Privacy Policy

This policy explains what personal information KoalaFix collects, why, who we share it with, where it's processed, how long we keep it, and your rights. It's for everyone whose information we handle: people who use KoalaFix at work, website visitors, people who contact us, and people mentioned in a team's memory. It describes our practices but isn't part of our contract; the Terms of Service and the Data Processing Addendum (DPA) set out what we've agreed with each organisation. Each section opens with an "In short" line, which is a summary only: the full text is what counts.

1 · Who we are and what this policy covers

In short: KoalaFix Pty Ltd, an Australian company, runs KoalaFix. We decide how account, usage, website and marketing information, including support contact details, is used. Team memory, and the messages and files people send us for support, belong to the organisation that uses KoalaFix, and we handle them only for that organisation.

KoalaFix Pty Ltd (ABN 99 696 245 959, ACN 696 245 959), 425 Smith St, Fitzroy VIC 3065, Australia ("KoalaFix", "we", "us", "our") provides KoalaFix, a hosted service that helps a team run AI coding agents together. Agents can check in before starting work, so teammates' agents can see what's in progress, and they share a team memory they can search by meaning. KoalaFix is a coordination layer, not a way to watch people.

We handle personal information in line with the Australian Privacy Principles (APPs). We've also written this policy with the EU and UK GDPR, New Zealand's Privacy Act 2020 and US state privacy laws in mind.

Our two roles

If you're mentioned in a team's memory

You might be named in a Space's memory even if you don't use KoalaFix: for example, in a note that you made a decision. The organisation that runs that Space is responsible for that information. We store it for the organisation and use it only to provide KoalaFix to it, never for our own purposes, and never to train AI models unless the organisation opts in (section 6). Everyone in that Space can read team-lane memory, and their agents pass it to their AI providers (section 6). Ask that organisation about it; if you can't, ask us and we'll help (section 12).

Contacts and representatives

Privacy requests and questions: support@koalafix.com. Our other contacts are in section 18. We have not appointed a representative in the EU/EEA or the UK; people there can write to us directly at support@koalafix.com. We haven't appointed a data protection officer; support@koalafix.com reaches the people at KoalaFix responsible for privacy.

Words we use

Customer Content, Account Data and Usage Data are explained in section 3.

2 · The short version

In short: the main points on one screen. This list is a summary only; the sections below give the detail.

• What we collect: account and billing details, technical usage records, support contact details, website and waitlist details and, for your organisation, the team memory, check-ins, search questions and support messages its people and agents send us.
• Why: to run KoalaFix, keep it secure, bill for it, help you and meet the law; to measure our website and advertise KoalaFix; and, only if you opt in, to send you product news.
• No training: our promise to every organisation (section 6): "We don't use your Customer Content to train AI models, and we don't let our AI providers train on it. We don't use it to improve KoalaFix for other customers, or for any purpose other than providing the Service to you, unless you opt in." We don't train AI models on other personal information either.
• Advertising: our website uses analytics and advertising pixels from Google, Meta, LinkedIn and X. We may also give them your email address in coded (hashed) form, and tell them when you sign up or pay, so they can show you our ads and measure them. They may also use this information for their own purposes. You can opt out at any time; in the EU, the EEA and the UK, we only do this if you agree (sections 8 and 14). Our marketing emails track opens and clicks (section 15). We never use Customer Content for advertising.
• Where: team memory, embeddings and sign-in data are stored in Australia. Some providers process information elsewhere: email in the EU, Stripe and Cloudflare globally, our website's analytics and advertising providers mainly in the US and, if it's switched on, our AI judge wherever Microsoft runs the model.
• How long: team memory stays until your organisation deletes it; on the Basic plan, hidden memory is deleted 12 months after it's hidden, and we close Spaces no one has used for 24 months; other records have set periods.
• Your rights: access, correction, deletion, export, objection and complaint. For team memory, start with your organisation; we'll help it respond.

3 · Information we collect

In short: we collect account, billing, usage, support contact, website and marketing information for our own purposes. Customer Content, meaning team memory, what agents send us and what people send us for support, we hold for your organisation.

Information we handle for ourselves

Account Data. Your name, work email address and password (our sign-in provider stores only a hash of it). If you sign in with Google, Google sends us your name, email address and Google account identifier. We also keep your organisation's name and work-email domain, your Space memberships and role, invites you send or accept, your API and connection tokens (their secrets stored only as hashes), your dashboard sessions, and a record of your acceptance of our Terms (the version, time, account and IP address). While KoalaFix is invite-only, if you try to sign in without an invite, our sign-in provider may still keep your email address and a sign-in record.

