Privacy Policy

1. Who we are

Antozoe is operated by Anzoe Pty Ltd (ABN 19 918 903 671), trading as Antozoe.

Antozoe is a business-to-business software service for Business Analysts, architects, consultants and delivery teams.

We handle personal information in accordance with this policy and applicable law. Our practices are designed around the Australian Privacy Principles, whether or not every activity is legally subject to the Privacy Act 1988 (Cth).

2. Information we collect

We collect information reasonably necessary to provide, secure, support and improve the Services.

• Account information: name, email address, telephone number, job title, organisation, profile details, authentication identifiers and security events.
• Organisation information: Workspace membership, permissions, invitations, billing contacts and administrative actions.
• Customer Content: transcripts, meeting notes, documents, files, project and stakeholder information, requirements, artefacts, comments, approvals, locks and evidence links.
• Client Portal information: recipient details, access events, comments, approvals, rejections and clarification requests.
• Billing information: Subscription, invoice, payment outcome, transaction identifier, tax and billing contact information. Stripe processes complete payment-card details.
• Technical information: IP address, browser, device, session, logs, feature usage, performance, error and security events.
• Communications: support, security, legal and privacy enquiries and related correspondence.
• AI usage information: provider, model, processing stage, token use, timing, cost and failure metadata where instrumentation is enabled.

3. How we collect information

We collect information directly from users and Administrators, from Customer Content submitted by or for a Customer, automatically through the website and application, and from providers that support authentication, payments, email, monitoring, hosting and other functions.

4. Why we use information

• to create and administer Accounts, Workspaces, permissions, Subscriptions and Client Portal access;
• to receive, store, analyse, review, generate, edit and export Customer Content and Customer-Specific Output;
• to provide AI-assisted analysis requested by the Customer;
• to authenticate users, secure the Services, detect misuse and respond to incidents;
• to process payments, invoices, tax, refunds and Subscription changes;
• to provide support and respond to legal, privacy, access, correction, deletion or complaint requests;
• to maintain, troubleshoot and improve the Services using technical, aggregated or de-identified information;
• to comply with law, enforce agreements and establish or defend legal claims;
• to send necessary service communications and, with consent or another lawful basis, marketing communications.

5. Customer responsibility for submitted information

The Customer is responsible for deciding what information to submit, giving required privacy notices, obtaining authority or consent, complying with meeting-recording and employment laws, and responding to individuals whose information it controls.

Customers should minimise personal and sensitive information. Unless agreed in writing, Antozoe is not designed for government security-classified information, payment-card data, authentication secrets, biometric templates or specialised regulated health-record hosting.

6. AI processing and human review

When a Customer starts analysis, Customer Content may be sent to one or more approved AI Providers, including OpenAI, Google, xAI and Anthropic, depending on the configured workflow.

AI processing may occur in the United States or another country in which a provider operates. The primary Antozoe database and file-storage project is hosted through Supabase in Sydney, Australia. Australian hosting does not mean that Customer Content never leaves Australia.

Antozoe does not use identifiable Customer Content to train a general-purpose public AI model unless that use is clearly disclosed and authorised where required. AI Provider retention, abuse-monitoring and training settings depend on the applicable provider Account and contract.

AI Output requires human review. Antozoe’s own service is designed to provide decision-support Output rather than determine an individual’s legal rights or similarly significant interests automatically. Customers must assess their own use of Antozoe Output in decisions about people.

7. Disclosure and subprocessors

We disclose information only where reasonably necessary for the purposes in this policy, with consent, or where required or authorised by law.

Our main provider categories include database, authentication and storage; application hosting; AI processing; payments; email delivery; error monitoring; and queueing or scheduled jobs.

The current provider list is published in the Antozoe Subprocessor List. We do not sell personal information for third-party advertising.

8. Overseas processing

Personal information may be processed in Australia, the United States and other countries where approved providers operate.

Where applicable, we take reasonable contractual, technical and organisational steps before disclosing personal information overseas. Overseas privacy protections may differ from Australian law.

