How KoalaFix handles personal information, AI processing, conversation content, and Microsoft 365 data.
KoalaFix Pty Ltd · ACN 696 245 959 · 425 Smith Street, Fitzroy VIC 3065 · support@koalafix.com
KoalaFix Pty Ltd ("we", "us", "our") respects your privacy and is committed to protecting personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This Policy also applies to users in New Zealand (under the Privacy Act 2020) and the United States. We do not currently offer the Service in the EU or UK.
We collect the following categories of data:
openid, profile, offline_access, User.Read, Files.Read, Mail.Read, Calendars.Read, MailboxSettings.ReadWrite, Sites.Read.All, Tasks.Read, and Chat.Read, for read-only health checks of OneDrive, mailbox, calendar, SharePoint/Lists, Planner and Teams-chat search (and writing mailbox settings such as auto-reply where you ask us to). Administrator scopes are requested only when a tenant administrator grants admin consent to enable IT-admin remediation: User.ReadWrite.All, UserAuthenticationMethod.ReadWrite.All, Group.ReadWrite.All, Files.ReadWrite.All, Organization.Read.All, DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementConfiguration.Read.All, and Tasks.ReadWrite, used for actions you explicitly request, such as password reset, account unlock, license assignment, group membership, file-share remediation and Intune device remediation.We use personal information to:
When you use the AI assistant, your conversation content is transmitted from the KoalaFix app via our relay server at api.koalafix.com to Anthropic (United States) as our primary AI provider. If Anthropic's service is unavailable, your conversation content may be routed to OpenAI (United States) as a fallback provider.
Both providers' APIs are configured so that your conversation content is not used by Anthropic or OpenAI to train their models. Each provider processes your content subject to their applicable terms and privacy policies, available at anthropic.com/legal and openai.com/policies.
The Service requires a persistent internet connection to api.koalafix.com. If the relay is unreachable, AI features will be unavailable.
Automated actions and decisions. KoalaFix uses automated systems, including large language models, to diagnose issues, suggest fixes, and carry out remediation actions, including the administrator-level actions described in Section 2 where a tenant administrator has granted consent. Remediation actions run either automatically or with your approval, as described in our Terms of Service, and actions are logged. If you believe an automated action or decision has affected you adversely, contact support@koalafix.com and a person will review it.
We may use conversation content to improve our own AI models and the Service. This is separate from the provider no-train settings referenced in Section 4: Anthropic and OpenAI do not train on your content, but KoalaFix may, subject to the protections set out below.
The following protections apply:
Pilot participants. If you take part in the KoalaFix Pilot Program, your data use is governed by the Pilot Program Terms and is a condition of participation. The opt-out described in this section does not apply to Pilot participants for the duration of their participation; you may instead leave the Pilot at any time, which stops further collection.
If you connect a Microsoft 365 account, we access your data via the Microsoft Graph API using the scopes listed in Section 2, solely to diagnose and remediate the issue you've asked us to help with. Access is granted only through explicit OAuth consent and can be revoked at any time via myaccount.microsoft.com.
If you have given us your consent (or where we are otherwise permitted under the Spam Act 2003 (Cth)), we may send you marketing emails about product updates, features, and offers. Every marketing email contains an unsubscribe link, and you can also opt out by emailing support@koalafix.com. Service-related communications (billing, account changes, security) will continue regardless of marketing preferences.
Personal data is stored with Supabase in the Sydney (ap-southeast-2) region. We take reasonable technical and organisational steps to protect data, including encryption in transit (TLS) and at rest, role-based access controls, audit logging, and regular patching and security review. No system is completely secure.
If we become aware of a data breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and equivalent authorities in New Zealand and the US where applicable.
We share information only with:
We do not sell personal information.
You may ask us to access, correct, or delete your personal information by emailing support@koalafix.com. We will acknowledge your request within 7 days and complete it within 30 days, or explain any delay.
New Zealand users have equivalent rights under the Privacy Act 2020 and may complain to the Office of the Privacy Commissioner at privacy.org.nz. To the extent the CCPA/CPRA applies to us, California users have the right to know, delete, correct, and opt out of "sharing", including sharing for cross-context behavioural advertising (see Section 13 for how to opt out); we do not sell personal information. Australian users may complain to the OAIC at oaic.gov.au.
Your data may be processed outside Australia. In particular, conversation content is transmitted to Anthropic (United States) and may fall back to OpenAI (United States). Where data is transferred internationally, we take reasonable steps to ensure it is protected consistently with this Policy and applicable law.
We use cookies and similar technologies on our website to keep you signed in, remember preferences, and understand how the website and Service are used. Our website analytics use Plausible, a privacy-focused, cookie-free analytics service that does not collect personal information.
Advertising and measurement. Our website uses the Meta Pixel and the Meta Conversions API (loaded server-side via Cloudflare Zaraz) to measure the effectiveness of our advertising and to reach people who have shown interest in KoalaFix on Meta platforms such as Facebook and Instagram. Through these tools, Meta Platforms, Inc. (United States) receives information such as your IP address, browser and device information, the pages you visit on our website, and actions you take there (for example, submitting a form). We do not send Meta your KoalaFix account data, conversation content, or Microsoft 365 data. Meta processes this information under its own privacy policy. Because part of this collection happens server-side, blocking cookies in your browser does not stop it entirely.
Your choices. You can opt out of our use of your information for advertising and ad targeting at any time by emailing support@koalafix.com; we will action your request within 7 days. You can also manage your ad preferences directly with Meta at facebook.com/adpreferences.
The Service is not directed at anyone under 18, and we do not knowingly collect information from them. If you believe we have collected information about a minor, contact us and we will delete it.
We may update this Policy from time to time. Where changes are material, we will notify active users by email or in-app notice. Continued use of the Service after an update indicates acceptance.
KoalaFix Pty Ltd · ACN 696 245 959
425 Smith Street, Fitzroy VIC 3065
Email: support@koalafix.com