Billing information (part of Account Data). Card details go straight to Stripe, our payment provider; we never see full card numbers. We keep the billing contact's name and email address, billing address and country, any tax ID, invoices and payment records, Stripe's references to the payment method and subscription, and a card fingerprint (a code Stripe creates from the card, which can't be used to charge it) to apply the one-trial rule.

Usage Data. Technical information about how the Service is used: timings, counts, error codes, which AI client family connected (such as Claude Code or Cursor) and when, IP addresses and security logs. It never includes the text of Customer Content.

Support contacts. Your name and email address when you contact us, and our replies. The messages and files you send us for support are Customer Content: we handle them for your organisation and use them only to help. If you contact us without an organisation that uses KoalaFix (for example, with a question before signing up), we handle your message ourselves under this policy.

Website, waitlist and access requests. The providers that deliver koalafix.com process your IP address and basic request details. Our website also uses cookies and pixels from Google, Meta, LinkedIn and X. They record how you use the website (pages you visit, clicks, device and browser details, IP address and cookie identifiers) and send it to those providers. Section 14 explains them and how to turn them off. If you join the waitlist or request access, we keep your name, email address and what you tell us.

Marketing and advertising. Whether you've opted in to product news; whether you open our marketing emails and which links you click (section 15); your advertising choices (section 8); and, if you unsubscribe or opt out, a record so we keep honouring that.

Information we handle for your organisation: Customer Content

Customer Content is everything people and agents send to or store in the Service, plus what we derive from it to run the Service:

• Team memory: notes, decisions, facts and handoffs, with who wrote each one and when, and their edit history.
• What agents send: check-ins, search questions (including the start of people's prompts) and decisions captured during a session (section 4).
• The team map: people's names (or, until someone accepts an invite, their email address), roles or departments, their rank in the Space (lead, member or new), areas and projects.
• Other content: settings text, and files and messages sent to us for support.
• What we derive: embeddings (lists of numbers that let agents search by meaning), search results, the search log, read receipts (which memory was shown to whom), gaps (questions an agent asked that found nothing, recorded so someone can add the missing memory; section 4), AI judge findings and summaries.

Customer Content often contains personal information: who wrote it, and anything people write about themselves, teammates, clients or others. "What not to put in KoalaFix" in our Acceptable Use Policy asks organisations to keep personal information to what their team needs, and bars secrets, payment card data, government identifiers, health and other sensitive information, and information about children.

Do you have to give us information?

No, but we can't give you an account without your name and email address, or start the Trial or Premium without card details. You can ask us general questions anonymously or under another name, but we need to know who you are to act on a request about your account or your personal information.

4 · How we collect it

In short: from you, your organisation and teammates, the agents and Client Software people connect, Google and Stripe, and automatically as the Service runs and as you use our website.

• From you, when you sign up, accept an invite, use the dashboard, contact us, join the waitlist or subscribe to product news.
• From your organisation and teammates. An Admin or teammate gives us your email address to invite you, and your organisation gives us its billing contacts. At set-up, the organisation's own agent may draft the team map from sources such as the organisation's website, code repositories and issue tracker, which it reads with the access of the person running it. Teammates and their agents may also write about you in team memory.
• From Google, if you sign in with it, and from Stripe: payment results, Stripe's references and the card fingerprint.
• Automatically: Usage Data, dashboard cookies, the cookies and pixels on our website (section 14), and whether you open our marketing emails and click their links (section 15).
• From agents and the Client Software, as follows.

What leaves a person's machine, and what doesn't

When someone connects an agent to KoalaFix, the Client Software sends:

