1. Who we are and what this policy covers
1.1 About Zato
Zato (“Zato”, “we”, “us”, “our”) provides an agentic AI compliance platform for accounting firms in Australia and New Zealand. The Zato group includes Zato Origin Limited, Zato New Zealand Limited and Zato Australia Pty Ltd.
This Privacy Policy explains how we collect, use, store, share, retain and delete personal information when you visit zatohq.com, use the Zato platform, connect third-party services such as Google, or contact us. It applies alongside our Terms of Use and Customer Data Processing Addendum (“DPA”).
1.2 Laws we comply with
We handle personal information in line with the Privacy Act 2020 (New Zealand) and its Information Privacy Principles, the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and, where it applies, the EU and UK General Data Protection Regulation.
1.3 Our role
For information about our website visitors, prospects and account users, we decide how that information is used. For the client data an accounting firm processes in the platform (“Customer Data”), the firm decides how it is used and Zato processes it on the firm’s behalf under the DPA. If you are a client of a firm that uses Zato, please contact that firm first about your information.
2. Information we collect
2.1 Information you give us
- Contact and account details: name, work email, phone number, firm name, role and login details when you book a demo, complete a form, register for a webinar or create an account.
- Customer Data: client records, ledgers, documents, workpapers, queries and related information a firm uploads to, or connects with, the platform.
- Communications: messages, support requests, survey responses and feedback you send us.
2.2 Information from connected services
When a firm connects an integration, we receive data from that service to run the compliance job, for example accounting ledgers from Xero, tax data from IRD and the ATO, company records from the Companies Office, and documents from FYI, SharePoint or Google Drive. Google data is covered in detail in section 4.
2.3 Information collected automatically
When you use our website or platform we collect technical information such as IP address, browser and device type, pages viewed, referring pages and the date and time of access, using cookies and similar technologies described in section 9. In the platform we also keep security and audit logs of sign-ins and actions taken.
3. How we use information
3.1 Purposes
- Providing, operating and supporting the platform, including running compliance jobs for the firms that use it.
- Authenticating users and keeping accounts, data and the platform secure.
- Responding to enquiries, demo requests and support requests.
- Sending service communications, and marketing communications you can opt out of at any time.
- Understanding how our website is used so we can improve it.
- Meeting our legal, tax, accounting and regulatory obligations.
3.2 Artificial intelligence
Zato uses AI models through Amazon Bedrock, hosted on AWS in the region your firm elects. Customer Data is processed to deliver the service to your firm only. It is not used to train foundation models, and it is not used to train generalised AI or machine learning models.
4. Google user data
4.1 What we access through Google OAuth
Zato only accesses Google user data when you choose to sign in with Google or a firm administrator connects Google Drive. We request the minimum access needed for those features:
| Google feature | Data we access | Why we access it |
|---|---|---|
| Sign in with Google | Your name, email address, profile picture and Google account identifier. | To create and authenticate your Zato account and let you sign in securely without a separate password. |
| Google Drive | Read-only access to the Drive files and folders you connect to Zato, including file names, folder structure, file metadata and file contents. | To collect source documents for a client’s compliance job from the folders your firm already uses, so documents do not need to be uploaded again. |
We do not access Gmail, Google Calendar, Google Contacts or any other Google service, and we do not access Drive files outside the folders connected to Zato.
4.2 How we use it
Google user data is used only to provide and improve the user-facing features described above: signing you in, and bringing your firm’s documents into the relevant client job for review and sign-off by your team.
4.3 How we store and protect it
Google user data is stored on AWS infrastructure in the region your firm elects: Asia Pacific (Sydney) for Australian firms and Asia Pacific (New Zealand) for New Zealand firms. It is encrypted in transit and at rest. OAuth access and refresh tokens are encrypted and are used only by the Zato services that perform the authorised task. Access by Zato personnel is restricted, logged and granted on a need-to-know basis.
4.4 How long we keep it
- Sign-in profile data is kept while your user account is active and deleted within 30 days after the account is closed or removed by your firm.
- OAuth tokens are kept only while the connection is active. They are deleted within 7 days after you disconnect Google in Zato, revoke access in your Google Account, or your account is closed.
- Documents imported from Google Drive become part of your firm’s Customer Data and follow the Customer Data retention periods in section 7.
