Who this applies to
This policy applies to your use of Z-M Intelligence at intelligence.zmatc.com.au. Z-M Advanced Technologies Co. Pty Ltd (ACN 696 940 771; ABN 71 696 940 771) is the entity responsible for the personal information we collect. We are bound by the Australian Privacy Act 1988 and the Australian Privacy Principles ("APPs").
What we collect
- Account data: email address, name (if provided), organisation (if provided), and your authentication method (magic link / Google / Microsoft).
- Membership and billing data: the type of membership, when it started, when it renews or ends, and a Stripe customer reference. Card numbers never reach our servers — Stripe handles them under PCI DSS.
- Reading preferences: bookmarks, alert subscriptions, and saved searches that you create.
- Usage logs: a privacy-respecting page-view record (powered by self-hosted Plausible Analytics) without cross-site tracking. We log session-bound activity for fraud detection and security. We do not store IP addresses beyond 30 days.
- Communications: messages you send us at director@zmatc.com.au.
What we do not do
- We do not sell personal information to anyone, ever.
- We do not run third-party advertising trackers, pixels, or analytics that share data with anyone outside Z-M.
- We do not use your reading data to train any machine-learning model.
- We do not share your data with Founding Partners. Their relationship with us does not give them access to who our members are.
Why we collect it
- To run your membership and authenticate you.
- To bill you and provide tax invoices.
- To send the alerts and digests you have subscribed to.
- To detect and prevent fraud and abuse.
- To keep mandatory accounting records (BAS / ATO / 7 years).
Who else handles it
We use a small set of carefully chosen processors to operate the service. Each is bound by data-protection terms in their standard agreements:
- Hosting / compute: Vercel (Sydney region) at launch, with a Phase 2 migration to Australian sovereign cloud (Vault Cloud or AC3).
- Database: Postgres (Sydney region).
- Object storage: Cloudflare R2.
- Email: Resend (transactional email).
- Payments: Stripe (compliant with the Australian Payment Card Industry framework).
- Authentication: Auth.js, Google OAuth, Microsoft Entra ID for OAuth sign-in.
- Authoring assistance: Anthropic Claude with Australian-residency assurances. Customer data is not used by these tools — only public source material we are processing for the Library.
Where it is stored
Member personal information is stored in Australia. Some processors (Stripe, Resend, OAuth providers) operate internationally; their access is limited to what is required to provide the service. We have arrangements in place to ensure protections substantially equivalent to the APPs apply to those transfers.
How long we keep it
- Account information: until you delete your account, after which we remove it within 30 days except for what we are legally required to retain.
- Billing records: retained for at least 7 years to meet ATO obligations.
- Page-view logs: aggregated; raw session-level records age out after 30 days.
- Email captures (waitlist): until the email owner asks us to delete them, or we close the relevant campaign.
Your rights
You can ask us to:
- show you the personal information we hold about you;
- correct anything that is inaccurate;
- delete your account and the data we hold for it;
- export your bookmarks and alert preferences in JSON.
Email director@zmatc.com.au. We respond within 30 days.
Complaints
If you believe we have mishandled your information, contact us first. If we cannot resolve it, you can complain to the Office of the Australian Information Commissioner (OAIC).
Changes
Material changes to this policy will be notified to current members at least 30 days before taking effect.