• At the start of a session: a request for a short brief (team news, and what teammates' agents are working on).
• With each non-trivial prompt: up to the first 2,000 characters, as a search question, so KoalaFix can return relevant team memory. We use the question to find matching memory, and keep it in the search log for 30 days. If a question an agent asks finds nothing twice in 14 days, KoalaFix may record it as a "gap" in your organisation's Space, visible to your team and assigned to an Admin, so someone can add the missing memory. Gaps are kept until an Admin closes them, or for 90 days. Questions our hooks send automatically from people's prompts are never recorded as gaps.
• Check-ins: a short description of the work an agent is starting (the repository and branch, or the folder name), when it was last active, and the outcome when it finishes, with the paths of up to 20 project files the prompt names or the session has edited, never their contents. A check-in collects up to 50 paths over a session. Teammates see the description and the paths while the work is open, and we keep them with the check-in after it ends.
• Repository and model: each request from the Client Software names the repository and the AI model the agent runs on.
• Whatever agents and people choose to save through KoalaFix's tools, including team facts and the team map.
• Standing instructions and set-up: KoalaFix gives connected agents short standing instructions on using its tools, including when to search memory and to save team decisions they see during a session, in their own words. While your organisation's Space isn't set up, a connected agent may start set-up without asking the person first; an Admin can turn this off.
• Decisions captured during a session: at set points, the Client Software asks the person's own agent to save the team decisions made so far, in its own words, and tells it not to quote the person, copy their prompts or save anything personal or secret. It doesn't send the transcript or the person's prompts. A final pass may run on the person's own AI account at the end of the session. It can be switched off.

Apart from these, KoalaFix doesn't receive people's conversations with their agents. Our servers don't read an organisation's code repositories, files, issue tracker, website or chat by themselves; during set-up, the organisation's own agent reads those sources and decides what to send. In return, teammates' memory and check-ins, with their descriptions and file paths, are added to each person's agent context, and so reach that person's AI provider (section 6).

Your organisation must tell its people about this, and get any consent the law requires (for example, under workplace surveillance laws), before their agents' prompts and check-ins are sent to KoalaFix.

5 · Why we use it, and our legal bases

In short: we use personal information to run KoalaFix, keep it secure, bill, help you, meet the law, and measure our website and advertise KoalaFix (in the EU, the EEA and the UK, only with your consent). We send marketing emails only with your consent. For Customer Content, we follow your organisation's instructions. You can object to uses based on our legitimate interests.

Laws such as the EU and UK GDPR require a legal basis for each use of personal information. Ours are:

We don't use personal information for other purposes unless they're closely related ones you'd reasonably expect, or we've told you first and, where the law requires, asked for your consent.

Your right to object. Where we rely on legitimate interests, you can object at any time, on grounds relating to your situation, by emailing support@koalafix.com. We'll stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the information to make or defend legal claims. You can object to direct marketing at any time, for any reason, and we'll stop.

6 · How we use AI

In short: KoalaFix uses Microsoft's Azure OpenAI to make team memory searchable by meaning and, if switched on, to suggest clean-ups. We don't train AI models on your organisation's content, and we don't let our AI providers do so, unless your organisation opts in.

Search by meaning. We send the text of memory and search questions to Azure OpenAI, which turns it into an embedding so agents can find memory by meaning. Our embedding deployment runs in Azure's Australia East region, and we store embeddings with the memory in Australia. Microsoft doesn't use this text to train models.

The AI judge. KoalaFix may also run an AI judge, which checks new memory against similar memory and suggests clean-ups. It's advisory: it doesn't delete or change memory by itself. On the Basic plan it runs within a small daily allowance and doesn't look at hidden memory. It uses an Azure OpenAI Global deployment, so Microsoft may process the text in any region where it runs the model, including outside Australia. It can be wrong, so people decide whether to act on its suggestions.

Abuse monitoring. If Microsoft's systems flag text as possibly harmful, Microsoft may keep it in the Azure geography where our resource is located (Australia), and authorised Microsoft staff may review it.

Our no-training promise, in the same words as our Terms ("you" here means your organisation):

"We don't use your Customer Content to train AI models, and we don't let our AI providers train on it. We don't use it to improve KoalaFix for other customers, or for any purpose other than providing the Service to you, unless you opt in."

We don't use the personal information we handle for ourselves to train AI models either. Any opt-in would be a separate choice that an organisation actively makes, never just a change to this policy.

Your teammates' AI providers. Memory and check-ins added to a person's agent reach that person's AI provider (for example Anthropic, OpenAI, Google or Cursor), under your organisation's arrangements with it. Those providers aren't our Subprocessors, and their own terms apply. If session decision capture is on, its final pass runs on the person's own AI account.

No profiling or monitoring. We never use Customer Content to profile people for advertising, and we don't rate individuals. (Sections 8 and 14 explain how we advertise KoalaFix.) KoalaFix isn't designed to monitor individuals, or to make or support employment, credit, housing, insurance or other significant decisions about people.

7 · Automated decisions

In short: some decisions in KoalaFix are made or assisted by computer programs, such as the automatic charge after a Trial and the Basic plan's hiding of old memory. This section lists them, the information they use, and how to ask a person to look again.

