How KoalaFix handles personal information, AI processing, Customer Data, Microsoft 365 data, retention, overseas processing and privacy choices.
KoalaFix Pty Ltd · ABN 99 696 245 959 · 425 Smith Street, Fitzroy VIC 3065 · support@koalafix.com
KoalaFix Pty Ltd (KoalaFix, we, us) provides an AI-assisted Windows and Microsoft 365 helpdesk.
This Policy explains how we handle personal information about:
For a Business Customer, KoalaFix generally processes conversation, diagnostic and Microsoft 365 content on the Business Customer's instructions. The Business Customer is responsible for its own notices and instructions to its personnel. KoalaFix is responsible for information it handles for its own account administration, billing, security, support, legal and business purposes.
We aim to handle personal information consistently with the Privacy Act 1988 (Cth) and Australian Privacy Principles where they apply, and with other privacy laws applicable to our activities. This Policy does not remove any rights a person has under applicable law.
The information we collect depends on the features used.
Diagnostic information can contain a person's name, username, email address or other information embedded in a path, error message or application state. We use minimisation and secret-scrubbing controls, but automated filtering may not detect everything.
If a user or tenant administrator connects Microsoft 365, we receive OAuth tokens and identifiers and can access information permitted by the scopes granted through Microsoft. Depending on the feature and permission tier, this can include profile, mailbox, calendar, OneDrive, SharePoint, Teams, Planner, group, licence, authentication-method, Intune and organisation information.
We access Microsoft 365 information to diagnose an issue, display a requested result, or perform an authorised action. Higher-privilege organisational actions require the relevant Microsoft administrator consent and KoalaFix workflow controls.
We collect information:
Where practicable, a person may contact us without identifying themselves, but an account and identity are required for features that need authentication, licensing, Microsoft access or support history.
We use personal information to:
We do not sell personal information for money.
When you use the AI assistant, your conversation content is transmitted from the KoalaFix app via our relay at api.koalafix.com to Microsoft Azure OpenAI Service (Microsoft Foundry), which generates responses. Separately, OpenAI (United States) processes short search-query text to create embeddings used for knowledge retrieval; OpenAI does not process your conversations. Since 11 August 2026 we no longer send conversation content to Anthropic.
Both providers are configured so that your content is not used to train their foundation models. Providers may temporarily retain and review content for abuse monitoring under their terms. Each provider processes your content subject to its applicable terms and privacy policies.
The Service requires a persistent internet connection to api.koalafix.com. If the relay is unreachable, AI features will be unavailable.
Azure OpenAI processing may occur in Microsoft data centres outside Australia, depending on deployment configuration.
Business accounts. We do not use a Business Customer's raw conversation content or Microsoft 365 content to train or improve a general or cross-customer model unless the Business Customer's administrator gives a separate affirmative opt-in. We may use aggregated and de-identified service metrics that do not reasonably identify a customer or individual.
Free individual (Solo) accounts. KoalaFix Solo is free because it helps us improve KoalaFix. As a condition of using a free Offering, we use your conversation content and diagnostic data to improve our own AI models and the Service. There is no opt-out while you participate. You can stop at any time by uninstalling the app and closing your account, which stops all new collection. These protections apply:
KoalaFix uses computer programs, including large language models and rules-based safety systems, to make or materially assist decisions that can affect a user's device, account or Microsoft 365 environment.
The kinds of personal information used can include:
The kinds of decisions or related steps can include:
These systems do not make employment, credit, insurance, medical or legal decisions for KoalaFix. Material actions are subject to the permissions, approval controls and safety rules described in the Terms of Service. We log actions and outcomes. A person who believes an automated action has adversely affected them can email support@koalafix.com to request human review.
This section is intended to address the Australian automated-decision transparency requirements commencing 10 December 2026.
Microsoft access begins only after the relevant user or tenant administrator completes Microsoft's consent process. Access can be revoked through Microsoft and, where available, KoalaFix settings.
A Business Customer's Owners or administrators can manage membership, seats, billing, connected services, workflow policies, devices and usage information. The ordinary customer dashboard does not show administrators the content of an Authorised User's assistant conversations.
The Business Customer determines why its personnel use KoalaFix and must provide appropriate workplace and privacy notices. Users should direct questions about their employer's instructions or monitoring to that employer as well as to KoalaFix where relevant.
We disclose personal information only as reasonably necessary to:
We use technical and organisational measures designed to protect personal information, including encryption in transit, encryption at rest for hosted data where supported, access controls, tenant and row-level authorisation, administrative logging, secret management, signed software distribution, patching, monitoring, incident response and confidentiality obligations.
No system is completely secure. Users must protect credentials, apply updates, maintain appropriate backups and promptly report suspected compromise.
