1. Who we are
Veeza is operated by Veeza Pty Ltd ABN 53 623 506 856, of shop 1a / 12 Coronation Parade Enfield NSW 2136 (Veeza, we, us or our). This policy explains how we handle personal information through our website, app, connected services and support channels. It covers account holders and people whose information is included in a customer’s workspace, including staff, contractors, clients and suppliers.
Contact our Privacy Officer at privacy@veeza.com.au or PO Box 4415 Homebush South NSW 2140. We handle personal information under applicable privacy laws, including the Privacy Act 1988 (Cth) and Australian Privacy Principles where they apply.
2. Information we collect
Depending on the features you use, we collect account details such as your name, email address, business name, contact details, role and login information; subscription and billing records; and information you provide to support.
Workspace information may include emails and attachments, invoices, quotes, purchase orders, project records, client and supplier details, reimbursements, assets, vehicles, timesheets, rosters and staff or contractor information. These records may contain names, addresses, contact details, financial information and other personal information.
We also collect technical and usage information such as IP addresses, device and browser details, login events, feature usage and diagnostic logs. Connected services may provide account identifiers, access tokens and information within the permissions you authorise.
3. How we collect information
We collect information directly when you register, use the service, upload documents, submit forms or contact us. We also collect information from authorised workspace administrators, team members, connected services, forwarded emails and people who communicate with a connected mailbox. Information may be generated when our systems extract or organise data from these sources.
You may browse public parts of our website or make general enquiries anonymously or using a pseudonym where practicable. Account and billing functions require identifying information. If required information is not provided, we may be unable to provide the relevant feature.
4. Connected email accounts
If you connect an email account or shared mailbox, we process email content, attachments and related metadata within the permissions and mailbox scope you authorise to provide selected Veeza features. This may include extracting information and organising it into invoices, quotes, projects, contacts and other business records. If you forward emails to Veeza, we process the forwarded messages and attachments for those purposes.
Only connect or forward a mailbox if you have authority to do so, and review its scope before enabling it. Connections are read-only. We ask for three permissions: see your email address, see your basic profile, and read-only access to email. We cannot send, delete or modify anything in your email.
You can revoke a connection at any time through your email provider’s account settings (for Google, myaccount.google.com/permissions), or in Veeza by opening Email Management and selecting the remove (bin) icon beside the connected mailbox. When you remove a mailbox in Veeza, we ask the provider to revoke our access token, delete the stored connection key from our database, and stop reading that mailbox. Forwarding rules you set up with your email provider must be disabled separately.
Google user data: Veeza’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to provide the user-facing email features you enable (sorting emails and extracting invoices, quotes and job details into your workspace). We do not use Gmail data for advertising, we do not sell it, and we do not allow humans to read it except with your consent, for security purposes, to comply with law, or where the data is aggregated and anonymised.
Gmail data is never used to develop, improve or train generalised or non-personalised AI or machine learning models, by Veeza or by any AI provider that processes it on our behalf. Gmail content is sent to an AI model only at the moment a feature needs it, solely to return a result to you.
5. Why we use personal information
We use personal information to create and administer accounts; deliver features you request; extract and organise business records; manage subscriptions; provide support; maintain service reliability and security; investigate misuse; and meet legal obligations. We may use appropriate technical usage data and de-identified information to understand and improve service performance. Information is only treated as de-identified where individuals are not reasonably identifiable.
We send service messages about security, billing and important account changes. We send promotional communications only where permitted by law. You can unsubscribe from promotional emails using the link in the message or by contacting us. Unsubscribing does not stop necessary service communications.
6. AI processing
Veeza uses AI to analyse, extract, classify and organise information you submit or authorise us to access. Relevant content may be sent to contracted AI providers to perform those functions. AI may produce inaccurate, incomplete or incorrectly matched information, so you should review outputs before relying on them.
