Privacy Policy
Last updated 20 August 2026 · Oynayo Pty Ltd · ACN 691 113 514 · ABN 69 691 113 514
This policy explains how Oynayo Pty Ltd handles personal information in connection with Nectazo. It covers two different things: information about our own customers, and information about our customers' contacts, which we hold on their behalf. Section 2 explains why that distinction matters.
1.Who we are
Nectazo is operated by Oynayo Pty Ltd (ACN 691 113 514), ABN 69 691 113 514, a company incorporated in Australia.
We take the position that we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and, where it applies to the personal data we handle, the EU and UK General Data Protection Regulation.
Questions or complaints: privacy@nectazo.com, or by post to Oynayo Pty Ltd, PO Box 1216, Runaway Bay, QLD 4216, Australia.
2.Two roles: our data, and your data
2.1 Where we are the controller
For information about our own customers — the people who sign up for an account, their names, email addresses, login sessions and billing records — we decide how and why it is handled. We are the controller of that information, and this policy is our notice to you about it.
2.2 Where we are the processor
For the contact records, campaign content and engagement data our customers store in Nectazo, our customer decides what is collected and why. They are the controller; we are the processor, acting on their instructions. We do not decide who is contacted, what is sent, or how long a customer keeps a record.
Our obligations in that role are set out in Schedule 1 of our Terms of Service.
3.What we collect
3.1 Account information (we are controller)
- Your name and email address.
- A cryptographic hash of your password. We never store your password itself and cannot recover it.
- Login session records, including the IP address and browser user-agent used to sign in, so we can secure your account and show you active sessions.
- Your brand settings: sending domain, from-name, from-address, business address used in email footers, and brand description used by the AI features.
- Billing identifiers issued by Stripe (customer and subscription IDs), your plan, plan status and renewal date. We do not receive or store your card number, expiry, or security code — those go directly to Stripe.
- Your correspondence with us, including support requests.
3.2 Customer Data (we are processor)
Our customers store records about their own contacts. Depending on what a customer chooses to collect, these can include:
- email address, first and last name, phone number;
- company, job title;
- postal address, city, state, postcode and country;
- tags, free-text notes, and any custom fields the customer defines;
- subscription status (subscribed, pending, unsubscribed), the source the contact came from, and list memberships;
- suppression records — addresses that unsubscribed or complained, kept so they are not contacted again; and
- message engagement: which messages were sent and delivered, whether and when a message was opened, which links were clicked and when, and bounce and complaint events.
Customers may also connect a WooCommerce or Shopify store, in which case we store product information (titles, descriptions, prices, images and links). That is business information, not personal information, but it is Customer Data and is treated the same way.
Signup form abuse prevention. A customer's signup form is public, so anyone can reach it. To stop it being used to send unwanted email to a stranger, we count recent submissions against the sender's IP address and against the email address entered. The IP address is stored for this purpose alone — it is never attached to a contact record, never used to profile anyone, and the counters are deleted after seven days. Without it, a signup form could be turned into a way to mail somebody repeatedly against their wishes.
3.3 Website analytics (we are controller)
We measure visits to our public marketing pages. This is deliberately built to avoid identifying anyone:
- We set no cookie and store nothing on your device for analytics.
- We do not store your IP address or your user-agent string.
- To tell repeat page views apart, we compute a one-way hash of your IP address and user-agent combined with a secret that changes every day, and store only that hash. Yesterday's value cannot be linked to today's, and the hash cannot be reversed to recover your IP address.
- We store the page path, the referring website, any campaign tags in the link you followed, and a two-letter country code.
The trade-off is honest: if you visit on two different days you are counted twice, and several people behind one office connection may be counted once. We accept less accurate numbers in exchange for not tracking anyone.
3.4 Service logs
Our infrastructure providers generate operational logs, which can include IP addresses, request paths and error details, used to run and secure the Service and retained for a short period in the ordinary course.
3.5 Visitors to our customers' landing pages (we are processor)
Our customers can build landing pages that we host and serve — either at an address on our own domain, or at a domain the customer has connected for the purpose, in which case the page is ours to serve but the address is theirs. If you have arrived on one of those pages, you have a relationship with the business whose page it is, not with us. That business decides what the page says and what it collects; we run the hosting and the counting on their behalf, and this section describes what we do in that role. The business named on the page is the one to contact about your information, and their own privacy policy governs it.