If a data breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and will meet other applicable notification duties.
We keep personal information only for as long as reasonably needed for the purposes in this Policy, the Customer's instructions, security, dispute resolution and legal obligations. After that, we delete or de-identify it.
Our general retention schedule is:
| Information | Retention |
|---|---|
| Conversation content, case text and associated tool-run content | Up to 90 days from creation, unless the Customer requests earlier deletion or a shorter Order applies |
| Completed transient cloud and OneDrive job records | Usually deleted promptly after delivery and otherwise within 14 days |
| Remediation events, device-health snapshots and diagnostic records | Up to 90 days from creation |
| Product-improvement source content | For Business Customers, only while the relevant opt-in remains active. For Solo, while participation continues; after participation ends, stored data is deleted under this schedule and is no longer used in future training runs. |
| Account and workspace records | While the account is active and for up to 90 days after closure, except records needed for security, disputes or law |
| Usage and transaction records needed for billing, tax and corporate records | Up to 7 years, with content fields minimised |
| Support tickets and correspondence | Up to 24 months after the relevant account or matter is closed |
| Website enquiries and sales leads | Up to 24 months after the last meaningful contact |
| Crash and error telemetry | Up to 90 days, subject to shorter provider settings where configured |
| Backups | Removed or overwritten on the ordinary provider backup cycle, unless isolated for security or legal reasons |
On termination of a Business Customer, the DPA deletion terms apply. We may retain a minimal suppression record to honour an unsubscribe or advertising opt-out.
Your data may be processed outside Australia. In particular: Azure OpenAI processing may occur in Microsoft data centres outside Australia, depending on deployment configuration; OpenAI (United States) processes search-query embeddings; Stripe (United States and Australia) processes payments; Vercel (United States, global network) hosts the customer dashboard; Sentry (United States) processes scrubbed crash reports; Brevo (European Union) sends service email; Plausible (European Union) provides website analytics; Cloudflare operates a global edge network; Meta (United States) receives the website advertising events described in section 12; and Microsoft 365 data is processed in your tenant's Microsoft geography. Where data is transferred internationally, we take reasonable steps to ensure it is protected consistently with this Policy and applicable law.
We use necessary storage and similar technologies for security, sign-in and preferences.
We use Plausible to understand website traffic and interactions. Plausible is configured as a privacy-focused analytics service, but the website still discloses its use and the events sent.
If advertising measurement is enabled, Meta Pixel and Meta Conversions API can receive information such as IP address, browser and device information, page URL, referral information, event time and actions such as submitting a form. We do not intentionally send Meta KoalaFix conversation content, Microsoft 365 content, support text, passwords or payment-card details.
Optional advertising measurement remains disabled unless KoalaFix implements an appropriate visitor choice and honours it across the relevant browser and server-side events. Visitors can also use Meta's own advertising controls, but those controls do not replace KoalaFix's obligations.
We do not use website tracking to make decisions about a person's access to KoalaFix.
We send marketing where the recipient has consented or where otherwise permitted by the Spam Act 2003 (Cth) and applicable law. Marketing emails include an unsubscribe mechanism. Unsubscribing from marketing does not stop necessary account, renewal, billing, payment-failure, security or service communications.
A person can object to KoalaFix's use of their information for direct marketing by using the unsubscribe or privacy control or contacting support@koalafix.com. We will action the request within a reasonable period and in any event within the period required by law.
A person can ask to access or correct personal information, request deletion where available, withdraw an optional consent, object to direct marketing, or make a privacy complaint by emailing support@koalafix.com.
We may need to verify identity and may decline or limit a request where permitted or required by law. If information is controlled by a Business Customer, we may refer the request to that Customer and assist it under the DPA.
We aim to acknowledge a privacy complaint within 7 days and respond within 30 days. If an Australian complainant is not satisfied, they can contact the Office of the Australian Information Commissioner. People in other jurisdictions may contact their local privacy regulator where applicable.
KoalaFix is not directed to people under 18 and we do not knowingly permit them to create accounts. Contact us if you believe a minor's information has been collected without appropriate authority.
We review this Policy when our products, processors or legal obligations change. We will publish the new version and effective date. If a change materially affects active users, we will provide reasonable notice. Where law requires consent for a new use, we will seek that consent separately; continued use alone is not treated as consent to an unrelated new use.
25 August 2026: Clarified subscription cadence, purchased-seat quantity, promotional-offer administration, payment recovery and necessary billing communications. No new payment or communications provider was introduced.
Privacy contact: support@koalafix.com
KoalaFix Pty Ltd ABN 99 696 245 959 · ACN 696 245 959 425 Smith Street, Fitzroy VIC 3065, Australia