Last updated 1 November 2026 · Zaur Partners, ABN [●], Melbourne, Victoria, Australia
01Who this covers
Zaur Partners (“Zaur”, “we”, “us”) builds, hosts and looks after subscription software for businesses in Australia and Indonesia. This policy covers personal information we collect from three groups:
aWebsite visitors — anyone who browses our site or sends an enquiry.
bClients and their staff — the businesses we build for, and the people who log in to use what we build.
cOur clients’ customers — people whose details pass through software we host on a client’s behalf (for example, someone who rings a client’s phone line answered by an AI receptionist, or a student whose work is marked by a client’s assessment tool).
We’re bound by the Australian Privacy Act 1988 and the Australian Privacy Principles. Where we handle information for a client, we do so on that client’s instructions, and the client is responsible for telling their own customers how their information is used. Section 04 explains that split.
02What we collect
aWhen you enquire. Business name, your name and position, email, phone number, location, the kind and size of your business, and whatever you tell us about the problems you want solved. We also generate a brief reference number.
bWhen you become a client. Contact and billing details, ABN, the names and work emails of staff who need logins, and the records of our conversations, proposals and support requests.
cWhen you use software we host. Login details (passwords are stored hashed, never in plain text), what you do inside the software, device and browser information, IP address, and the dates and times of use. This is how we keep it secure and working.
dWhen you visit our website. Standard server logs (IP address, browser, pages visited, time) and, if we use analytics, aggregated information about how the site is used (section 10).
eInformation you give us about other people. If you give us a colleague’s or customer’s details, you confirm you’re allowed to and that they know about it.
We don’t ask for, and please don’t send us, sensitive information — health details, government identifiers, financial account numbers — unless a specific piece of software we build for you needs it, in which case your Order will say so and how it’s protected.
03Why we collect it
Only for reasons you’d expect:
aTo answer your enquiry and prepare a proposal.
bTo build, run, host, support, secure and improve the software you subscribe to.
cTo invoice you and manage your account.
dTo tell you about changes to your service, these terms, or things we think are relevant to you. You can opt out of anything that isn’t about your account.
eTo meet our legal obligations.
We do not sell personal information. We do not rent it, trade it, or give it to anyone for their own marketing. That is the whole of our position on it.
04Data our software handles for clients
Most of the personal information that passes through Zaur isn’t ours — it belongs to our clients and their customers. A phone-answering assistant hears callers’ names and numbers. A field app holds a crew’s shift notes. An assessment tool holds students’ work.
aFor that information, the client is the controller and we act on their instructions. We use it only to provide the service to that client, to keep it secure, and as the law requires.
bWe don’t look at it except to support the client, fix a problem, or where we’re legally required to.
cWe don’t use one client’s data to build or train anything for another client, unless that client agrees in writing. Aggregated, de-identified statistics about how a system is used (how many calls a month, say) aren’t personal information and may be used to improve the platform.
dIf you are a customer of one of our clients and want to access or correct your information, contact that business first. We’ll help them respond.
05AI, call recordings and transcripts
Some of our software uses artificial intelligence, including voice assistants that answer phone calls. Where that’s the case:
aCalls may be recorded, transcribed and summarised so the client can see what the caller needed. The client is responsible for telling callers that calls are recorded, where the law requires it. Our assistants can announce this at the start of a call.
bAudio and text may be processed by third-party AI and telephony providers to do that work (section 06). We choose providers that don’t use our clients’ data to train their public models, and we say which providers are involved in each client’s Order.
cAI outputs are generated automatically and may be wrong. They’re an aid to a human decision, not the decision itself, and we design our software so a person stays in the loop where it matters.
06Who we share it with
We share personal information only with:
aService providers that help us run the software — cloud hosting, databases, telephony, AI model providers, email delivery, payment processing and error monitoring. They can only use the information to provide their service to us, and they’re bound by their own privacy and security obligations.
bOur own team, including staff and contractors in our Indonesian office, on a need-to-know basis and under confidentiality obligations.
cProfessional advisers such as accountants, lawyers and insurers, where needed.
dRegulators, courts or law enforcement where the law requires or allows it.
eA buyer of our business or the relevant part of it, if that ever happens — and we’d tell you.
Never to data brokers, advertisers or anyone who wants to market to you.
