Last updated: 16 October 2026
Zimozi Solutions Pty Ltd (“Zimozi”, “we”, “us” or “our”) respects your privacy. This Privacy Policy explains how we collect, hold, use and disclose personal information when you visit zimozi.au, contact us or engage our services.
We handle personal information in accordance with applicable Australian privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles, where they apply to us. Separate privacy notices or contractual arrangements may apply to particular products and client projects.
We collect personal information reasonably necessary to manage enquiries and business relationships and provide our services. This may include your name, email address, telephone number, job title, organisation, project requirements, budget preferences, correspondence and feedback.
We may also collect technical and usage information, including your IP address, device and browser type, pages visited, referring website and interactions with our website.
We generally collect information directly from you through website forms, emails, telephone calls and meetings. We may also receive information from your organisation, an authorised representative or providers helping us manage your enquiry.
You may browse our website without identifying yourself and, where practicable, contact us anonymously or using a pseudonym. If you do not provide information needed for a particular request, we may be unable to respond or provide the requested service.
Please do not send sensitive information, such as health information, unless it is needed for an agreed purpose. Where we need to collect sensitive information, we will seek consent unless collection is otherwise permitted or required by law.
We use personal information to respond to enquiries, arrange consultations, prepare proposals and quotes, deliver and support services, manage client relationships, improve our website, maintain security and meet legal obligations.
We may send relevant marketing communications where we have your consent or are otherwise permitted by law. You can opt out using the unsubscribe facility in our messages or by contacting us. We will action electronic marketing unsubscribe requests within five working days. Service-related communications may continue where necessary.
We do not sell your personal information.
Our website may use cookies and similar technologies to support functionality, remember preferences and understand how visitors use the site. These technologies may collect device information, page views and interactions such as clicks and scrolling.
Third-party tools used to support website analytics, enquiry handling and communications may process information on our behalf. Their own privacy policies may also apply to information they collect directly.
You can manage or disable cookies through your browser settings and use any cookie controls made available on the website. Disabling cookies may affect some website features.
Business visitor identification. We also use our own first-party analytics to understand which organisations visit our website. It records the pages you view, how long you stay and how you arrived, and, on our pages, which sections are on screen and for how long, how far you scroll, which of our links, buttons and FAQ items you click, and any text you copy from our pages. It also notes whether the page is open and in view, idle or in a background tab, and when it is closed, and whether a message from our team in the chat has been read on screen. To recognise the same device when browser storage is cleared or a private window is used, it keeps a one-way code made from basic device settings (screen size, time zone, language, processor, memory and graphics type); the settings themselves are not stored. If you give us a work email address or company name while on a business network, we note that this network’s address block belongs to that organisation (not to you personally) and share it between our websites, so the organisation’s next visit is recognised. It does not record what you type into forms, except your name, email address and phone number (see “Contact details in our forms” below). Your IP address is used once to look up which organisation’s network the visit comes from (for example, a company’s office network), using public network registries and, where those give no answer, the IP data service ipapi.is, which receives only the IP address. It is then deleted. We keep only a one-way hashed value that cannot be turned back into your IP address. If you submit a form with a work email address, we note the company domain of that address (for example, example.com), not the address itself. We do not use this information to identify you personally, and it is not sold or shared with anyone else. We keep this visit information for up to 90 days. To recognise returning visits, we set a first-party cookie containing a random ID, which can last up to 400 days unless you delete it sooner. We also keep a list of IP address ranges registered to organisations, with each organisation’s name. These ranges describe company networks, not individual visitors, and we keep them until they are no longer needed. You can opt out at any time by visiting zimozi.au/?zvi_optout=1 in your browser, and you can send questions to [email protected].
AI chat assistant. Our website may offer a chat with an AI assistant. If you use it, what you type is sent to our AI provider, Groq (US), to generate replies, and is stored with us for up to 90 days. Our sales team can read these chats and may use details you share, such as your name, company, email or phone number, to follow up with you. Members of our team may also send you a message in this chat, including on a later visit, and reply to you in person; these messages are stored with the chat. Please don’t share sensitive information in the chat. To ask us to delete a chat, email [email protected].
Visit summaries and scoring. We use this visit information, and any chat with our assistant, to write short internal notes about each visit and to estimate how interested a visitor may be in our services, so our team can prioritise follow-up and receive visitor reports. Part of this analysis is done by our AI provider, Groq (US), which receives the visit details, the chat and the network or organisation the visit came from, but not your IP address. These notes are kept for up to 90 days with the other visit information and are not used to make decisions with legal or similarly significant effects on you.
Contact details in our forms. If you type your name, email address or phone number into a form on our website, we keep these details with your visit information even if you do not send the form, so our team can follow up on your enquiry. We do not keep anything else you type into a form unless you send it. These details are kept for up to 90 days with the other visit information and are shared between our websites as described below. To ask us to delete them, email [email protected].
