Privacy Policy
Last updated 1 November 2026 · Komiti (ABN 45 984 876 899) · Sydney, NSW
Who we are
Komiti (ABN 45 984 876 899) operates from Sydney, New South Wales, Australia. A business our size may fall under the Privacy Act 1988 (Cth)'s small-business exemption, but we've chosen to handle your information as if the Australian Privacy Principles apply to us regardless, rather than rely on that exemption. You can reach us at [email protected] about anything in this policy, including access, correction, deletion or a complaint.
What we collect
| Information | When | Why |
|---|---|---|
| Your name, email, business name, industry, phone number if you give it, and what eats your week | When you send the "Book the free 30-minute call" form | Only to reply to you and arrange the call. The form sends it by email to [email protected] and the site doesn't store it: no database, no copy on our servers, and no automatic reply to the address you typed. We count only that an enquiry was sent |
| Name, email, business name, and what you need help with | When you joined the founding list or email us | To reply to you and understand who we're building for |
| Your answers to a checklist or question (industry, state, staffing, turnover band, free-text notes) | When you use the Setup Checklist or Business Q&A | To generate the response you asked for |
| Your account: email address, and a sign-in token sent to it | When you create an account or sign in | To sign you in. There is no password: a single-use link is emailed instead |
| Your business profile: ABN, entity name and type, state, industry, GST status, staff numbers, annual wages, premises and lease dates | When you set up a business in the app (most of it is filled from the public ABN register) | To work out which obligations actually apply to you, which is the core of the product |
| Documents you upload to the vault, their file names and any expiry dates you set | When you add them to your document vault | To store them for you and turn expiry dates into watched dates |
| ABNs you enter into the ABN lookup or the structure check | When you use those free tools | To read the public ABN register and compare business names against it. A one-off check doesn't keep the ABNs you enter, unless you ask us to watch them (next row). We only count that a check was run |
| Email address and the ABNs you ask us to watch, plus the last register reading for them | When you ask for a monthly structure watch and confirm it from your inbox | To re-read the public register each month and email you only when something changes. Nothing is watched until you confirm |
| Email address and industry for change alerts | When you ask to be told when the rules change | To email you when something changes that affects your industry |
| Email address, how you do payroll, how many people you pay, and what makes payday hard | When you ask for early access to Payday Watch and confirm it from your inbox | To set up your access (Xero users can connect now), to tell you if it becomes available for the payroll software you use, to decide what gets built next, and so we can ask how you handle payroll now. Nothing is kept until you confirm |
| Access to your Xero payroll: an encrypted access key, your organisation's name, your settings, the payroll jobs you've ticked off, the award and pay table line you pick for each employee if you use the award rate check, a note of which paydays and payroll findings we've already emailed you about (Xero IDs and dates, no names or amounts), and a daily check log | When you connect Xero to Payday Watch | To check your pay calendars, employees and pay runs once a day and email you about paydays. Payroll details are read each time and not kept. The check log records only what each daily check found (for example "a calendar was 2 paydays behind", "1 person has no super fund") and which emails went, with no names or amounts, so your monthly report can show the checks that were run. Komiti can prepare a draft pay run if you ask it to, and is blocked in its own code from posting pay runs or moving money. The award rate check reads published pay rates from the Fair Work Commission by sending only an award's code; nothing about your business or your employees goes to the Commission. Payroll data from Xero is never sent to an AI provider or used to train AI models |
| Usage counts: which section of the site was viewed, the domain of the website that linked you here, and how many times each free tool was used | Automatically, when a page loads or a tool is used. Not collected if your browser sends Do Not Track or Global Privacy Control | To know whether the site is useful. Kept only as daily totals, with no cookie, no IP address and nothing else that could identify you |
| Technical data: IP address, browser user-agent, timestamps | Automatically, on submission | Security, abuse prevention, and diagnosing faults |
Please don't put sensitive information (health, financial account numbers, government identifiers, or anything you wouldn't want processed by a third-party AI provider) into free-text fields. We don't need it and we'd rather not hold it.
When we build systems in your business
To build systems in your business, we need access to some of the software you use, such as your job or booking system, accounting software, email and website. While we have that access, we may see personal information about you, your staff and your clients.
- What access, and why. Before work starts, we tell you in writing which accounts we need access to and what for. We use it only to do the build we agreed, and the monthly service after it.
- Read-only where possible. We ask for read-only access wherever that's enough, and admin access only where a build step needs it.
- Removed at handover. Every account stays in your name. Any admin access we used is removed at handover.
- No client details in public AI tools. Your clients' personal or health information is never pasted into public AI tools.
