GinoZi Privacy Policy
Draft — pending review by an Australian lawyer
Document details
- Operator: GinoZi, a business name of Madhaus Pty Ltd (ACN 659 024 290)
- Entity type: Australian proprietary company
- ABN: 92 659 024 290
- ACN: 659 024 290
- Business name: GinoZi
- Effective date: 12 November 2026
- Governing law: New South Wales, Australia
- Privacy contact: hello@ginozi.com
- Postal address: 6/59-63 Captain Cook Drive, Caringbah NSW 2229, Australia
Related documents: GinoZi Terms of Use, GinoZi Refund Policy, GinoZi Acceptable Use Policy, and GinoZi Freelancer (Seller) Terms. Defined terms in the Terms of Use have the same meaning in this policy.
Contents
- About this policy
- Who this policy covers
- Personal information we collect
- How we collect it
- Why we collect and use it
- When we disclose it
- Payments and Stripe
- Automated receipt checks
- Overseas disclosure
- Security
- Retention
- Access, correction and your other rights
- Direct marketing, cookies and analytics
- Notifiable data breaches
- Complaints
- Changes
- Contact
1. About this policy
This Privacy Policy explains how GinoZi, a business name of Madhaus Pty Ltd (ACN 659 024 290, ABN 92 659 024 290), an Australian proprietary company (we, us, our), handles personal information. We operate the GinoZi platform from Sydney, New South Wales, Australia.
We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). A small business with annual turnover of A$3 million or less may be exempt from the Privacy Act in some cases. Whether that exemption would apply depends on the annual turnover of Madhaus Pty Ltd as a whole, which can change, and some activities are covered even if the exemption otherwise applies. We will comply with the APPs anyway.
This policy starts on 12 November 2026. If you do not agree with it, you should not use the Platform. Some collection is required for the Platform to work (for example, an email and verified mobile number to create a Freelancer account, or payment details to complete a purchase).
The Platform is an Australia-only beta. People outside Australia cannot join the beta, but may join a waitlist. We still handle waitlist information, and personal information of people in Australia, in accordance with this policy.
2. Who this policy covers
This policy covers personal information about:
- Freelancers and people who apply for a Freelancer account, including staff or contractors of a Freelancer business whose details are given to us.
- Clients and Purchasers, even if they never create an account. Anyone who opens a Delivery link may provide personal information or have technical information collected about them.
- People who join a waitlist, including people outside Australia who cannot yet join the Australia-only beta.
- People who contact us, report abuse, or visit https://www.ginozi.com.
A Freelancer who includes another person's personal information in Files, in a Delivery description, or in a receipt must have a right to provide it, and should avoid uploading information that is not needed for the Delivery or the payment.
3. Personal information we collect
The personal information we collect depends on how you use the Platform. It may include the following.
| Category | Examples |
|---|---|
| Identity and contact | Name, email address, mobile number, business name, and postal or billing address if you give us one. |
| Account and verification | Magic-link and Google sign-in identifiers, SMS verification status, and account settings. Each Freelancer account has one mobile number. A mobile number that has already been used to verify one account cannot be used to verify another. |
| Client details | Name, email or other details a Client types, or that a Freelancer enters for a Delivery. |
| Waitlist | Name, email and any other contact details a person gives us to join the waitlist, including people outside Australia. |
| Files and messages | Uploaded Files, Previews, Usage Licence text, support messages, and abuse reports. Files may incidentally contain personal information (for example, a person's image). |
| Payment | Payment amounts, currency, status, and limited billing metadata. Card numbers are collected by Stripe, not stored by GinoZi. Bank-transfer receipts may show account names, references, and partial account details. |
| Usage and logs | IP address, device and browser information, approximate location derived from IP, pages viewed, and Delivery, approval, payment and download event logs. |
| Compliance | Records we need for tax, GST, complaints, disputes, chargebacks, and legal requests. |
We do not seek to collect sensitive information (as defined in the Privacy Act), such as health information or information about religious beliefs. Please do not upload it unless it is unavoidable in the Files themselves. If we ever collect sensitive information, we will do so only with consent or as otherwise permitted by law.
4. How we collect it
We collect personal information directly from you when you create an account, sign in, join a waitlist, open a Delivery link, submit a form, pay, upload Files or a receipt, contact us, or report abuse. We also collect some information automatically when you use the Platform, including IP addresses and event logs.
We may collect information from the Freelancer about a Client (for example, an email the Freelancer enters), from a Client about a payment, from Stripe about a payment's status, from Google if you choose Google sign-in, from Twilio Verify when we verify a Freelancer mobile number, and from our other service providers listed in section 9.