Messaging our team without analytics. If you decline our analytics, or have not yet chosen, you can still write to us using the “Message our team” box. It asks only for your message, your email address (so that we can reply) and, if you wish, your name. We use these details only to answer you. The box does not set a cookie, does not record which pages you view, does not give you a visitor ID and does not use the AI chat assistant. To limit spam, your IP address is converted into a one-way code that is kept for about one hour and then deleted; the IP address itself is not stored. Your message reaches our team as an email, sent through our email provider, and is kept in our mailboxes for as long as needed to deal with your enquiry. You can ask us to see or delete it at any time by writing to [email protected].
Our websites together. Zimozi’s websites (zimozi.co, zimozi.sg, zimozi.au, zi.sg and their Insights blogs) share the visit information described above with each other, on our own servers, so we can recognise when the same visitor uses more than one of them. We match visits when you follow a link from one of our websites to another (the link carries a random ID), when you give the same email address or phone number, or when visits come from the same network and device within 24 hours. Your IP address is never shared, only a one-way hashed value. This information is kept for up to 90 days and used for the same purposes.
Business contact information. When an organisation shows interest in our services, we may collect publicly available business contact details of people who work there, such as name, job title, work email and the public web page where it was found. We collect these from that organisation’s own website and from the business email directory Hunter.io, and use them to contact the organisation about our services. We keep these details for up to 90 days in our visitor tool. You can ask us to remove your details at any time by emailing [email protected].
Your choice in the EU, EEA, UK and Switzerland. If you visit from these countries, we ask for your consent before our own visitor analytics start or our AI chat assistant is offered. If you decline or don’t choose, they don’t run, and we only count anonymous totals of how often the question was shown, accepted or declined, by day and country. You can change your choice at any time at zimozi.au/?zvi_consent=reset.
We may share personal information with employees, related entities, contractors and service providers who need it to perform their work for us. These may include providers of hosting, cloud storage, analytics, scheduling, communications, contact management and professional advice.
We take reasonable steps to ensure that providers handling personal information on our behalf are subject to appropriate confidentiality, privacy and security obligations. We may also disclose information with your consent or where required or authorised by law.
Our website may link to external websites. Their collection and handling of personal information are governed by their own privacy policies.
We retain personal information for as long as reasonably needed for the purposes described in this policy, including providing services, maintaining business records and meeting legal obligations. Retention periods depend on the nature of the information and the applicable requirements.
When personal information is no longer needed, we take reasonable steps to securely destroy or de-identify it, unless retention is required by law.
Personal information may be held electronically in business systems and with service providers. We take reasonable technical and organisational measures to protect it from misuse, interference, loss, unauthorised access, modification and disclosure. Access is limited according to work responsibilities.
No method of online transmission or storage is completely secure. If a data breach occurs, we will assess and respond to it and notify affected individuals and the Office of the Australian Information Commissioner where required by law.
You may request access to personal information we hold about you and ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Contact us using the details below and describe your request. We may need to verify your identity.
We will respond within a reasonable period. There is no charge to make an access or correction request. If a reasonable charge applies to providing access, we will explain it beforehand. If we refuse a request, we will explain the reasons, unless the law prevents us, and explain how you can complain.
You may also ask us to delete personal information we no longer need. We will consider the request subject to applicable legal and retention requirements.
Zimozi works with an international group whose published locations include Australia, Singapore, India and Egypt. Where related entities or service providers assist with enquiries, delivery or support, personal information may be accessed, stored or processed outside Australia, including in Singapore, India and Egypt.
Third-party provider locations depend on the services used. You can contact us for information about overseas handling relevant to your enquiry or service. Where we disclose personal information overseas, we take reasonable steps required by applicable Australian privacy law to protect it, including appropriate contractual and security arrangements.
If you have a concern about how we handle personal information, contact us through our contact form, by telephone or by post. Please mark written enquiries “Privacy enquiry” or “Privacy complaint” and provide enough detail for us to investigate, together with your preferred reply details.
We will acknowledge your complaint, investigate the issues raised and aim to respond within 30 days. If more time is needed, we will explain why and keep you informed. If you are dissatisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC), where the matter is within its jurisdiction: www.oaic.gov.au/privacy/privacy-complaints.
We may update this policy to reflect changes to our practices, services or legal obligations. The latest version will be published on our website with an updated revision date.
Privacy enquiries – Zimozi Solutions Pty Ltd
38 Apollo Street, Schofields NSW 2762, Australia
Telephone: +61 469 242 230
Contact form: https://zimozi.au/contact-us/
Website: https://zimozi.au/
When you provide contact details in an enquiry or chat, we may check public registration information, mail records and website content for the supplied email domain to identify possible impersonation. We compare relevant public domain patterns across zimozi.co, zimozi.sg, zimozi.au, zi.sg and their Insights blogs. Shared domain-pattern records do not include email local parts, person names, visitor IDs or identity-verification decisions.
