1. Scope
This Privacy Policy explains how Ozmosoft ("we", "us") collects, uses, stores, and protects information in connection with the Ozmosoft platform (the "Service"), for both the organisations that subscribe to the Service ("Customers") and the individual users who access it on a Customer’s behalf ("Members").
Where a Customer enters business records (customers, invoices, employees, projects, etc.) into the Service, that Customer is the data controller for that data and Ozmosoft acts as a data processor on the Customer’s instructions, except where stated otherwise.
2. Information we collect
Account information: name, email address, organisation name, role, and authentication details (passwords are stored as salted hashes; we never store plaintext passwords).
Usage information: log data such as IP address, browser/device information, pages and features accessed, and timestamps — used to operate, secure, and improve the Service.
Business records: the data Members enter or import while using the Service — for example invoices, ledger entries, project and job data, inventory records, employee records, and files uploaded to the platform. This data belongs to the Customer (see our Terms of Service).
Payment information: subscription billing is handled by our third-party payment processor; Ozmosoft does not store full card numbers.
3. How we use information
To provide, operate, and maintain the Service, including authenticating access and enforcing each Customer’s configured roles and permissions.
To process subscription billing, send account and billing notices, and provide customer support.
To monitor for security issues, detect and prevent fraud or abuse, and maintain the integrity of the platform (for example, our tenant-isolation and access-control safeguards).
To improve the Service, including aggregated/anonymised analysis of usage patterns that does not identify an individual or Customer.
To comply with legal obligations, such as tax and accounting record-keeping requirements that apply to us as an operator.
6. Third-party processors
We use a limited number of service providers to run the Service. Each one is named on our Subprocessors page (/legal/subprocessors) with what it does and where it processes data, and we update that page before we add a new one.
These providers are contractually restricted to using data only to provide their service to us, and are selected for their own security practices.
7. AI and overseas processing
Ozmosoft’s AI features — for example Ozzy, reading a bill you upload, and suggesting matches for bank transactions — are provided by Anthropic (Claude) and OpenAI. Anthropic is the default provider for Ozzy’s written answers. OpenAI is also a provider the platform may use: it runs Ozzy’s voice (turning speech into text and reading answers aloud), and it may run written answers and other AI features when our AI routing selects it. When an AI feature runs for your organisation, the request and the records it needs are sent to the provider that runs that feature, which processes them in the United States. Our support team may also use the same services to look into an error that affected your organisation.
Before your request leaves Ozmosoft, we remove card numbers, passwords, keys and similar secrets from it. Voice recordings are turned into text and are not stored by Ozmosoft.
Anthropic’s and OpenAI’s terms for business customers say that data sent through their APIs is not used to train their models by default.
Ozmosoft hosts the platform, its database and your files with Amazon Web Services in Sydney, Australia. Some of the providers on our Subprocessors page process data outside Australia, mainly in the United States: Anthropic and OpenAI for AI features, Stripe for payments, Twilio for text messages, Sentry for error reports, and Google or Microsoft when you connect them.
Before we disclose personal information to a provider overseas, we take reasonable steps, including contract terms, so that it is handled in a way that is consistent with the Australian Privacy Principles.
8. Google and Microsoft account data
You can choose to connect a Google or Microsoft account to Ozmosoft. We only request the access needed for the feature you turn on: sending email from your own address (Gmail: gmail.send; Microsoft: Mail.Send), keeping your calendar in sync with Ozmosoft (Google: calendar.events, plus calendar.calendarlist.readonly so we can show you the list of your calendars and you can choose which ones sync; Microsoft: Calendars.ReadWrite, plus Calendars.ReadWrite.Shared for shared calendars you choose to sync), and saving or attaching the specific files you choose (Google: drive.file; Microsoft: Files.ReadWrite). Signing in with Google or Microsoft only uses your name, email address and profile picture.
We use this data only to provide those features to you inside Ozmosoft. We do not read, index or store the contents of your mailbox; we only send the messages you ask us to send. We read the events on the calendars you switch on so they appear on your Ozmosoft calendar, and we only create or update calendar events and files that you create in, or explicitly link to, Ozmosoft. Switching a calendar off stops reading it.
We do not sell this data, do not use it for advertising, and do not transfer it to anyone except as needed to provide the feature, to comply with the law, or as part of a merger with notice to you. Humans at Ozmosoft do not read it unless you ask us to for support, it is needed for security or legal reasons, or it has been aggregated and anonymised.
Ozmosoft's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data received from Google APIs (Gmail, Google Calendar and Google Drive) is never sent to Anthropic, OpenAI or any other AI or machine-learning provider, and is never used to develop, improve or train AI or machine-learning models.
Access tokens are stored encrypted. You can disconnect at any time from Apps or Settings in Ozmosoft, or from your Google or Microsoft account security settings; disconnecting in Ozmosoft deletes the stored tokens immediately and, where the provider supports it, also asks the provider to revoke our access. Removing Ozmosoft from your Google or Microsoft account always revokes it.
Copy Records to your Drive: if an owner or admin of your organisation turns this on, copies of the files in your Records folder (the folders they choose) are written to your organisation’s own Google Drive, in a top-level folder named “Ozmosoft Records”, or to your own OneDrive, inside the Ozmosoft app folder. It is off until someone turns it on. Copies are only added, never deleted: turning it off, disconnecting the account or archiving a record stops new copies but leaves the copies already in your Drive for you to manage. Payroll files and employee files (ID documents, licences and employment contracts) are only copied when the person who turned it on chose those folders and may see payroll or edit employee records.
9. Data retention & deletion
While your subscription is active, your business records are retained for as long as your organisation exists on the platform.
If a subscription is cancelled, the organisation’s data is retained for a data-retention window configured on your plan (30 days by default) during which access can be restored or data exported.
If an organisation proceeds to account closure, its data enters a pending-deletion window (30 days by default) before permanent ("hard") deletion, giving time to reconsider or complete an export.
Certain records — such as audit logs of security-relevant and financial actions — are retained for a longer minimum period (currently 7 years / 2,555 days) to meet standard financial record-keeping and audit requirements, even where a shorter retention setting is configured elsewhere.
We may retain limited information beyond these windows where required by law (for example, tax records) or to resolve disputes and enforce our agreements.
10. Your rights
Subject to applicable law, you (or the Customer organisation you belong to) may request: access to the personal information we hold about you; export of your organisation’s business records in a portable format; correction of inaccurate account information; and deletion of your account or organisation’s data, subject to the retention periods described above and any legal obligation to retain certain records.
Members should generally direct requests about business records to their organisation’s administrator, since the Customer organisation controls that data. Requests about your own account information can be sent directly to us.
11. Children
The Service is intended for business use by adults and is not directed to children. We do not knowingly collect personal information from children.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated policy with a new "Last updated" date and, for material changes, provide reasonable notice.
13. Contact
Questions about this Privacy Policy, or requests relating to your data, can be sent to support@ozmosoft.com. For OAuth data-access questions specifically, see /support-contact.
Questions about this Privacy Policy, or requests relating to your data? Contact support@ozmosoft.com.