9. Workspace, administrator and Client Portal access

Customer Workspaces are logically separated through application-level organisation, project and role controls. Authorised Antozoe personnel or platform Administrators may access customer information where reasonably necessary for support, security, legal compliance or verified recovery.

Customers are responsible for assigning suitable permissions, reviewing sharing settings and revoking access.

Some Client Portal links may operate as bearer links. A person who obtains a valid link may be able to access the shared content until the link is revoked or expires.

10. Security

We use administrative, technical and organisational safeguards appropriate to the nature of the Services and information processed. Measures may include encrypted transport, provider-managed encryption at rest, authentication, application-level access controls, logging, monitoring, backups, secure development practices and incident response.

No online service can guarantee absolute security. Customers remain responsible for endpoint security, Account credentials, authorised-user management and their own copies or exports.

Where the Notifiable Data Breaches scheme applies, we will assess suspected eligible data breaches and make required notifications. Otherwise, we will still assess serious incidents and notify affected Customers where appropriate.

11. Retention, export, deletion and de-identification

We retain Customer Content and Account information while reasonably required to provide the Services, administer the Subscription, support the Customer, secure the platform and meet legal obligations.

Customers should export required content before cancelling. We do not presently guarantee a post-termination export window or a complete account-level export unless an Order Form states otherwise.

We take reasonable steps to delete, de-identify or put beyond ordinary use personal information that is no longer needed for a permitted purpose, subject to legal-retention requirements and technical feasibility. Deletion may require manual processing and may not be immediate.

Residual copies may remain in access-controlled database backups for up to seven days before being overwritten in the ordinary backup cycle. Backups are for disaster recovery, not customer archiving.

We may retain billing, tax, security, fraud-prevention, audit and legal records for as long as required by law or reasonably necessary.

Australian privacy law does not provide a general right to erasure in every circumstance. We assess deletion and de-identification requests based on applicable law, identity verification, the purposes for which information is still required and any legal hold.

12. Access, correction and privacy requests

A person may request access to, correction of, deletion of or de-identification of personal information Antozoe holds about them by emailing zoe@antozoe.com with the subject “Privacy request”.

We may verify identity and may refuse or limit a request where permitted by law. We aim to acknowledge requests promptly and respond within a reasonable period.

Where information is controlled by a Customer, we may refer the request to that Customer and assist as reasonably required.

13. Privacy complaints

Send privacy complaints to zoe@antozoe.com. Describe the concern, the relevant Account or Workspace and the outcome sought.

We will investigate and respond within a reasonable period. Where the Privacy Act applies and a person remains dissatisfied, they may be entitled to complain to the Office of the Australian Information Commissioner.

14. Cookies and similar technologies

We use necessary cookies and similar technologies for authentication, security, session management and preferences. Optional analytics or marketing technologies will be used only where enabled and, where required, after consent.

Users can control optional technologies through the consent interface or browser settings. Disabling necessary cookies may prevent the Services from operating.

15. Marketing communications

We may send necessary Account, billing, security and service messages.

Commercial electronic messages will identify Antozoe, be sent with consent or another lawful basis, and include a functional unsubscribe method. We will action unsubscribe requests within five working days where the Spam Act 2003 applies.

16. Automated-decision transparency

From 10 December 2026, if Antozoe is subject to the relevant Privacy Act requirements and arranges for a computer program to use personal information in a decision that could reasonably be expected to significantly affect an individual’s rights or interests, this policy will describe the kinds of information and decisions involved.

At the effective date of this policy, Antozoe’s own service is designed to provide decision support requiring human review, rather than determine an individual’s rights or interests automatically.

17. Children

Antozoe is intended for business users aged 18 years or older and is not directed to children.

18. Changes to this policy

We may update this policy to reflect changes to law, providers, the Services or our practices. We will publish the updated version and give reasonable notice of a material change where practicable.

19. Contact

Anzoe Pty Ltd (ABN 19 918 903 671), trading as Antozoe.

Registered office: 46 Devereaux Street, Oak Park VIC 3046, Australia.

Website: https://antozoe.com.

Privacy, legal, security and support enquiries: zoe@antozoe.com.