Our configured AI service provider may receive company claims and public domain evidence to explain risk signals for our team. A risk flag is not proof of fraud, and these checks do not automatically establish your identity, employment or authority to represent a company. An enquiry may be held for independent verification before sales follow-up. An email verification code confirms neither employment nor company affiliation.
Review evidence is retained under the same retention period as the associated enquiry; shared recent-domain patterns are kept for up to 30 days. You can contact us using the privacy contact details in this policy to request correction or review of an inaccurate assessment.
We use the website journey, enquiry and booking information described above to review our pages and assess improvements. Our team may record whether an enquiry is qualified. We also keep anonymous snapshots of our own public pages, including desktop and mobile screenshots and page structure, and may use our configured AI provider to analyse these together with relevant journey summaries. AI recommendations are reviewed by our team; they do not automatically change our pages or verify a visitor’s identity. We retain source links and aggregate outcomes to inform later reviews. Visitor-linked analysis follows the retention period for the associated visitor information. Internal team conversations and improvement discussions remain saved until deleted; reusable learning is intended to exclude personal contact details. You may contact us about access, correction or deletion of information relating to you.
Authorised team members can save improvement tasks, approval and ownership decisions, due dates, planning notes, discussion comments and optional image evidence. These records and private images remain available to the team until their task or record is deleted. Team members should include only information needed to explain the work.
For optional read-only AI planning connections, we use an administrator-managed work-email list and a single-use email verification code. Verification records expire after ten minutes; personal connection credentials expire after thirty days or can be revoked earlier. We store protected verification and credential hashes, the work email, a connection label, expiry and limited last-use details, rather than the reusable credential itself.
A verified connection can read team suggestions, related evidence and discussions, saved planning notes and aggregate website activity. It cannot change tasks or access individual visitor profiles, unrelated visitor conversations, administrative settings or secrets. The team member chooses whether to connect an AI service; information they ask it to read is then subject to that service and account arrangements. Adding a work email does not create a WordPress account or automatically contact that person.
For authorised staff using our dashboard, we use the time zone reported by their browser to display dates and accept local date and time inputs. We save this time-zone preference in the staff account so individual task notifications can use it too. Deadlines are stored as UTC instants with the time zone used to enter them. This does not request precise location, GPS permission or an IP-based location lookup, and does not add time-zone collection from anonymous website visitors.
We may use Google’s Gemini API, in addition to our existing AI service, to review screenshots and rendered structure of our public website pages. This image-review lane does not send individual visitor journeys, private conversations, contact details entered by visitors or private team discussions. Google’s free API service may use submitted public-page content and responses to improve its products, under its applicable terms. AI visual findings are dated interpretations requiring human review, not independently verified facts. Saved findings link to their original website, page, device capture and image so authorised team members can inspect them. Relevant scoped summaries can inform our site assistant and team analysis through our access-controlled shared knowledge index. API credentials and raw screenshots are not copied into that shared index.
Our configured AI services include Groq and OpenRouter with compatible upstream model providers. We may route a task to an alternative provider when a service or quota is unavailable. These services process the information needed for the task: relevant conversation and enquiry context for visitor assistance, and authorised team discussions, aggregate activity and page evidence for internal analysis. Private requests through OpenRouter are restricted to endpoints configured not to collect request data for training; prompt publishing is disabled. Their applicable service terms and processing arrangements still apply. Google’s unpaid API lane remains limited to public-page images and structure, as described above. Provider selection does not broaden which visitor or team knowledge an assistant can access. We retain the actual provider, model, source references and limited usage and retry records to support review. Account quotas are coordinated across our websites without sending prompts, images or API credentials in that coordination.
Authorised team members use a private workspace to review retained visitor journeys and conversations, organise enquiries and work, and record internal decisions, discussions and dated meeting notes. Human qualification decisions are separate from AI scores and booking clicks. Meeting notes and team discussions remain available until explicitly removed; visitor-linked evidence continues to follow the existing visitor-data retention policy. Removing a source excludes dependent AI knowledge from future reuse while independently recorded work and human decisions can remain.
For website maintenance we retain bounded, timestamped server CPU, memory and disk readings, plugin-storage estimates, completed background-job costs and aggregate recorded session counts. These observations help investigate workload and missing monitoring intervals; a gap or correlation does not prove an outage or its cause. Raw operational observations are restricted to administrators. Saved performance reviews may contain AI interpretation of selected aggregate observations using the configured private-data-capable AI service, with uncertainty and source links. Local notifications depend on the server recovering and the configured delivery settings; no independent external downtime service is implied.
The team assistant retains shared conversations and the versioned guidance and sources supplied for an answer. Public visitor assistance cannot read private team conversations, meeting notes, operational records or another visitor’s memories. Reviewing an AI response does not automatically approve a task, send outreach, change a live website or grant external access. Optional calendar integrations remain off until separately connected and enabled with the required permissions and notice.