If you do not provide information we need, we may not be able to create an account, complete a payment, unlock Files, add you to the waitlist, or respond to you.
5. Why we collect and use it
We collect and use personal information for purposes that include:
- Creating and securing Freelancer accounts, including email and SMS verification, and limiting each mobile number to one Freelancer account.
- Operating the Australia-only beta, including confirming that a user is in Australia where we reasonably can, and operating a waitlist for people who cannot yet join, so we can contact them if the Platform becomes available to them.
- Operating Deliveries: hosting Files, generating Previews, recording approval, taking payment instructions, unlocking downloads, and offering a Link Extension to the Purchaser.
- Charging GinoZi's fees: the 2% Platform Fee on the Free plan after the first 5 Sends in a calendar month, paid Subscriptions (Starter, Pro and Teams), the Link Extension (currently A$5), Extra Storage at A$7 a month, including GST, for each extra 500 GB beyond the 500 GB included in a paid plan, and the optional 12-month retention add-on on the Free plan, at [FREE 12-MONTH RETENTION PRICE], including GST, also shown on the Platform. Extra Storage is not available on the Free plan. The Free plan includes 3 GB of storage. On a paid plan, Files are kept for 12 months after unlock at no extra charge. On the Free plan, keeping Files for 12 months after unlock is an extra charge.
- Preventing fraud, abuse and unauthorised access, and enforcing the Terms of Use and Acceptable Use Policy.
- Keeping download, approval and IP logs for at least 3 years as evidence if a payment is disputed or charged back, as set out in section 11. We do not use those logs to bind a Delivery link to an IP address or to restrict who can open a link.
- Reviewing bank-transfer receipts, including with an automated (AI) check, as described in section 8.
- Providing support, handling complaints and refund requests, and communicating about your account, a Delivery, a Subscription, the waitlist, or a change to our terms or this policy.
- Meeting our legal, tax, GST and accounting obligations, and dealing with Stripe, banks, insurers, and regulators.
- Improving and securing the Platform, including troubleshooting and understanding how features are used, in a way that is reasonably necessary for our business.
We will not use personal information for a purpose that is unrelated to the above, or that you would not reasonably expect, unless we have your consent or the law allows or requires it. We will not use waitlist details for unrelated marketing unless the person has separately opted in.
6. When we disclose it
We may disclose personal information to:
- The other party to a Delivery, to the extent needed to complete it. For example, a Freelancer may see that a Client has approved or paid, and a Client will see the Freelancer's Delivery details and Files.
- Our service providers, who process information on our instructions, including the providers in section 9.
- Stripe, and, for bank transfers, the Freelancer and (if needed) the Freelancer's bank, to complete or review a payment.
- Professional advisers, such as lawyers and accountants, under a confidentiality obligation.
- A person who acquires, or may acquire, our business, on the basis that they handle the information in accordance with this policy or the Privacy Act.
- Police, a regulator (including the OAIC), a court, or another person, if the law requires or authorises it, or if we reasonably believe disclosure is necessary to prevent serious harm or to report unlawful activity.
We do not sell personal information.
7. Payments and Stripe
Delivery payments made by card or another Stripe method are processed as direct charges on the Freelancer's own Stripe connected account, so that the Freelancer is the merchant of record. The Freelancer has a direct relationship with Stripe, and manages that account in their own Stripe Dashboard. Stripe hosts onboarding. GinoZi does not hold or control those Delivery funds. Subscription, Link Extension, Extra Storage and 12-month retention add-on payments are taken by GinoZi, also through Stripe unless we say otherwise at checkout. Bank transfer is GinoZi's own payment flow, not a Stripe payment method. It is available only on the Pro and Teams plans. The Client pays straight into the Freelancer's bank account. GinoZi never holds bank transfer funds, and GinoZi does not charge a transaction fee on those payments.
When you pay by card or another Stripe method, Stripe collects and processes your payment details under Stripe's own privacy policy and terms. We receive confirmation and limited metadata (for example, payment status, last four digits or wallet type, amount, and Stripe identifiers). We do not store full card numbers.
When you provide personal data in connection with the payment services, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy. You should also read Stripe's privacy notice, including how Stripe may process information outside Australia.
8. Automated receipt checks
If a Client pays by bank transfer, which is available only on the Pro and Teams plans, they or the Freelancer may upload a payment receipt so the Delivery can be unlocked. Bank transfer is GinoZi's own flow, not a Stripe payment method, and GinoZi never holds those funds. An AI model provided by xAI checks the receipt, then the Freelancer confirms receipt and unlocks the Files manually.
