Privacy Policy

ZeroLapse collects the information needed to operate a business compliance platform. Customer organisations control most staff and compliance records; ZeroLapse operates the service. Information may be processed in Australia and by specialist providers. We do not sell personal information.

This Policy applies to ZeroLapse websites, applications, support, billing, service communications, and related interactions. ZeroLapse Limited is a New Zealand agency for information it collects and holds for its own business purposes. For personal information that a customer organisation submits and controls, that organisation is usually the relevant agency and ZeroLapse acts as its service provider or processor. Individuals should often contact their organisation first about records their organisation manages.

• Account and identity information: name, email address, authentication identifiers, role, organisation membership, and account preferences.
• Workforce and business records: staff number, role, location, assignments, licences, certifications, expiry dates, renewal details, and manager approvals or declines.
• Asset and premises records: vehicle, equipment, and building/location details, including plates, purchase information, assignments, inspections, insurance, WOF, registration, CoF, BWOF, and related obligations.
• Evidence and content: documents, images, notes, change proposals, exports, support attachments, and other material uploaded by users.
• Billing information: plan, subscription status, invoice and transaction identifiers, and limited payment metadata. Full card details are handled by Stripe, not stored by ZeroLapse.
• Technical and usage information: IP address, device/browser details, timestamps, session and security events, feature interactions, diagnostic logs, error reports, and audit records.
• Communications: support requests, feedback, product enquiries, consent records, and service or marketing communication preferences.

We collect information directly from users and customer administrators, from invited staff, automatically through use of the service, and from service providers such as authentication, payment, email, hosting, and monitoring providers. Customer organisations may enter information about staff and other individuals. This is an indirect collection. Since 1 May 2026, Information Privacy Principle 3A may require the collecting organisation to take reasonable steps to notify the individual unless an exception applies. Customers must ensure they have lawful authority and provide every notice required for their use of ZeroLapse.

• Provide, authenticate, administer, secure, support, and improve the service.
• Calculate expiry status and display compliance tracking information using deterministic rules, not AI decision-making.
• Send invitations, password or sign-in messages, reminders, trial and billing notices, security alerts, and other service communications.
• Process subscriptions and maintain business, tax, accounting, and fraud-prevention records.
• Respond to support requests and, where legitimately necessary, access customer data for support or maintenance.
• Detect misuse, investigate incidents, enforce agreements, and comply with legal obligations.
• Create aggregated and anonymised analytics that do not identify a customer or individual.
• Send product news or marketing where permitted; marketing consent and opt-out are handled separately from necessary service communications.

We disclose information only as reasonably necessary for the purposes above, with the relevant customer’s instructions, with consent, or as required or permitted by law. Categories include cloud hosting, database, authentication and storage (Supabase), application hosting (Vercel), payments (Stripe), transactional email (Resend), monitoring (Sentry), DNS and security services (Cloudflare), and business productivity and support providers (including Microsoft 365). Provider names and locations may change.

We may also disclose information to professional advisers, insurers, auditors, regulators, courts, law enforcement, a purchaser or successor in a genuine business transaction, or others where necessary to protect people, rights, property, or the service. We do not sell personal information or customer data.

The primary application infrastructure and database are configured in Sydney, Australia (ap-southeast-2 / syd1). Providers or their support systems may process information in Australia, the United States, or other countries. This means information may be accessible from or held outside New Zealand.

ZeroLapse will take reasonable steps to ensure overseas disclosures comply with Information Privacy Principle 12 of the Privacy Act 2020, including by using providers that are subject to the Act, comparable safeguards, binding contractual protections, or another lawful basis. Customers must assess and disclose their own overseas processing.

We use essential cookies and similar storage for authentication, session security, preferences, and service operation. We may use limited diagnostics or analytics where disclosed and permitted. See our Cookie Policy for categories and controls. We do not use non-essential analytics or advertising cookies unless they are actually deployed and disclosed.

We use reasonable safeguards designed for the service, including encryption in transit and at rest, authenticated access, role-based permissions, private evidence storage, tenant-isolation controls, audit logging, monitoring, backups, and incident response. Authorised ZeroLapse personnel may access customer data only for legitimate support, maintenance, security, legal, or operational purposes. No system is risk-free, and users must protect credentials and report suspected compromise promptly.

We retain personal information for as long as reasonably needed to provide the service, meet customer instructions, maintain security and audit records, resolve disputes, and satisfy legal, tax, and accounting obligations. After cancellation, customers are intended to have 30 days to export available data before deletion from active systems. Deleted data may remain in encrypted backups until overwritten under backup cycles and may be retained where legally required.

Subject to the Privacy Act 2020, an individual may request access to or correction of personal information ZeroLapse holds about them. Email hello@zerolapse.co.nz with enough detail to identify the information. We may need to verify identity and may transfer a request to the relevant customer organisation where that organisation controls the record. If correction is not made, an individual may be entitled to request that a statement of correction be attached. Complaints may also be made to the Office of the Privacy Commissioner at privacy.org.nz.

We maintain a process to assess and respond to privacy breaches. Where a breach has caused or is likely to cause serious harm, ZeroLapse will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, subject to the Privacy Act 2020. Customers must promptly provide information and cooperation needed for an assessment where Customer Data is involved.

The service is for organisations and authorised workplace users, not children acting independently. Customers must not invite or enter information about minors unless lawful, necessary for their legitimate business purpose, and supported by appropriate authority and safeguards.

We may update this Policy and will publish the updated date and provide notice of material changes where appropriate. Privacy enquiries can be sent to hello@zerolapse.co.nz or via our contact page.