4.5 Whether we share it
We do not sell Google user data and we do not share it with third parties, except:
- with the sub-processors that host and operate the platform for us, such as AWS, under contracts that require them to protect it and use it only to provide our service;
- where your firm directs us to, as part of the service it has configured;
- where required by law, or to protect the security of the platform and our users.
Zato personnel do not read Google user data unless you give us explicit permission (for example to help with a support request), it is needed for security purposes such as investigating abuse, it is required to comply with the law, or it has been aggregated and anonymised for internal operations.
4.6 What we never do with Google user data
Google user data is never:
- used for serving advertisements, including personalised, retargeted or interest-based advertising;
- sold, or transferred to data brokers or information resellers;
- used to determine creditworthiness or for lending purposes;
- used to develop, improve or train generalised AI or machine learning models.
4.7 Limited Use
Zato’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4.8 Revoking access
You can disconnect Google at any time from your Zato settings, or remove Zato’s access from your Google Account at myaccount.google.com/permissions. To have Google user data deleted, follow the process in section 8.
6. Where information is stored
6.1 Data residency
Customer Data is stored and processed in the AWS region your firm elects: Asia Pacific (Sydney) for Australian firms and Asia Pacific (New Zealand) for New Zealand firms, with AI model inference in the same region by default.
6.2 Service providers outside Australia and New Zealand
Some sub-processors, such as identity and productivity providers, operate global services and may process limited personal information, such as account and sign-in details, outside Australia and New Zealand. Where this happens we rely on contractual protections that meet the requirements of New Zealand and Australian privacy law and, where it applies, the GDPR.
6.3 Security
Zato is certified to ISO/IEC 27001, ISO/IEC 42001 and ISO 9001, with an independent SOC 2 Type II attestation and GDPR-aligned data handling. More detail is on our Security page.
7. Data retention
7.1 Retention periods
We keep personal information only for as long as we need it for the purposes in this policy, or as required by law:
| Data | Retention period | Notes |
|---|---|---|
| Customer Data, including documents imported from Google Drive | For the life of the firm’s subscription. After termination it is available for export for 30 days, then deleted from active systems within a further 30 days. | Backups are overwritten within 35 days after deletion. |
| Account and user profile data | While the user account is active. | Deleted within 30 days after the account is closed or the user is removed. |
| Google OAuth tokens | While the connection is active. | Deleted within 7 days after disconnection, revocation or account closure. |
| Security and audit logs | 12 months. | Kept longer only if needed to investigate an incident. |
| Enquiries, demo requests, webinar and survey responses | Up to 24 months after our last interaction with you. | Deleted sooner on request, or when you unsubscribe from marketing. |
| Support communications | 3 years after the request is closed. | |
| Billing and financial records | 7 years. | Required by New Zealand and Australian tax law. |
| Website analytics | 14 months. | Set in Google Analytics. |
7.2 Your firm’s own obligations
Accounting firms may have their own record-keeping obligations for client files. Firms remain responsible for exporting and keeping any records they are legally required to hold before their data is deleted from Zato.
8. How to request deletion
8.1 The deletion process
- Make a request: email security@zatohq.com from the email address on your account, or ask your firm administrator to request deletion of a user, client or the firm’s whole account.
- Verification: we confirm your identity and authority before acting, and acknowledge the request within one business day.
- Deletion: we delete the information from active systems within 30 days of verification, including any Google user data and OAuth tokens, and it is overwritten in backups within a further 35 days.
- Confirmation: we confirm in writing when deletion is complete, and tell you about any information we must keep by law and why.
8.2 Client data held for a firm
If you are a client of an accounting firm that uses Zato, the firm controls that data. We will pass your request to the firm and help it respond.
10. Your rights
10.1 Access, correction and deletion
You can ask to access the personal information we hold about you, have it corrected, or have it deleted, and you can opt out of marketing at any time. Where the GDPR applies you may also object to or restrict processing and ask for your data in a portable format. Email security@zatohq.com and we will respond within 20 working days.
10.2 Complaints
If you have a concern, please contact us first so we can resolve it. You can also complain to the Office of the Privacy Commissioner in New Zealand (privacy.org.nz) or the Office of the Australian Information Commissioner (oaic.gov.au).
11. Changes and contact
11.1 Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed. If we make a material change, particularly to how we use Google user data, we will notify account administrators before it takes effect.
11.2 Contact us
Privacy enquiries: security@zatohq.com
Zato Origin Limited, Auckland, New Zealand