Privacy Policy

This Privacy Policy explains how ZeroLapse Limited (ZeroLapse, we, us) collects, uses, stores and discloses personal information through the ZeroLapse website, application, support, billing and related business activities.

For information ZeroLapse collects for its own business purposes, ZeroLapse is an agency under the Privacy Act 2020. For workforce and compliance information a customer organisation enters and controls, the customer will usually be the organisation deciding why that information is collected and used, while ZeroLapse provides the software and processing service. Depending on the request, an individual may need to contact their employer or other customer organisation first.

• Account and identity information such as name, email address, authentication identifiers, role, organisation membership and preferences.
• Workforce and compliance records such as staff number, role, location, assignments, licences, certifications, expiry dates, renewal information and manager review outcomes.
• Asset and premises records linked to individuals, including vehicle, equipment and location assignments.
• Evidence and content such as documents, images, notes, change proposals, exports and support attachments.
• Billing information such as plan, subscription status, invoice and transaction identifiers and limited payment metadata. Full card details are handled by Stripe rather than stored by ZeroLapse.
• Technical and security information such as IP address, browser/device information, timestamps, session and security events, diagnostics, error reports and audit records.
• Communications such as support requests, feedback, product enquiries and communication preferences.

Information may be collected directly from users, from customer administrators and managers, from invited staff, automatically when the service is used, and from providers that support authentication, payments, email, hosting and monitoring. Customer organisations may also provide information about staff or other individuals.

From 1 May 2026, Information Privacy Principle 3A applies to many situations where an agency collects personal information about an individual from someone other than that individual. Where IPP 3A applies, the collecting agency must take reasonable steps to ensure the individual is aware that the information has been collected, why it was collected, the intended recipients, the name and address of the collecting and holding agencies, any particular law authorising or requiring the collection, and the individual’s access and correction rights, unless an exception applies. Those steps must be taken as soon as reasonably practicable after collection unless taken sooner.

Customers that enter staff or contractor information into ZeroLapse are responsible for assessing and meeting their own IPP 3A obligations. ZeroLapse will provide reasonable information about the service and its processing to help customers do that. ZeroLapse also assesses its own indirect-collection obligations where it is the relevant collecting agency.

• Provide, authenticate, administer, secure and support the service.
• Calculate and display expiry and evidence status using deterministic service rules.
• Send invitations, authentication messages, reminders, trial and billing notices, security alerts and other necessary service communications.
• Process subscriptions and maintain business, accounting, fraud-prevention and transaction records.
• Respond to support requests and, where legitimately necessary, access customer information for support, maintenance, security or legal reasons.
• Detect misuse, investigate incidents, enforce agreements and comply with law.
• Create aggregated or de-identified service analytics that do not identify a customer or individual.
• Send marketing or product updates where permitted and provide an appropriate opt-out from marketing communications.

ZeroLapse uses specialist providers to operate the service. Current key providers include Supabase for database, authentication and private storage; Vercel for application hosting; Stripe for payments; Resend for transactional email; Sentry for error monitoring; Cloudflare for DNS/security services; and Microsoft 365 for business communications and administration.

ZeroLapse may also disclose information where reasonably necessary to professional advisers, insurers, auditors, regulators, courts, law enforcement, or a purchaser or successor in a genuine business transaction, and where otherwise permitted or required by law. ZeroLapse does not sell personal information or Customer Data.

ZeroLapse’s primary application and database infrastructure is configured in Sydney, Australia. Some providers may also use global support, security or processing locations.

Under the Privacy Act 2020, sending personal information to an overseas provider that acts only as an agent for storage or processing is treated differently from disclosing that information to an overseas recipient for its own purposes. Where ZeroLapse makes a disclosure outside New Zealand to which Information Privacy Principle 12 applies, ZeroLapse will use an available lawful basis and take reasonable steps to ensure appropriate privacy safeguards. These may include the recipient being subject to the New Zealand Privacy Act, comparable privacy law, or contractual safeguards that provide comparable protection.

ZeroLapse uses cookies and similar browser storage that are necessary for authentication, session continuity, security, preferences and core service operation. We do not claim to use advertising cookies unless and until they are actually deployed and disclosed. See the Cookie Policy for more information.

ZeroLapse uses layered safeguards including authenticated access, role-based permissions, database row-level security, session-derived organisation identity, private evidence storage, organisation-scoped storage controls, audit events and service monitoring. Authorised ZeroLapse access to customer information is limited to legitimate support, maintenance, security, legal or operational purposes. No system is risk-free.

ZeroLapse retains personal information for as long as reasonably necessary to provide and secure the service, follow customer instructions, resolve disputes and meet legal, accounting and security obligations. Customers should export records they need before service access ends.

ZeroLapse’s current operating intention is to provide up to 30 days after cancellation or termination for an available export request where the account is not restricted for security or legal reasons. After that period, information may be deleted from active systems. Copies may remain for a limited period in technical backups or retained records where necessary for legal, accounting, fraud-prevention, security or dispute purposes. ZeroLapse does not promise a specific backup retention period unless separately agreed in writing.

Individuals may have rights under the Privacy Act 2020 to request access to and correction of personal information. Requests can be sent to hello@zerolapse.co.nz with “Privacy request” in the subject line. ZeroLapse may need to verify identity and may refer or transfer a request to the relevant customer organisation where that organisation controls the record. If a requested correction is not made, the individual may be entitled to ask for a statement of correction to be attached to the information.

ZeroLapse assesses suspected privacy breaches and takes reasonable steps to contain, investigate and remediate them. Where the Privacy Act 2020 requires notification because a breach has caused or is likely to cause serious harm, ZeroLapse will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, subject to any applicable exception.

ZeroLapse is a business service and is not intended for children acting independently. Customers should avoid uploading sensitive information that is not necessary for their compliance-record purpose. Evidence documents can sometimes reveal health, immigration, criminal, identity or employment information, so customers should minimise what they upload and ensure they have lawful authority to do so.

We may update this Policy as the service, providers or law changes. Material changes will be notified where appropriate.

Privacy contact: hello@zerolapse.co.nz (subject: Privacy)
General contact: hello@zerolapse.co.nz
Website: https://zerolapse.co.nz