From 10 December 2026, the APPs ask organisations to explain decisions made or substantially assisted by computer programs that use personal information and could significantly affect people; the GDPR asks for similar information. We list every kind KoalaFix makes, even where we don't think it would significantly affect you:

None of these is a decision based solely on automated processing that has legal or similarly significant effects on you as a person, in the sense of Article 22 of the GDPR. The charge, the move to Basic and the one-trial rule carry out the plan your organisation chose under its Terms; closing unused Basic Spaces and accounts follows our Terms and limits how long we keep data; fraud screening protects cardholders and us; the others protect the Service or keep memory tidy. KoalaFix makes no decisions about people's work, performance or employment.

Ask a person to look again by emailing support@koalafix.com. A KoalaFix founder or staff member will review the decision, consider what you tell us, and reply with the outcome. You can also appeal a suspension as set out in "Suspension" in the Terms of Service.

8 · Who we share it with

In short: our Subprocessors, the people in your Space, your organisation, our analytics and advertising providers (Google, Meta, LinkedIn and X) and, only when needed, advisers, authorities or a buyer of our business. Sending advertising providers website data or your hashed email address can count as "selling" or "sharing" under some US state laws. We don't "sell" or "share" Customer Content, and we never use it for advertising.

Subprocessors

Our Subprocessors are Microsoft Azure (hosting and database), Azure OpenAI (embeddings and the AI judge), Supabase (sign-in), Brevo (service emails), Stripe (payments), Cloudflare (DNS now and, once we turn on its proxy, our network edge) and Microsoft 365 (our support mailbox). The Subprocessors page lists each Subprocessor, what it does and where; section 9 lists the countries. We give Admins, and anyone subscribed on that page, 30 days' notice by email before adding or replacing a Subprocessor (in an emergency, notice as soon as we can).

Stripe may also use payment information for its own purposes, such as preventing fraud, under its own privacy policy. If you sign in with Google, Google is a sign-in provider you chose, not our Subprocessor.

People in your Space, and your organisation

• Team-lane memory, check-ins and the team map are visible to everyone in the Space, showing who wrote what and when. Gaps are visible to your team too (section 4).
• Private-lane memory is visible in KoalaFix only to the person who saved it. It's still part of your organisation's Space, so it's included if your organisation asks for a full export, for example when it leaves KoalaFix (on the Basic plan, hidden memory isn't included). We tell you this when you first sign in, and KoalaFix staff can access it only as section 11 describes.
• Your organisation controls its Space and its Customer Content. Its Admins can see who's in the Space and their roles, manage your access, and see, export or delete what you've written in the team lane.

Our analytics and advertising providers

Website. The cookies and pixels on our website send website visitors' data (pages you visit, clicks, device and browser details, IP address and cookie identifiers) to Google (Google Analytics and Google Ads), Meta (the Meta Pixel), LinkedIn (the LinkedIn Insight Tag) and X (the X Pixel). Section 14 explains how to turn them off.

Email addresses and conversions. We may also give these providers the email addresses of people who sign up for KoalaFix themselves or join our waitlist, in a coded (hashed) form that each provider matches to its own users. We do this to show our ads to people who may be interested, to stop showing them to existing customers and, where the provider offers it, to reach people similar to them. When someone who clicked one of our ads signs up, starts a Trial or pays, we may also tell the provider from our servers, with the ad's click identifier and, for the people this section covers, a hashed email address, so it can measure the ad. We don't send the email addresses of people who were invited into a Space rather than signing up themselves, and we never send Customer Content.

Your choices. In the EU, the EEA and the UK, we use your email address this way only if you agree, and you can withdraw at any time. Everywhere else, you can opt out at any time in your account settings or by emailing support@koalafix.com, and we'll stop including your email address from then on.

These providers use the information to measure our advertising and show our ads, and may also use it for their own purposes under their own terms and privacy policies. Under some US state laws, sending them this information can count as "selling" or "sharing" personal information (section 13).

Others, only when needed

• Professional advisers, insurers and auditors, under a duty of confidence.
• Authorities and courts, only when the law requires it. We check that each request is valid, challenge requests we have reasonable grounds to consider unlawful, and disclose only the minimum. Unless the law forbids it, we tell the affected organisation first so it can object. We keep a record of the requests we receive.
• A buyer or successor, if KoalaFix is reorganised, merged or sold, including moving our business to a related company such as a future US parent company. We'll give notice first, and the new owner must keep handling personal information in line with this policy.
• Anyone else you or your organisation ask us to share it with.