The AI check is an aid only. It is not a guarantee that the funds have arrived, that the receipt is genuine, or that the payment will not later be reversed. The Freelancer must confirm receipt of the funds before unlocking, unless the Freelancer knowingly chooses to unlock earlier.
We keep the data sent to xAI (Grok) to the minimum needed for the check. That data is the receipt image, the expected amount, the payment reference, and the Freelancer's bank name and the last 4 digits of their account. It does not include Client names, Client emails, or full account numbers. We send this data with storage disabled (store:false), so that xAI does not keep it. The receipt image itself may still show other personal details (for example, a name or balance visible on the receipt). You should avoid including information on a receipt that is not needed to evidence the payment.
How long we keep receipts ourselves is set out in section 11. We do not use receipt data to improve the AI check, or for unrelated profiling.
9. Overseas disclosure
Provider locations as checked on 11 November 2026, Australia/Sydney time.
We use service providers that store or access personal information outside Australia. When we disclose personal information to an overseas recipient, we take reasonable steps, including through our contracts and the provider's terms, to ensure the recipient does not breach the Australian Privacy Principles, as required by APP 8.1. We remain accountable for that disclosure under section 16C of the Privacy Act 1988 (Cth). We do not rely on your consent as the basis for overseas disclosure.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Twilio Verify | SMS verification at Freelancer sign-up only | Mobile number and verification codes or status. Not used for Client Delivery links. | Processed in Twilio's US1 region (eastern United States). |
| Railway | Application hosting and Postgres database | Account, Delivery, waitlist and other application data, which may include personal information. | United States (US West, California). |
| Cloudflare R2 | File and Preview storage | Uploaded Files and Previews, which may contain personal information (for example, a person's image). Files are kept for the periods set out in section 11, then deleted. | We use an Oceania location hint. That is a best-effort preference only, not a residency guarantee. Files may be stored or processed in other countries where Cloudflare operates. We do not promise that Files are stored in Australia. |
| Resend | Transactional email | Email addresses and message content, including waitlist and service messages. Resend account data, logs and API records. | Email is sent from Japan (Tokyo). Account data, logs and API records are stored in the United States. |
| Stripe (through Stripe Payments Australia) | Payment processing and Freelancer connected accounts | Payment and identity information Stripe collects to process a payment or maintain a connected account. We do not store full card numbers. | Personal data may be transferred to Stripe, LLC in the United States, and possibly to India and other countries, through Stripe affiliates and sub-processors. |
| xAI (Grok API) | Automated bank-transfer receipt checks, on Pro and Teams only | Kept to the minimum: the receipt image, the expected amount, the payment reference, and the Freelancer's bank name and last 4 account digits. It does not include Client names, Client emails, or full account numbers. Sent with storage disabled (store:false), so that xAI does not keep it. The receipt image itself may still show other personal details. | A global endpoint, with no guaranteed processing region. Processing may occur in the United States or elsewhere. |
| Google LLC | Optional Google sign-in | Sign-in identifiers and the profile information Google shares with us when you choose Google sign-in. | United States. |
Those providers may also have sub-processors in other countries. If we add or change a provider in a way that materially affects overseas disclosure, we will update this policy.
10. Security
We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include access controls, encryption in transit, and limiting staff and contractor access to what is needed.
No method of storage or transmission is completely secure. Delivery links are bearer links: anyone who has the link can open it. Freelancers and Clients must keep links confidential, as explained in the Terms of Use. That link design is a product choice, not an IP-based access control. We still protect stored Files and accounts with reasonable security measures.
11. Retention
We keep personal information only as long as we need it for the purposes set out in this policy, or as required by law (including tax and record-keeping laws). Under Australian Privacy Principle 11.2, we must take reasonable steps to destroy or irreversibly de-identify personal information when we no longer need it for those purposes. The periods below are the periods for which we currently need the relevant records. They include a minimum of 3 years for account, Delivery and payment records and metadata, and 7 years for records the ATO requires, such as tax invoices, payments and GST records. Those record-keeping periods do not apply to the Files themselves, except as set out in the Files and Previews row. How long we keep unlocked Files depends on the Freelancer's plan, as set out in that row.