We do not use customer email content, attachments or workspace documents to train general-purpose AI models, and we require providers processing that content on our behalf not to use it for that purpose.
Customer data (emails or anything else) is never used to train AI models. It's sent to the AI only at the moment a feature needs it (e.g. sorting an email), to get an answer.
We use AI models accessed through our AI Gateway: Google Gemini models (email sorting and reading invoices, statements and documents) and OpenAI GPT models (the voice assistant, reports and quote comparisons).
7. Who can access information
Within your organisation, information may be visible to workspace administrators and other users according to assigned permissions. Your organisation controls membership and roles. Ask your administrator about access to your organisation’s records.
We disclose information to service providers where needed to operate Veeza, including hosting, storage, email processing, AI, payments, analytics and support providers. Access by our personnel is limited to purposes such as support, security and service operation. We may disclose information where required or authorised by law or reasonably necessary to protect legal rights or safety. In a business sale or restructure, relevant information may be disclosed subject to confidentiality and applicable privacy obligations.
We do not sell personal information or use customer mailbox content for targeted advertising. We do not transfer or disclose your information to third parties for purposes other than the ones provided.
8. Overseas processing
Some providers or personnel may process, store or access personal information outside Australia. Data is stored in the hosted AWS facilities across Sydney Australia. However, requests to the AI features are processed by Google and OpenAI, which may happen outside Australia. Likely countries include USA. We take the steps required by applicable law for overseas disclosures, including appropriate contractual and other safeguards. Contact us for information about overseas processing. This policy does not ask you to waive your privacy rights.
9. Cookies and similar technologies
We use sign-in session token stored in the browser (localStorage) to keep you logged in, and small preference flags (e.g. dismissing the Fiona hint bubble). No advertising or tracking cookies, no third-party analytics trackers. You can manage cookies through your browser. Blocking essential cookies may prevent some features from working. Where required by law, we obtain consent before using non-essential technologies.
10. Security and data breaches
We take reasonable technical and organisational steps to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure. Data is transferred via HTTPS, and critical (banking, security, and confidential) data is encrypted (AES-256). No online service can guarantee absolute security. Keep your login details secure and notify us promptly of suspected account compromise. We assess suspected data breaches and notify affected people and regulators where required by law.
11. Retention and deletion
We retain personal information for as long as reasonably necessary to provide the service, meet legal obligations, resolve disputes and maintain security. We delete or de-identify information when it is no longer needed, subject to lawful retention requirements.
After a workspace subscription ends, the account owner has 30 days to request an export. We then delete workspace information from active systems, unless retention is legally required or a dispute or security investigation reasonably requires preservation. Residual backup copies expire within a further 90 days and are restricted from routine use. If a backup is restored, deletion requests are reapplied.
Disconnecting an integration, deleting a user account and deleting an organisation’s workspace are different actions. Business records may remain in an organisation’s workspace after an individual leaves. Billing, compliance and security records may be retained separately for 30 days.
12. Access, correction and privacy requests
Contact hello@veeza.com.au to request access to or correction of your personal information, or to raise a deletion or privacy concern. We may need to verify your identity and authority. We will respond within a reasonable period and any applicable legal timeframe. If access or correction is refused, we will explain the reason and complaint options where required. There is no charge to make a request; any lawful access processing charge will be explained in advance.
If your information is held in a customer’s workspace, we may coordinate with that organisation to respond. This does not remove any rights you have against Veeza under applicable law.
13. Privacy complaints
Send complaints to privacy@veeza.com.au with details of your concern. We aim to acknowledge them within 7 days and respond within 30 days. If more time is required, we will explain why. If unresolved, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au where the matter falls within its jurisdiction, or another relevant regulator.
14. Changes to this policy
We may update this policy to reflect changes to our service or legal obligations. We publish the current version with its effective date and notify users of material changes through an appropriate channel. Any new consent required by law will be sought separately; updating this policy does not itself supply that consent.