We don't sell or share Customer Content (as US state privacy laws use those words), and we never use it for advertising. Apart from what we send our analytics and advertising providers as this section describes, we don't give personal information to others for their own marketing.

9 · Overseas processing

In short: we store team memory, embeddings and sign-in data in Australia. Some providers store or process other information in other countries, including the US, the EU and Singapore and, for the AI judge, wherever Microsoft runs the model. We use contracts to protect it, except that our analytics and advertising providers (Google, Meta, LinkedIn and X), mainly in the US, use what we send them under their own terms.

We store Customer Content, embeddings and sign-in data in Australia, including the geo-redundant backup copy. These recipients are located, or may process personal information, outside Australia:

Memory that reaches your teammates' agents goes wherever their AI providers operate, under your organisation's arrangements, not ours.

Safeguards. Before we send personal information to a provider overseas, we take reasonable steps (mainly a written contract that limits its use) so that the provider protects the information in line with the APPs, and we stay responsible for how it handles that information for us. Our analytics and advertising providers are different: they receive this information under their own terms and may use it for their own purposes (section 8). For personal information from the EU/EEA, the UK or Switzerland, we use the European Commission's Standard Contractual Clauses (2021) with the UK Addendum and the Swiss amendments and, where a provider is certified, the EU–US Data Privacy Framework and its UK and Swiss extensions. Australia doesn't have an EU adequacy decision, so where EU or UK law treats sending information to us in Australia as a transfer, the Standard Contractual Clauses in our DPA cover it. For a copy of the safeguards, email support@koalafix.com (we may remove commercial terms).

Future regions. We plan to open US and EU hosting when there's demand. We'll update the Subprocessors page and tell an organisation's Admins before moving its data to another region. On the Enterprise plan, a Space's memory can live in a Postgres database the organisation owns, which our hosted service connects to.

10 · How long we keep it

In short: team memory stays until your organisation deletes it, except on the Basic plan: hidden memory is deleted 12 months after it's hidden, and we close Spaces no one has used for 24 months. Other records have set periods. Deleted accounts and Spaces leave the live Service, and then our backups.

This table uses the same words as our other documents, so "you" means your organisation or you as a person, whichever fits the row.

On the Basic plan, memory that isn't hidden is kept the same way.

We also keep:

Hidden memory on the Basic plan. Check-ins and open work are never hidden, and the same rules apply to private-lane memory. The dashboard shows how much memory is hidden and the date the next hidden memory will be deleted. We also email Admins at least 30 days before hidden memory is first due to be deleted, and then once a month while more is due. "Hidden memory on the Basic plan" in the Plans & Billing Terms explains how hiding works.

Hidden memory is still your organisation's Customer Content, and our promises about it still apply. On the Basic plan, the only way to get hidden memory back is to upgrade to Premium within 12 months of it becoming hidden. It isn't included in any export, including when your organisation leaves KoalaFix or moves to another provider, unless a law requires us to provide it. Admins can still delete hidden memory, or the whole Space, at any time without upgrading. If someone makes a legal request about their personal information and it may be in hidden memory, contact us at support@koalafix.com and we'll do what the law requires. A full export when your organisation leaves also includes private-lane memory (section 8), apart from hidden memory on the Basic plan.

Deleting things. An Admin can delete individual memory, or the whole Space by typing its name to confirm, and anyone can delete their own account from the dashboard. Deleting your account deletes your private notes. Team notes you wrote stay with the Space and show as written by "a former member", unless you choose "Also delete what I wrote". The last Admin of a Space can't delete their account until they hand over admin rights or delete the Space. Where an Enterprise organisation keeps memory in its own database, it decides how long memory stays there.

11 · How we protect it

In short: we use encryption, membership checks on every request, limits and tightly controlled staff access. The Security Practices page gives the details, including what we haven't done yet.

We protect personal information with encryption in transit and at rest, a check of the person's membership of the Space on every request (teams share one database and are kept apart by those checks, not by separate databases), tokens that can be revoked and set to expire, rate limits, and a write guard that refuses text that looks like an API key or token. Only named KoalaFix founders and staff with a need can access Customer Content, only for the reasons in "KoalaFix staff access" on the Security page, and we log that access. We don't yet have SOC 2 or ISO 27001 certification or an independent penetration test, and no system is perfectly secure: "What we haven't done yet" on the Security page says where we are, and you can report any concern to support@koalafix.com.