- AI products are chosen for their data terms, for example business plans that don't train on your data. The AI tools and services we connect run under your own accounts and their own terms.
- Clinics. We treat beauty and health clinics as health service providers under the Privacy Act, and handle any health information we see on that basis.
Who processes your information
We use third-party providers to run the service. Some are located outside Australia, which means your information may be disclosed overseas, principally to the United States.
| Provider | What they handle | Where |
|---|---|---|
| Cloudflare | Website hosting and delivery (the edge network that serves pages) | Global network: pages are served from wherever you are |
| Cloudflare (D1 database and R2 storage) | Your account, business profile, obligations and vault documents | Region-pinned to Oceania. Verified 6 Sep 2026: the database reports region OC (Sydney) and the vault bucket is created in OC |
| Cloudflare (KV storage) | Founding-list and change-alert sign-ups, what you submit to the Setup Checklist and Business Q&A | Cloudflare's global network. Unlike the database above, this storage isn't pinned to Oceania |
| Xero | Only if you connect it: Komiti reads your payroll from Xero and can create a draft pay run there at your request | Xero's own hosting |
| Domain registries: auDA (.au), Verisign (.com) and Identity Digital (.ai) | Checking whether a domain name is registered when you use the name finder. They receive the domain name being checked, from Komiti's server or, when a registry is too busy to answer it, straight from your browser, which also shows them your IP address | Australia and the United States |
| Resend | Sending sign-in, structure-watch and payday emails, and delivering the enquiry form to our inbox | United States (sending infrastructure in Asia-Pacific) |
| Anthropic (Claude) | Generating checklists, answers and document drafts from what you submit | United States |
| Google Workspace | Our business email, if you contact us or send the enquiry form | Global, incl. United States |
We don't sell your information, and we don't use it for advertising or profiling.
How long we keep it
- Generated documents and the related audit record (who approved what, and when): kept for the same period unless you ask us to keep them longer for your own record-keeping obligations.
- Checklist and Q&A submissions: retained so we can improve the service and respond if you follow up.
- Contact details from the founding list: kept until you ask us to remove them.
- Structure watch: your email address, the ABNs and the last register reading are kept until you stop the watch, which is one click from any email we send, and are then deleted. A watch request that is never confirmed is deleted after 7 days.
- Xero connection: kept until you disconnect, which deletes the access key, settings and check log and revokes Komiti's access at Xero. Check log entries older than 400 days are deleted automatically.
- Business name watch for members: if your business profile has an ABN, Komiti watches the public register for that ABN every month and emails you only when something changes. It keeps the ABN and the last names it saw until you stop the watch (one click from the Everything due page or any watch email).
- Renewals you add (a name, an expiry date, and which business): kept until you remove them or close your account, and used only to email you reminders.
- Payday Health Check (one-off): the Xero access key is kept only until you disconnect or switch to Payday Watch, and at most 24 hours. No check log is kept and no emails are sent.
- Payday Watch early access: kept until you ask to be removed (every email has a one-click way), then deleted. Unconfirmed requests are deleted.
- Enquiries from the form: not stored on this site at all. The email stays in our inbox while we deal with your enquiry; ask and we'll delete it.
- Usage counts: daily totals, kept indefinitely. They contain nothing about any person.
You can ask us to delete anything sooner, or to hold it longer, by emailing [email protected]. We'll confirm when it's done.
Your rights
If you have an account, your account page lets you download everything Komiti keeps about you, change your emails, and delete your account and its data yourself. You can also ask us to give you a copy of the personal information we hold about you, correct it if it's wrong, or delete it. Email [email protected] and we'll respond within a reasonable time. If you're unhappy with how we've handled a privacy matter, you can complain to us first, and if that doesn't resolve it, to the Office of the Australian Information Commissioner at oaic.gov.au.
Security
Information is transmitted over encrypted connections and stored on Cloudflare infrastructure with access restricted to the operator. Your account data and vault documents are held in storage pinned to the Oceania region. Sign-in uses a single-use link emailed to you that expires in 20 minutes. There is no password to leak, and the link is never shown on screen or to anyone who did not receive the email. You can add a second step, a code from an authenticator app, and it's required to connect Xero payroll and to view payroll in Komiti. The authenticator secret is stored encrypted, and recovery codes are stored only as one-way hashes. No system is perfectly secure, and we can't guarantee against every risk. If a data breach occurs that is likely to cause serious harm, we'll notify affected people and the OAIC as required under the Notifiable Data Breaches scheme.
Changes
If we change this policy we'll update the date at the top. If a change materially affects how we handle information you've already given us, we'll contact you about it.