Privacy Policy.

01 · Overview.

KoalaFix Pty Ltd ("we", "us", "our") respects your privacy and is committed to protecting personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This Policy also applies to users in New Zealand (under the Privacy Act 2020) and the United States. We do not currently offer the Service in the EU or UK.

02 · What we collect.

We collect the following categories of data:

• Account information: name, email address, billing contact details, and (for business accounts) company name and admin details.
• Remediation events: the action performed (e.g. service restart, cache clear, registry modification), timestamp, target application, and outcome.
• Device health snapshots: Windows service states, disk usage, running processes, network status, installed application versions, and other diagnostic telemetry.
• Usage events: feature usage, LLM call counts, session metadata, and in-app navigation events.
• Conversation content: messages and prompts you send to the AI assistant, and the responses generated.
• Support tickets: the content of any support correspondence.
• Technical data: IP address, device identifiers, operating system, browser type, and diagnostic logs.
• Microsoft 365 data (optional): if you connect a Microsoft 365 account, we access data via Microsoft Graph using the scopes Files.Read, offline_access, openid, profile, and User.Read.

03 · How we use information.

We use personal information to:

• Provide, operate, and maintain the Service
• Process inputs and generate AI-assisted responses
• Perform automated remediation actions you request
• Improve functionality, reliability, and performance, including improving our AI models (see Section 5)
• Maintain security, detect abuse, and prevent misuse
• Send you service-related and (with your consent) marketing communications
• Meet legal and regulatory obligations

04 · AI processing and the KoalaFix relay.

When you use the AI assistant, your conversation content is transmitted from the KoalaFix app via our relay server at api.koalafix.com to Anthropic (United States) as our primary AI provider. If Anthropic's service is unavailable, your conversation content may be routed to OpenAI (United States) as a fallback provider.

Both providers' APIs are configured so that your conversation content is not used by Anthropic or OpenAI to train their models. Each provider processes your content subject to their applicable terms and privacy policies, available at anthropic.com/legal and openai.com/policies.

The Service requires a persistent internet connection to api.koalafix.com. If the relay is unreachable, AI features will be unavailable.

05 · Use of conversation content for model improvement.

We may use conversation content to improve our own AI models and the Service. This is separate from the provider no-train settings referenced in Section 4 — Anthropic and OpenAI do not train on your content, but KoalaFix may, subject to the protections set out below.

The following protections apply:

• You can opt out at any time. To opt out, go to your account settings or email support@koalafix.com. We will stop including your conversation content in future training runs within 7 days of your request.
• Sensitive content is excluded. We apply automated filters to exclude content that contains detected passwords, payment details, government identifiers, and other sensitive personal information from our training pipeline.
• Retention for training purposes. Once conversation content has been incorporated into a trained model, it cannot be removed from that model. However, if you request deletion or opt out, we will not use your content in any future training runs.

06 · Microsoft 365 data.

If you connect a Microsoft 365 account, we access your data via the Microsoft Graph API using the scopes listed in Section 2, solely to diagnose and remediate the issue you've asked us to help with. Access is granted only through explicit OAuth consent and can be revoked at any time via myaccount.microsoft.com.

07 · Marketing communications.

If you have given us your consent (or where we are otherwise permitted under the Spam Act 2003 (Cth)), we may send you marketing emails about product updates, features, and offers. Every marketing email contains an unsubscribe link, and you can also opt out by emailing support@koalafix.com. Service-related communications (billing, account changes, security) will continue regardless of marketing preferences.

08 · Data storage and security.

Personal data is stored with Supabase in the Sydney (ap-southeast-2) region. We take reasonable technical and organisational steps to protect data, including encryption in transit (TLS) and at rest, role-based access controls, audit logging, and regular patching and security review. No system is completely secure.

If we become aware of a data breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and equivalent authorities in New Zealand and the US where applicable.

09 · Sharing of information.

We share information only with:

• Subprocessors strictly as needed to provide the Service. Our current subprocessors are: Supabase (data hosting, Sydney AU), Anthropic (primary AI provider, US), OpenAI (fallback AI provider, US), Stripe (payment processing, US/AU), and Microsoft (Graph API access, per your M365 region, only if you connect a Microsoft 365 account). We give at least 30 days' notice before adding or replacing a subprocessor.
• Legal authorities where required by law, court order, or to protect rights, property, or safety.
• Professional advisers (lawyers, accountants) under confidentiality.

We do not sell personal information.

10 · Data retention.

• Conversation content, remediation events, and device health snapshots: 12 months from last use, unless you request earlier deletion (subject to Section 5 for training data).
• Account and billing records: for the life of your account plus 7 years to meet Australian tax and record-keeping obligations.
• Support tickets: 24 months from closure.

11 · Your rights — access, correction, and deletion.

You may ask us to access, correct, or delete your personal information by emailing support@koalafix.com. We will acknowledge your request within 7 days and complete it within 30 days, or explain any delay.

New Zealand users have equivalent rights under the Privacy Act 2020 and may complain to the Office of the Privacy Commissioner at privacy.org.nz. California users have rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of "sharing" — we do not sell personal information. Australian users may complain to the OAIC at oaic.gov.au.

12 · International data transfers.

Your data may be processed outside Australia. In particular, conversation content is transmitted to Anthropic (United States) and may fall back to OpenAI (United States). Where data is transferred internationally, we take reasonable steps to ensure it is protected consistently with this Policy and applicable law.

13 · Cookies and analytics.

We use cookies and similar technologies on our website to keep you signed in, remember preferences, and understand how the Service is used. You can manage cookies via your browser settings.

14 · Children.

The Service is not directed at anyone under 18, and we do not knowingly collect information from them. If you believe we have collected information about a minor, contact us and we will delete it.

15 · Changes to this Policy.

We may update this Policy from time to time. Where changes are material, we will notify active users by email or in-app notice. Continued use of the Service after an update indicates acceptance.

16 · Contact.

KoalaFix Pty Ltd · ACN 696 245 959
425 Smith Street, Fitzroy VIC 3065
Email: support@koalafix.com