What we record for the customer when a landing page is viewed:
- Which page was viewed, and when.
- The website that linked you there, and any campaign tags in the link you followed.
- A two-letter country code.
- The same daily-rotating one-way hash described in 3.3, computed from your IP address and user-agent, so repeat views can be told apart. We do not store your IP address or user-agent themselves, yesterday's hash cannot be linked to today's, and it cannot be reversed.
We set no cookie and store nothing on your device when you view a landing page. Because of that, these pages carry no cookie banner — there is nothing to consent to.
If you fill in a form on one of those pages, what you type goes to the business whose page it is and becomes their Customer Data, handled as described in 3.2. We also record for them that a signup happened on that page, alongside the same referring site and campaign tags, so they can see which of their links worked. That record holds no additional information about you beyond what is listed above.
4.Why we use it, and our legal basis
| Purpose | Information | Legal basis (GDPR) |
|---|---|---|
| Providing the Service — accounts, sending, reporting | Account information, Customer Data | Performance of a contract |
| Billing and collecting fees | Account and billing information | Performance of a contract; legal obligation |
| Security, fraud and abuse prevention | Account information, session and service logs | Legitimate interests — protecting the Service and its users |
| Support and communicating about the Service | Account information, correspondence | Performance of a contract; legitimate interests |
| Measuring and improving our marketing site | Cookieless analytics described in 3.3 | Legitimate interests — understanding demand without tracking individuals |
| Marketing our own product to account holders | Name and email address | Legitimate interests; consent where required. You can opt out at any time |
| Complying with law and responding to lawful requests | As required | Legal obligation |
We do not sell personal information, and we do not disclose it for cross-context behavioural advertising. We do not use our customers' contact lists to market our own products to those contacts.
5.Cookies
We use a small number of strictly necessary cookies and no others. We do not use advertising cookies, third-party analytics cookies, or tracking pixels on our website.
- A session cookie that keeps you signed in.
- A cookie that remembers which brand you are currently working in.
Because we set no non-essential cookies, we do not show a cookie consent banner. If you block the cookies above, you will not be able to sign in.
Landing pages we host for customers set no cookies at all — see 3.5.
5.1 Signup forms on our customers' websites
When a customer embeds one of our signup forms, our script stores one small entry in the visitor's browser for each form: whether that form has already been dismissed or signed up through. It exists so a popup does not reappear on every page, and on every page after somebody has already subscribed.
It holds no identifier and is never sent to us — it is read by the browser, on that site, to decide whether to show a box. It is a display preference rather than a tracking technology, which is why we treat it as strictly necessary to the function the visitor can plainly see. Clearing site data removes it, and the form simply forgets.
6.Email open and click tracking
Messages sent through Nectazo may include a small tracking image and links that redirect through our servers, so the sending business can see whether a message was opened and which links were clicked. Where that happens:
- the data is recorded against the contact record held by the sending business, not by us for our own purposes;
- the sending business is the controller of it; and
- if you do not want to be tracked, most email clients let you block remote images, which prevents open tracking, and you can unsubscribe using the link in the message.
7.AI features
Our optional AI writing features send the text a customer provides, along with relevant context from their account such as their brand description and previous campaign copy, to Anthropic to generate suggested content.
Our optional AI image generation feature sends the customer's written prompt, and any reference image they choose to supply, to OpenAI to generate an image. The generated image is stored in our own systems and served from our infrastructure.
Neither provider uses content submitted through its API to train its models, and we do not use Customer Data to train models.
Customers should not paste personal information about their contacts into AI prompts, as it is not necessary for the feature to work.
