Privacy policy
What personal information we collect, why, where it goes, and your rights.
Version 1.2 · Last updated · Zhon1 Tech Pty Ltd
Zhon1 Tech Pty Ltd (ACN 700 514 478, ABN 84 700 514 478) ("Zhon1", "we", "us") makes software products for businesses and builds websites for businesses and individuals. This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We follow the APPs whether or not the small business exemption applies to us.
1. Whose information we handle
- Visitors to zhon1tech.com.
- People who contact us, for example to book a demo or a free website consultation.
- Our customers' users: people who sign in to one of our products.
- Our customers' customers: people whose details our customers enter into a product (for example a name or address on a solar quote). For this information we act as a service provider to our customer, who decides what is collected. See section 8.
- Website clients: people and businesses we build or maintain websites for.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Contact details | name, email, phone number, business name | you, when you contact us or sign up |
| Account details | name, mobile number, email, role, encrypted password hash | you, when you create an account or accept an invite |
| Business details | company name, ABN, business address | you; ABN details are checked against the public Australian Business Register |
| Product data | pricing configuration, saved quotes, any customer name, reference or address your staff enter | our customer and its users |
| Billing details | subscription status, invoices, billing address | you and our payment provider Stripe. Card details go directly to Stripe and never reach our servers. |
| Enquiry details | what you tell us about your project, your current website address | you |
| Technical details | sign-in session cookies, your cookie choice, server logs (IP address, browser, time) for security | your device |
We do not collect sensitive information (such as health information) and ask you not to enter it into our products.
3. Why we use it
- To provide, secure and support our products and services, including sign-in, keeping each customer's data separate, and audit logs.
- To respond to enquiries, run demos and consultations, and prepare quotes for website work.
- To process payments and send transactional emails (receipts, invoices, password resets, renewal reminders).
- To meet legal obligations, including tax record-keeping.
- With your consent only: to send you product news or marketing, and to run analytics on how the website is used.
4. Marketing
We only send marketing emails if you have opted in (for example by ticking the separate, unticked box on a form). Every marketing email identifies us and has an unsubscribe link, which we action within 5 business days. Transactional emails about your account are not marketing.
5. Cookies
We use only essential cookies. If you choose "Accept all", we also run Vercel Web Analytics and Vercel Speed Insights, which count page views and measure how fast pages load. They set no cookies, do not track you across other websites and do not identify you; Vercel processes the data on our behalf. If you choose "Essential only", neither runs.
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
sb-…-auth-token |
Keeps you signed in to the product (Supabase) | Essential | Session, refreshed while you are signed in |
zt-cookie-consent |
Remembers your cookie choice | Essential | 12 months |
You can change your choice at any time with "Cookie settings" in the website footer.
6. Who we share it with
We do not sell personal information. We share it only with the service providers that run our business, when required by law, or with your consent.
| Provider | What they do for us | Where data may be processed |
|---|---|---|
| Supabase Inc. | Database, sign-in and file storage | Data stored in Sydney, Australia; provider staff may access it from the United States and other countries for support and security |
| Vercel Inc. | Website and application hosting; with your consent, page-view and page-speed analytics (Web Analytics, Speed Insights) | United States and other countries (global network) |
| Stripe (Stripe Payments Australia Pty Ltd and its affiliates) | Payments, subscriptions and invoices | Australia, the United States and other countries |
| Google LLC (Google Workspace) | Our business email | United States and other countries |
| Google LLC (Google Maps Platform) | Business-address suggestions during sign-up, if you use them | United States |
| Australian Business Register (Australian Taxation Office) | Confirming an ABN is active | Australia |
When information is disclosed overseas, we take reasonable steps (including contractual terms) so it is handled consistently with the APPs.
7. How we protect it
- Encryption in transit (TLS) and at rest.
- Row-level security in our database, so each customer can only access its own data.
- Server-only handling of sensitive pricing and cost information.
- Least-privilege access to production systems, audit logs of key changes, and regular security reviews.
8. Information we hold for our customers
When our customer (for example a solar installer) enters its own customers' details into our product, our customer is responsible for collecting that information lawfully and for its privacy notices. We handle it only to provide the product, as set out in our Data Processing Addendum. If you are one of our customer's customers and want to access or correct your information, please contact that business first; we will help them respond.
9. Automated decisions
We do not make decisions about individuals using automated processing. Our products calculate figures (such as quote prices and rebate estimates) that our customers review before using.
10. How long we keep it
- Account and product data: while the account is active, then 60 days after it closes so it can be exported, then deleted from active systems (backups roll over in their normal cycle).
- Enquiries that do not become work: up to 2 years.
- If you delete your account yourself (Account → Privacy & data): your sign-in and personal details are deleted 30 days after you ask, and you can cancel until then. Records that belong to your business, such as quotes, stay with the business without your name.
- Tax and billing records: 5 years, as required by Australian tax law.
- Security logs: up to 12 months.
11. Access, correction and complaints
You can view and update most of your details in your account. Under Account → Privacy & data you can also download a copy of your personal information and delete your account yourself. To ask for anything else, such as a correction we can't do in the app, or to make a complaint, email info@zhon1tech.com. We will respond within 30 days.
If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
12. Data breaches
We follow the Notifiable Data Breaches scheme. If a breach is likely to cause serious harm, we will notify the people affected and the OAIC. Where the information belongs to our customer, we will tell our customer promptly so it can meet its own obligations.
13. Changes to this policy
We will update this policy when our practices change. The version and date at the top show the latest update. If a change is significant, we will tell account holders by email.