used (which features people use, where people get stuck). This is overseas processing: analytics data is handled by Google. To keep this as small as we can, we (a) anonymise IP addresses, (b) never send names, emails, crew member or site names, or the contents of your timesheets — only feature, plan and page category labels — and (c) for the Telegram bot, send a hashed, non-personal identifier rather than your username. We do not use ad remarketing pixels or share this data with advertisers. Analytics runs only when enabled.

See our consent page for the plain-words notice we record at signup.

6. Access, correction and erasure

You can request access to, correction of, or deletion of your personal information at any time by emailing our privacy contact. We respond within 30 days.

7. Retention and breach readiness

Company data, including timesheets and approval history, is kept while the company account is active. When a company account is closed, its data is permanently deleted 90 days after closure. You can also ask us to delete personal information earlier.

Location coordinates, when collected, are deleted automatically 90 days after the work date. The result (near the site, outside it, or not shared), the distance from the site pin, and reported accuracy stay with the timesheet record for as long as the timesheet is kept. Live location is never accepted.

Backups. We take an encrypted database backup every day, and also before software updates. Backups are kept on our server, with an encrypted copy stored off-site in Google Drive that cannot be read without our private key. Each backup is kept for 35 days and then deleted, so a backup can contain copies of data for up to 35 days after it is deleted from the live service.

If a data breach is likely to cause serious harm, we notify the Office of the Australian Information Commissioner and affected individuals as the Notifiable Data Breaches scheme requires.

Questions: contact our privacy team at support@zimqi.com.au (Findertech Australia Pty Ltd trading as ZimQi Online).