| Record | Retention |
|---|---|
| Files and Previews | On a paid plan, kept for 12 months after unlock at no extra charge, then deleted. Those Files are active for the first 30 days after unlock, then archived for the rest of that 12-month period. The Freelancer can restore archived Files for free during the archive period. On the Free plan, keeping Files for 12 months after unlock is an extra charge, not included. By default, Free-plan Files are active for the first 30 days after unlock, then archived for a further 30 days, and then deleted. The Freelancer can restore archived Files for free during that archive period. A Freelancer on the Free plan may buy an optional 12-month retention add-on, at [FREE 12-MONTH RETENTION PRICE], including GST, also shown on the Platform, to keep unlocked Files for 12 months after unlock instead of that default period. Extra Storage is optional extra capacity on a paid plan, and is not available on the Free plan. The Free plan includes 3 GB of storage. Extra Storage does not change how long Files are kept. The storage period starts at unlock. If a Delivery is not paid, it remains active for 30 days after it is created, then is archived for a further 30 days, and is deleted 60 days after it is created (once archived, it is no longer available to the Client; the Freelancer can still see it as archived until it is deleted). The 3-year and 7-year record-keeping periods do not extend how long we keep the Files themselves. |
| Account, Delivery and payment records and metadata | Kept for the life of the account, and for at least 3 years. After an account is closed, we keep these records for at least 3 years from the relevant event, unless a longer period applies below. This covers account and transaction records, not the Files themselves. |
| Waitlist details | Until the person asks to be removed, or until we no longer operate the waitlist, then deleted or irreversibly de-identified, unless we must keep a record of the request or a legal obligation requires us to keep it longer. |
| Download, approval and IP logs | Kept for at least 3 years as chargeback and payment-dispute evidence, or longer if needed for an open dispute or a legal requirement, then deleted or irreversibly de-identified. They are not used to bind links to an IP address. |
| Bank-transfer receipts | Kept for 7 years. Used to review the payment and, if needed, a later dispute. Not used to improve the AI check, or for unrelated profiling. |
| Payment, tax invoice and GST records | Kept for 7 years, as required by the ATO and Australian tax law. |
When we no longer need personal information, including when those periods have ended and no legal requirement remains, we take reasonable steps to destroy it or to irreversibly de-identify it.
12. Access, correction and your other rights
You may ask us for access to the personal information we hold about you, and you may ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Freelancers can update many account details in https://app.ginozi.com/dashboard. Clients without an account, and people on the waitlist, can contact hello@ginozi.com.
We will respond within a reasonable time, and we will not charge you just for making the request. If we refuse access or correction, we will tell you why, unless we are not required to, and how you can complain. Where we refuse a correction, you may ask us to associate a statement with the information.
The Australian Privacy Principles do not give a general right to have personal information deleted. You may ask us to close a Freelancer account, to remove you from the waitlist, or to delete personal information that we no longer need. We will consider that request. We may keep information for as long as we need it for the purposes in this policy, or as required by law, including the periods in section 11. Closing an account does not mean that all records are deleted immediately.
If we rely on consent for a particular use, you may withdraw that consent at any time, without affecting earlier use that was lawful.
13. Direct marketing, cookies and analytics
We may send Freelancers service messages that are necessary for the account (for example, security, billing, trial-expiry, and changes to terms). We may also send optional product updates or marketing to Freelancers who have consented, or as otherwise permitted by the Spam Act 2003 (Cth) and the Privacy Act. You can opt out of marketing using the link in the message or by writing to hello@ginozi.com. We will not send marketing to a Client merely because they opened a Delivery link or paid a Freelancer, unless the Client has separately opted in. Waitlist messages are used to contact a person about the beta or future availability, not for unrelated marketing, unless the person has separately opted in.
The Platform uses only essential cookies, for sign-in and session. We do not currently use analytics or other non-essential cookies, and we do not display a cookie banner. If that changes, we will update this policy. You can control cookies in your browser, but some features may not work without essential cookies.
14. Notifiable data breaches
If we suffer a data breach that is likely to result in serious harm to an individual, and we cannot prevent that likely risk of serious harm with remedial action, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals in accordance with the Notifiable Data Breaches scheme, and we will take reasonable steps to contain and remedy the breach.
15. Complaints
If you have a privacy complaint, contact us first at hello@ginozi.com or 6/59-63 Captain Cook Drive, Caringbah NSW 2229, Australia. Please include enough detail for us to investigate. We will acknowledge your complaint and aim to respond within 30 days.
If you are not satisfied with our response, you may complain to the OAIC. See oaic.gov.au, or contact the OAIC on 1300 363 992. The OAIC generally expects you to complain to us first.
16. Changes
We may update this policy from time to time. We will post the updated policy on the Platform and change the effective date. If a change is material, we will also give notice by email to Freelancers, and we will present the updated policy at the next Client checkout or Link Extension purchase where practical. The current policy applies from the stated effective date.
17. Contact
Privacy questions, access and correction requests, and privacy complaints can be sent to hello@ginozi.com, or posted to GinoZi, a business name of Madhaus Pty Ltd, 6/59-63 Captain Cook Drive, Caringbah NSW 2229, Australia.