Privacy without the fog.

Information you provide

When you contact ZacFlow, you may provide your name, business details, email address, phone number and information about a potential project. ZacFlow collects this information directly from you through the enquiry form, email, phone calls or project conversations.

How it is used

Enquiry information is used to understand and respond to your enquiry, prepare project discussions or proposals, deliver agreed services and maintain necessary business and accounting records. It is not sold or used for unrelated marketing lists.

Storage, service providers and overseas processing

Information is held in ZacFlow’s email and working systems. Website enquiries are delivered using Resend, whose primary processing operations are in the United States. If you allow optional Google measurement, analytics and advertising conversion data may be processed on Google servers outside Australia. These providers handle information under their own privacy and security terms.

Retention and security

Enquiries that do not become active projects are generally deleted after 24 months. Client, transaction and project records may be kept longer where reasonably needed to provide services, meet tax or legal obligations, or resolve a dispute. ZacFlow takes reasonable steps to protect information, but no internet transmission or storage system can be guaranteed completely secure.

Enquiry and sign-in forms use request counters to prevent abuse. Where a trusted network address is available, these counters use a daily rotating keyed hash instead of saving the raw address. Counters expire within 24 hours and are removed when the controls next run. Private workspace sign-in uses an essential session cookie for up to 30 days, with sign-out after seven days of inactivity. You can lock the workspace or sign out other devices from its session controls.

Private concept link visits

For private website concepts, ZacFlow counts link requests and likely human visits to understand which concepts are useful. Known scanners and prefetch requests are separated from likely views. A random session identifier is limited to that concept link; we do not store visitor IP addresses or use cross-site fingerprinting for these counts. Visit records are kept for up to 180 days. These are concept visits, not email-open tracking, and a forwarded link does not identify who personally viewed it. Engagement reports are available only to authorised staff.

Website assistant

The website assistant helps with public service information and preparing an enquiry. Chat history is held in the current page’s memory and is cleared when you reload, leave the public site or choose New chat. ZacFlow does not save chat transcripts to its database or send message content to website analytics.

When AI chat is enabled, messages you send and the recent conversation are processed by OpenAI, which may process information outside Australia under its own terms. ZacFlow requests that API responses are not stored as conversation state; provider security and abuse-monitoring retention may still apply. The assistant identifies when it is using the published-information guide instead. Keep personal, payment and sensitive information out of chat.

To prevent abuse and control AI costs, ZacFlow uses a daily rotating, keyed hash of your network address to limit requests. The assistant does not save the raw address or chat content in its usage records. Network counters expire within 48 hours and are deleted the next time the usage controls run. Aggregate usage allowances are retained separately. These limits may be shared by visitors on the same network. When a limit is reached, the published-information guide and enquiry form remain available.

Preparing a brief does not submit it. You can review and edit the brief, add your contact details and choose Send enquiry. Only that submitted brief and form details are sent through the enquiry email provider.

Optional website and advertising measurement

ZacFlow asks for your permission before recording optional website measurement or loading Google Analytics or Google Ads measurement. When allowed, ZacFlow records page views, scroll milestones, homepage sections reached, broad device and referral categories, and interactions such as opening a demonstration or starting or successfully submitting an enquiry. Google Ads may record a successful enquiry with a random receipt identifier to measure advertising results and avoid duplicate conversions. Form answers, names, email addresses, phone numbers and current website addresses are not sent as measurement data. Measurement is not replayed if you allow it after submitting. Google Analytics uses an IP address at collection to determine a coarse location, then discards the address before the data is logged. You can change your choice using “Analytics choices” in the footer.

The on-site report stores a random identifier for each measured page view to prevent duplicate events. It is not a persistent visitor identity or a browser-storage cookie. No full referring URLs, query strings, raw IP addresses, chat messages or form answers are stored in this report. Records are retained for up to 30 days and removed when collection or reporting next runs. Do Not Track and Global Privacy Control requests are respected for on-site collection. The report covers consenting visits and may not include visitors using blockers.

Access, correction, deletion and complaints

To ask what information ZacFlow holds about you, request a correction or deletion, or make a privacy complaint, email hello@zacflow.au. ZacFlow may need to confirm your identity and may retain information where required by law. Complaints will be reviewed and answered within a reasonable time. If the Privacy Act applies and the issue remains unresolved, you can contact the Office of the Australian Information Commissioner.

Changes to this notice

This page may be updated when ZacFlow’s services or information practices change.

Last updated: 18 October 2026.