8.Who we share information with
We share personal information with the service providers below, only as needed to run Nectazo, and under contracts requiring them to protect it.
| Provider | What they do | Where |
|---|---|---|
| Vercel Inc. | Application hosting and content delivery | United States |
| Neon Inc. | Managed PostgreSQL database (all account and contact records) | United States (AWS us-east-1) |
| Amazon Web Services, Inc. | Email delivery (SES) and file storage (S3) for uploaded images, files offered as form downloads, and videos while they are being converted | United States (us-east-1) |
| Trigger.dev Ltd | Background job execution for campaign sending, automations and store sync | United States |
| Anthropic PBC | AI text generation for the optional AI writing features | United States |
| OpenAI, L.L.C. | AI image generation for the optional image generation feature | United States |
| Fly.io, Inc. | Video-to-GIF conversion for the optional animated GIF tool | United States |
| Stripe, Inc. | Subscription billing and payment processing | United States |
We may also disclose personal information:
- where required by law, court order, or a lawful request from a regulator or law enforcement agency;
- to establish, exercise or defend legal claims;
- to professional advisers such as lawyers and accountants, under a duty of confidentiality; and
- to a buyer or successor in connection with a merger, acquisition or sale of assets, in which case we will require them to honour this policy and will notify affected customers.
9.Where your information is stored
Our database, file storage and email infrastructure are hosted in the United States. This means personal information, including Customer Data, is stored and processed outside Australia, the European Economic Area and the United Kingdom.
For transfers of personal data out of the EEA, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable) or another lawful transfer mechanism. For Australian Privacy Principle 8 purposes, we take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles.
10.How long we keep it
- Account information — for as long as your account is open, and for 30 days after it closes so it can be recovered.
- Customer Data — for as long as the customer keeps it. Customers control deletion of individual contact records at any time. After an account closes, we delete Customer Data from live systems after 30 days.
- Backups — encrypted backups are retained on a rolling basis and overwritten within 90 days, so deleted data can persist in backups for that period.
- Suppression records — retained indefinitely in minimised form (email address and reason). Deleting them would destroy the record that someone asked not to be contacted, which would put them at risk of being contacted again.
- Billing records — retained for seven years to meet Australian tax and corporate record-keeping obligations.
- Website analytics — the visitor hash cannot be linked across days; aggregate visit records are retained for up to 24 months.
- Signup form abuse counters — the IP address and email address counters described in 3.2 are deleted after seven days.
- Videos uploaded for GIF conversion — deleted as soon as the conversion finishes, successfully or not. Only the resulting GIF is kept, in the customer's media library.
11.Security
We take reasonable steps to protect personal information, including:
- encryption of all traffic in transit using TLS;
- encryption at rest of third-party store credentials using AES-256-GCM;
- one-way hashing of account passwords and of API keys, so neither can be read from our database;
- signed, expiring tokens for unsubscribe and tracking links, so they cannot be forged or enumerated;
- strict separation of data between accounts and brands, enforced on every request;
- access to production data limited to personnel who need it to operate the Service; and
- hosting with providers who maintain recognised security certifications.
No system is completely secure, and we cannot guarantee absolute security. You are responsible for choosing a strong, unique password and keeping your API keys confidential.
12.Data breaches
If a data breach occurs that is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner and affected individuals as required by the Notifiable Data Breaches scheme.
Where a breach affects Customer Data, we will notify the affected customer without undue delay with the information available to us, so they can meet their own notification obligations. Where the GDPR applies, we will assist customers in meeting the 72-hour notification requirement.
13.Your rights
13.1 If you have an account with us
You may:
- access the personal information we hold about you, and request a copy;
- correct information that is inaccurate, incomplete or out of date;
- export your data, and delete your account;
- object to or ask us to restrict certain processing, and withdraw consent where we rely on it;
- request that we transfer your information to another provider in a structured, machine-readable format; and
- opt out of our marketing emails at any time using the unsubscribe link.
Contact privacy@nectazo.com. We will respond within 30 days. We may need to verify your identity first, and we may decline a request where the law permits — in which case we will tell you why.
13.2 If you are a contact of one of our customers
Your rights are exercised against the business that holds your details, not against us, because they decide what is held and why. Use the unsubscribe link in their message, or contact them directly.
If you cannot identify or reach them, write to privacy@nectazo.com and we will pass your request to the relevant customer and assist them in responding. We will not access or disclose their records to you without their instruction.
14.Children
The Service is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.
15.Changes to this policy
We may update this policy. The date at the top shows when it last changed. If a change materially affects how we handle your personal information, we will give at least 30 days' notice by email or in-app before it takes effect.
16.Complaints
If you think we have mishandled your personal information, contact privacy@nectazo.com first. We will acknowledge within 5 business days and aim to resolve the matter within 30 days.
If you are not satisfied, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au. If you are in the European Economic Area or the United Kingdom, you may also complain to your local data protection supervisory authority.