If something goes wrong. If a security breach affects personal information, we'll tell the affected organisation without undue delay and in any case within 72 hours after we become aware. We'll also tell affected people and regulators where the law requires.

12 · Your rights and choices

In short: you can ask to access, correct, delete or export your personal information, restrict or object to how we use it, and withdraw consent. For team memory, ask your organisation first and we'll help it. Requests are free in most cases.

Depending on where you live, the law gives you some or all of these rights. We'll respond to requests from anyone, wherever they live, as far as the law allows:

• Access: find out what personal information we hold about you, and get a copy.
• Correction: have wrong, out-of-date or incomplete information fixed (you can also edit your account details in the dashboard). If we disagree, you can ask us to keep a note with it saying you think it's wrong.
• Deletion: have your personal information deleted, or delete your own account (section 10). We keep what the law requires, such as billing records.
• Portability: get your Account Data in a structured, machine-readable format, or have it sent to someone else where that's technically possible. Your organisation's Admins can export the team-lane memory you've written, and if your organisation asks for a full export, for example when it leaves KoalaFix, that export includes your private-lane memory too, apart from hidden memory on the Basic plan (section 10).
• Restriction: have us limit how we use your information while a concern is sorted out.
• Objection: object to uses based on legitimate interests, and to direct marketing, including advertising that uses your email address, at any time (sections 5 and 8).
• Withdrawing consent at any time, without affecting what we did before.
• Human review of an automated decision (section 7).

How to ask. Email support@koalafix.com. We check that a request comes from the person it's about, usually by asking you to send it from, or confirm it through, the email address on your account. If that won't work, we'll ask for the least extra information we need, and use it only to check who you are. Someone you've authorised in writing can make a request for you; we may confirm that with you.

Team memory and other Customer Content. The organisation that runs a Space decides what happens to its Customer Content. For requests about it, such as something a teammate wrote about you or your line in the team map, please contact that organisation first. If you contact us instead, tell us which organisation you think holds the information. We'll pass your request on, which means telling the organisation who you are and what you've asked, and help it respond. If someone makes a legal request about their personal information and it may be in hidden memory, contact us at support@koalafix.com and we'll do what the law requires (section 10). We won't search organisations' Spaces for your information without their instructions.

How long it takes. We'll respond as soon as we can, and within one month of receiving your request (20 working days in New Zealand). For complex or multiple requests we may need up to two more months where the law allows; if so, we'll tell you why within the first month.

Fees and refusals. Requests are free. If a request is clearly unfounded or excessive, such as the same request repeated many times, we may charge a reasonable fee or decline it where the law allows. If we say no, we'll tell you why in writing (unless the law doesn't let us) and how to complain.

Other choices. You can unsubscribe from marketing (section 15), opt out of advertising that uses your email address (section 8), manage our website's cookies and pixels (section 14), or ask your organisation's Admins to remove you from its Space.

13 · Information for your region

In short: extra information for people in Australia, New Zealand, the EU/EEA, the UK, Switzerland, the US, Canada and elsewhere, including which regulator you can complain to.

Australia

We handle personal information in line with the APPs. Our website's pixels collect personal information about visitors and, in line with the OAIC's guidance on tracking pixels, section 14 explains what they collect, who receives it and how to turn them off. Using your email address to advertise to you on Google, Meta, LinkedIn and X is direct marketing: you can opt out at any time (section 8), and we'll stop. Please bring any privacy complaint to us first (section 18). If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au. Because we're a small business that hasn't opted in to the Privacy Act, the OAIC may not be able to investigate a complaint about us, but we still keep the commitments in this policy.

New Zealand

The Privacy Act 2020 applies to how we handle personal information about people in New Zealand. We respond to access and correction requests within 20 working days. If you're not satisfied with how we handle a complaint, you can contact the Office of the Privacy Commissioner at www.privacy.org.nz.

Information others gave us. We hold team memory only for the organisation that uses KoalaFix, so that organisation must tell you when it collects information about you from someone else, as information privacy principle 3A requires. If a teammate invited you, we collected your email address from them. We use it to send the invite and set up your account, and share it only as section 8 describes. KoalaFix Pty Ltd holds it, at the address in section 18. No law requires us to collect it, and you can ask to access or correct it at support@koalafix.com. Our invite emails link to this policy.

EU/EEA, UK and Switzerland

Our legal bases are in section 5, your rights in section 12, transfers in section 9 and automated decisions in section 7.

