Privacy Policy
DataOZ is a reporting service for Australian wholesale food suppliers, operated from Canberra, Australia by dataoz.com.au (ABN 65 845 290 845). We take the sales files your retailers send you, clean them, and turn them into one reconciled dashboard. Doing that means holding data on your behalf, and this policy explains how we handle it.
We comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Notifiable Data Breaches scheme. Where the law gives small businesses an exemption, we do not rely on it: we hold ourselves to the Act in full.
What we collect
- Account details. Your name, work email address and login credentials when you or your employer creates a DataOZ account. Passwords are stored hashed, never in plain text.
- Billing details. Payments run through Stripe. Stripe collects and holds your card details; we never see or store card numbers. We keep records of your plan, invoices and payment status.
- Your business sales data. The retailer sales files you upload or sync from Google Drive, and the cleaned records and reports we build from them. These files describe your products and sales. They occasionally contain incidental personal information, such as the name of a retailer's store contact, and we treat the whole file with the same care either way.
- Demo requests and correspondence. If you ask for a demo on our website we collect the email address you give us. We also keep support emails so we can help you.
How we use it
We use your information to run the service: to clean and reconcile your files, show you your dashboard, bill your subscription, answer your questions and tell you about changes to the service. We contact you about DataOZ only with your consent, every marketing email includes a working unsubscribe link, and we honour unsubscribes promptly, as the Spam Act 2003 (Cth) requires. We do not sell personal information, and we do not use your sales data to benefit any other customer.
Where your data is stored
Our application and database run on Railway infrastructure located in Amsterdam, the Netherlands. Because of this, information you give us is stored outside Australia. We also use these providers, each of which may process data in its own regions:
- Railway: application hosting and database (Netherlands).
- Stripe: payment processing (United States).
- Google: two uses. Drive file sync, only for tenants who connect a Drive folder and only the folder they share; and Google's Gemini API, which receives a small sample of rows from each uploaded file so our software can suggest column mappings. Google processes this data in its own regions.
- Cloudflare: delivery of this marketing website.
Before we adopt a provider we check that it protects data to a standard consistent with the Australian Privacy Principles. This section is our disclosure under APP 8 (cross-border disclosure of personal information).
How we protect it
All traffic to DataOZ is encrypted in transit. Every customer's data sits in its own tenant, enforced at the database layer with PostgreSQL row-level security that fails closed: a request without a valid tenant context sees nothing. Cross-tenant administrative access is restricted to the operator and gated by a separate platform-admin boundary. Our full security model is summarised on our data security page.
Automated processing
DataOZ uses software, including AI language models, to suggest how the columns in a retailer's file map onto our shared vocabulary. These suggestions apply to business sales data, and a human can review and correct every mapping. We do not use automated systems to make decisions that produce legal or similarly significant effects on individuals. The sample rows used for these suggestions are processed by Google's Gemini API, as described in the storage section above.
If something goes wrong
If a data breach occurs that is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner and the affected people as soon as practicable, as the Notifiable Data Breaches scheme requires, and we will tell you plainly what happened and what we are doing about it.
Access, correction and deletion
You can ask us at any time for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete your account and its data. Email hello@dataoz.com.au and we will respond within 30 days. When a subscription ends, you can export your data for 30 days, after which we delete it from our production systems.
Cookies
This marketing website sets no analytics or tracking cookies. The DataOZ application uses a session cookie so you stay logged in, and nothing else.
Complaints
If you think we have mishandled your information, email hello@dataoz.com.au with the subject "Privacy complaint" and we will respond within 30 days. If our response does not resolve it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Changes to this policy
When we change this policy we will update the date at the top, and for material changes we will email account holders before the change takes effect.