(a) This policy explains how we collect, hold, use and disclose your personal information, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

(b) Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable.

(c) This policy describes our practices. Where we need your consent for a particular use of your personal information — for example, connecting your Google Business Profile — we ask for it separately.

We collect only what we need to operate ZippyReview:

(a) technical and usage data — device type, IP address, approximate location, pages viewed and interactions, collected via the analytics and error-tracking services listed in section 5;

(b) information you submit — via our contact form (name, email address, business name, message, and technical details of the submission such as the page it was sent from, the time, and your browser type);

(c) account details — email address, name, and sign-in information (where you sign in with Google, the name and email address Google shares with us);

(d) order and delivery details — your name, email address, phone number, billing and delivery address, and the products you order. Payment card details are collected and processed directly by our payment provider (listed in section 5); we receive confirmation of payment, not your card number;

(e) business and review data — your business locations, the review-profile links you configure, and, where you connect your Google Business Profile, your public reviews and the replies you publish;

(f) product-interaction data — when someone taps or scans one of our customers' review products, we record the interaction (time, device type, IP address, browser type and approximate location) to provide analytics to that customer;

(g) review-request recipient details — where a business customer uses our review-request feature, the names, email addresses or phone numbers of their customers, supplied to us by that business (see sections 3 and 4); and

(h) any other information you choose to provide to us.

(a) We collect personal information directly from you, when you use the Service, place an order, submit a form or contact us.

(b) We also collect it automatically, through cookies and similar technologies — see our Cookie Policy.

(c) If you are a customer of a business that uses ZippyReview, we may collect your personal information from that business — for example when it submits your email address or phone number so we can send you a review invitation on its behalf. The business is required to confirm that you have consented to be contacted, and every message we send identifies the business and lets you opt out. You can ask us where your information came from at legal@zippyreview.com.

(d) We hold personal information in the cloud infrastructure of our hosting provider (currently Amazon Web Services, in the United States), in the systems of the service providers listed in section 5, and in our email and business records.

(a) to provide, operate, secure and improve the Service;

(b) to respond to your enquiries and provide support;

(c) to monitor errors, performance and usage of the Service;

(d) to comply with our legal obligations, resolve disputes and enforce our agreements;

(e) to process, fulfil and deliver your orders — including arranging shipping and tracking — and to handle returns, refunds and warranty claims;

(f) to send review invitations to a business's customers, on that business's instruction — every invitation identifies the business and includes an opt-out; once you opt out, we will not send you further invitations on behalf of that business;

(g) with your consent, to send you updates and marketing communications — every message includes an unsubscribe link; and

(h) for other purposes you would reasonably expect, or with your consent.

We may disclose personal information to the following categories of recipient:

(a) our personnel, contractors and related entities, on a need-to-know basis;

(b) service providers who help us operate the Website and our services — including hosting and storage, payment processing, shipping and delivery, analytics, advertising measurement, error tracking, spam protection, email and SMS delivery, and AI text drafting;

(c) our payment provider, to process your payment, and our shipping providers and their carriers, who receive your name, delivery address, phone number and email address to deliver your order and provide tracking;

(d) our professional advisers, such as accountants, auditors, insurers and lawyers;

(e) a purchaser or prospective purchaser, if there is a change of control of our business or a sale or transfer of business assets — disclosed under an obligation of confidentiality;

(f) where required or authorised by law, or to a regulator, law-enforcement body or court; and

(g) any other person with your consent.

The third-party service providers we currently use include those set out below. This table reflects our current providers and is not an exhaustive list or a limit on the categories above — we update it as our providers change.

We keep personal information only as long as needed for the purposes above, then take reasonable steps to destroy or de-identify it (APP 11.2). Current retention practices:

(a) order records and tax invoices — retained for at least five years, as required by Australian tax record-keeping law;

(b) local-search scan results — set to expire 90 days after the scan;

(c) free-report requests — set to expire 400 days after the request;

(d) product-interaction data and review-request records — retained only as long as needed to provide analytics and the review-request feature to the relevant business;

(e) contact-form submissions, account and business data — retained as long as needed to provide the Service, handle your enquiry and for our records.

You have the following rights in relation to the personal information we hold about you:

(a) Access. You may request access to the personal information we hold about you by contacting legal@zippyreview.com (APP 12). We will respond within a reasonable period. We do not charge for making a request.

(b) Correction. You may ask us to correct personal information that is inaccurate, out of date, incomplete or misleading (APP 13).

(c) Withdraw consent. Where we rely on your consent — for example, the connection of your Google Business Profile — you may withdraw it at any time, by disconnecting in your account or by contacting us. Withdrawing your consent does not affect anything we did on the basis of that consent before you withdrew it.

(d) Opt out of marketing. You may opt out of marketing communications at any time using the unsubscribe link in any message, or by contacting us. If you received a review invitation on behalf of a business, the opt-out link in that message stops further invitations on behalf of that business; you can also contact us at legal@zippyreview.com.

(e) Complaints. If you believe we have breached the APPs, contact us at legal@zippyreview.com with the details. We will investigate and respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au | 1300 363 992.