• Representatives: none appointed in the EU/EEA or the UK; contact support@koalafix.com.
• Cookies and pixels (EU/EEA and UK): our website sets non-essential cookies and pixels only after you agree, and you can withdraw your consent at any time in "Cookie settings" (section 14).
• Advertising with your email address, and email tracking (EU/EEA and UK): we give advertising providers your hashed email address or conversion events about you, and track opens and clicks in our marketing emails, only if you agree. You can withdraw at any time (sections 8 and 15).
• Complaining to us (UK): UK law gives you the right to complain to us. Our process in section 18 meets it: we acknowledge complaints within 30 days, look into them without undue delay, and tell you the outcome.
• Complaining to a regulator: you can complain to the data protection authority where you live or work, or where you think the problem happened. The European Data Protection Board lists EU/EEA authorities at www.edpb.europa.eu. In the UK, it's the Information Commissioner's Office (or its successor) at www.ico.org.uk; in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).

US state privacy rights

Some US state privacy laws give residents rights over their personal information. We give everyone the rights in section 12, wherever they live. This policy is our notice at collection. In those laws' terms:

• Categories we collect: identifiers (name, email address, IP address, cookie identifiers, and account and token identifiers); commercial information (plan, billing and payment records); internet or other network activity (Usage Data, security logs, and how you use our website: pages you visit, clicks, and device and browser details); approximate location (from your IP address); professional information (organisation, and role or department); and account sign-in credentials. Customer Content may contain any category of personal information that people choose to write; we hold it as the organisation's service provider.
• Sensitive personal information: we use sign-in credentials only to sign you in and keep your account secure, not to infer anything about you.
• Sources, purposes, recipients and retention: sections 4, 5, 8, 10 and 14. We disclose personal information for business purposes only to the recipients in section 8.
• "Selling" and "sharing": our website's pixels send website visitors' data, and we send hashed email addresses and sign-up, Trial and payment events, to Google, Meta, LinkedIn and X (section 8). Under some US state laws, this can count as "selling" or "sharing" personal information (for cross-context behavioural advertising). The categories involved are identifiers (email address in hashed form, IP address, cookie identifiers and ad click identifiers), commercial information (sign-up, Trial and payment events), internet or other network activity (pages you visit, clicks, and device and browser details) and approximate location from your IP address. The recipients are those advertising and analytics providers. We don't sell or share Customer Content, and we never use it for advertising. We don't knowingly sell or share the personal information of anyone under 16.
• Your right to opt out: you can opt out of the "selling" or "sharing" of your personal information and, under other states' laws, of targeted advertising. Use "Your privacy choices" on our website, or a browser or extension that sends a Global Privacy Control signal, which we treat as a request to opt out of "selling" and "sharing". Opting out turns off our advertising pixels, and any analytics whose provider uses the information for its own purposes, on that browser. If you're signed in when you opt out, or you opt out in your account settings or by emailing support@koalafix.com, we also stop sending your email address and conversions about you (section 8). Section 14 explains these choices.
• AI training: we don't use personal information to train large language models or other AI models.
• De-identified information: we keep it de-identified and don't try to re-identify it.
• Authorised agents can make requests for you with your signed permission; we may ask you to confirm your identity with us directly.
• Appeals: if we decline your request, email support@koalafix.com with "Appeal" in the subject line. We'll reply in writing with our decision and reasons, within the time your state's law sets. If you're still unhappy, you can contact your state's Attorney General.
• No discrimination: we won't treat you differently because you use your rights.

Canada and other countries

If you're outside Australia, your personal information is processed in Australia and the other countries in section 9 (for people in Canada, that means outside Canada), where courts and authorities may be able to access it under local law. Your local law may give you other rights; contact us and we'll respond in line with it.

14 · Cookies and similar technologies

In short: our website uses cookies, analytics and advertising pixels that send details of your visit to Google, Meta, LinkedIn and X. They use them to measure and show our ads, and may use them for their own purposes. In the EU, the EEA and the UK, the cookies and pixels are off until you agree; everywhere else, you can turn them off. We don't use session replay or website chat tools. The dashboard uses only strictly necessary cookies.

Dashboard. When you sign in to the KoalaFix dashboard, we set a session cookie that keeps you signed in. It's Secure, HttpOnly and SameSite=Strict, and it expires after 12 hours. We also use a security token to protect against cross-site request forgery. Both are strictly necessary, so we don't ask for consent; if you block them, you can't sign in. The dashboard uses only strictly necessary cookies.