07Overseas disclosure
We’re an Australian business with an office in Indonesia, and some of the service providers we use operate outside Australia. That means personal information may be accessed from, or processed in:
aIndonesia — by our own team, for support and development work.
bThe United States and other countries where our cloud, telephony, AI and email providers operate.
Before we disclose information overseas we take reasonable steps to make sure the recipient handles it in a way consistent with the Australian Privacy Principles, through contracts and by choosing providers with strong security practices. Where an Order promises that your data is hosted in Australia, the primary storage stays here; the overseas processing above is limited to what’s needed to make a specific feature work, and your Order says which.
08Where it’s stored and how it’s protected
aLocation. For Australian clients, the software and its data are hosted on servers located in Australia. For clients served from our Indonesian office, the hosting location is stated in their Order.
bSecurity. Encryption in transit and at rest, role-based access controls, logging, regular backups, and least-privilege access for our team. Passwords are hashed. We review access regularly and remove it when people leave.
cYour part. Use a strong password, don’t share logins, and tell us straight away if you think an account has been compromised.
No system is completely secure. We take reasonable steps to protect information, and section 13 explains what happens if something goes wrong.
09How long we keep it
aEnquiries that don’t become clients: up to 12 months, then deleted.
bClient account and billing records: for the life of the subscription and then as long as tax and business laws require (generally seven years).
cData inside the software (section 04): for the life of the subscription. After it ends, you can request an export for 30 days; after that we delete it, subject to backup cycles and any legal hold.
dCall recordings and transcripts: for the period set in the client’s Order (by default 12 months), then deleted.
eServer and security logs: up to 90 days.
When we no longer need personal information, we delete or de-identify it.
10Cookies and analytics
Our website uses only the cookies and local storage needed to make it work — for example, to remember a login session in the client portal. We don’t use advertising cookies or tracking pixels. You can block cookies in your browser; the public site will still work, but logging in won’t.
aAnalytics. We use Plausible Analytics to count visits and see which pages are useful. It doesn’t use cookies, doesn’t collect personal information, and doesn’t follow you across other websites. It records aggregated figures only (page views, referring sites, country and device type), and that data is stored in the European Union.
bSpam protection. Our enquiry and partner forms may use Google reCAPTCHA to check a real person is sending them. reCAPTCHA collects hardware and software information, such as device and browser data, and sends it to Google, under Google’s Privacy Policy and Terms.
cBooking a call. If you book a call with us, the booking tool collects your name, email and chosen time so we can meet you.
11Your rights: access, correction, deletion
aAccess. You can ask for a copy of the personal information we hold about you. We’ll respond within 30 days and won’t charge for a reasonable request.
bCorrection. If something is wrong or out of date, tell us and we’ll fix it.
cDeletion. You can ask us to delete your information. We will, unless we need to keep it for a legal reason or to provide a service you still use — and we’ll tell you which.
dOpting out. Any email that isn’t about your account or service has an unsubscribe link. Or just reply and tell us.
eAnonymity. You can browse our site without identifying yourself. We can’t build software for you anonymously, for obvious reasons.
If your information is held in software we run for one of our clients, ask that client first (section 04). We’ll help them.
12Children
Our website and services are for businesses, not children. Some software we build for clients — in education, for example — handles information about students. In those cases the client (the school or provider) is responsible for the lawful collection of that information, we act on their instructions, and the software is built to the relevant standards for the sector, such as the Safer Technologies 4 Schools framework. We don’t knowingly collect information from a child directly.
13Data breaches
If we become aware of a breach that’s likely to cause serious harm to anyone, we’ll follow the Notifiable Data Breaches scheme: contain it, assess it, notify the people affected and the Office of the Australian Information Commissioner, and tell the affected client without undue delay so they can meet their own obligations. We’ll be straight with you about what happened and what we’re doing.
14Complaints
If you think we’ve mishandled your information, email us (section 16) with the details. We’ll acknowledge it within a few days, look into it properly, and come back to you within 30 days. If you’re not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
15Changes to this policy
We’ll update this policy when our practices or the law change. The date at the top tells you when. If a change is significant and affects you, we’ll let clients know by email.
16Contact
Privacy questions, access requests, corrections and complaints:
Zaur Partners
Melbourne, Victoria, Australia
ABN [●]
Email: hello@zaur.com.au
In short: we collect what we need to answer you, build for you and keep your software running. We don’t sell it. Your data stays yours, Australian clients’ data stays in Australia, and you can ask to see, fix or delete what we hold at any time.