Website. Our website (koalafix.com) uses cookies, analytics and advertising pixels from Google (Google Analytics and Google Ads), Meta (the Meta Pixel), LinkedIn (the LinkedIn Insight Tag) and X (the X Pixel). They record how you use the website (pages you visit, clicks, device and browser details, IP address and cookie identifiers) and send it to those providers. They use it to measure our advertising and show our ads to you on other sites, and may also use it for their own purposes under their own privacy policies. We don't use advertising pixels in the KoalaFix dashboard or the Service, and we never use Customer Content for advertising. We don't use session replay (tools that record how you move around a page) or website chat tools. Section 10 says how long the cookies last.

Your choices. If you're in the EU, the EEA or the UK, we only set non-essential cookies and pixels after you agree in our cookie banner, and you can change your mind at any time in "Cookie settings". Everywhere else, you can turn them off in "Cookie settings" or "Your privacy choices". We treat a Global Privacy Control signal from your browser as a request to opt out of "selling" and "sharing", and turn off our advertising pixels and any analytics whose provider uses the information for its own purposes. These settings control the cookies and pixels in your browser; to stop us using your email address for advertising, see section 8. In our banner, "Reject all" is as easy to choose as "Accept all", and nothing is ticked in advance. You can also block or delete cookies in your browser. There's no agreed standard for Do Not Track signals, so our website doesn't respond to them; it acts on Global Privacy Control signals instead. Section 13 explains what some US state laws call "selling" and "sharing".

15 · Emails

In short: we send the service emails you need, and marketing emails only if you've opted in. Marketing emails track opens and clicks (in the EU, the EEA and the UK, only if you agree). Every marketing email has a working unsubscribe link.

Service emails. We send the emails you need to use KoalaFix: sign-up confirmations, password resets, invites, Trial confirmations and reminders, receipts, warnings to Admins before hidden memory on the Basic plan is deleted, warnings before we close a Basic Space or account no one has used for 24 months (section 10), a yearly subscription summary for Admins of paying Spaces, security notices, and notice of changes to our Terms, this policy or our Subprocessors. They come from no-reply@koalafix.com through Brevo, so to reach us, email support@koalafix.com rather than replying. They're factual, with no promotions, and you can't opt out of them while you have an account. If someone invites you, the invite email lets you opt out of further invites from that Space.

Marketing emails. We send product news and offers only if you've opted in; the box is never ticked for you. Every marketing email identifies KoalaFix Pty Ltd and has an unsubscribe link that works without signing in, and we act on unsubscribes within 5 working days. Our marketing emails record whether you open them and which links you click, so we can see what's useful; in the EU, the EEA and the UK, they do this only if you've agreed. You can block open tracking by turning off images in your email app. Our service emails don't track opens or clicks.

16 · Children

In short: KoalaFix is for adults at work. If we learn we hold information from someone under 18, we delete it.

KoalaFix is for work use by people aged 18 or over, and isn't directed at children. We don't knowingly collect personal information from anyone under 18. If we learn that we have, we'll delete it and close the account. If you think someone under 18 has given us information, email support@koalafix.com. "What not to put in KoalaFix" in our Acceptable Use Policy also doesn't allow information about children in team memory.

17 · Changes to this policy

In short: we'll give at least 30 days' notice of material changes that affect your information, and we won't start using information we already hold in a new way without consent.

We'll update this policy when our practices or the law change, and record each change in the change log. For material changes that affect how we handle personal information, we'll give at least 30 days' notice by email to Admins (and, for changes to how we handle Account Data or Usage Data, to everyone with an account) and in the dashboard before the change applies. Changes needed for the law or security, or that only help you, may apply sooner. We won't start using personal information we already hold in a materially different way, such as to train AI models, without consent from your organisation or, for information we handle for ourselves, from you. Earlier versions are available on request.

18 · Contact and complaints

In short: email support@koalafix.com with any question or complaint. We'll acknowledge it, look into it and tell you the outcome. You can also go to a regulator.

KoalaFix Pty Ltd (ABN 99 696 245 959, ACN 696 245 959), 425 Smith St, Fitzroy VIC 3065, Australia.

• Privacy: support@koalafix.com
• General, billing and account help: support@koalafix.com
• Security: support@koalafix.com
• Legal notices, and our point of contact under the EU Digital Services Act: support@koalafix.com
• EU and UK representatives: see section 1

How we handle complaints. Email support@koalafix.com, saying what happened and what you'd like us to do. We'll acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome and what we've done about it. If you're not satisfied, you can go to the regulator where you live (section 13).

19 · Change log