Privacy Policy

Colabi, operated by Zenyx Pty Ltd (ABN 98 659 778 524)

Last updated: 11 October 2026

This policy explains what personal information Colabi collects, why, who we share it with, where it is stored, how long we keep it, and the rights you have. It applies to our website (colabi.co), the Colabi web app (app.colabi.co), our mobile apps and related services (together, the "Services").

Questions or requests: support@colabi.co. We are based in Australia and the Services are hosted in Sydney, Australia.

1. Our role: controller and processor

Colabi is used by businesses (our "customers") to run their work with their team, freelancers, AI agents and their own customers.

• Where we decide how information is used, we are responsible for it (a "controller" under the GDPR and UK GDPR). This covers account holders and users, website visitors, people who contact us, and billing records.
• Where we hold information for a customer, we act on that customer's instructions (a "processor"). This covers what a business puts into Colabi about other people: its own customers and leads, people who call or message the business's AI agents, people who fill in its forms or booking pages, and its staff and freelancers. If you are one of those people, the business you dealt with is responsible for your information and you should contact it first. We will help it respond to you.

2. What we collect

Information you give us

• Account details: name, email address, phone number, address, password, profile photo, and optional details such as gender, hourly rate, skills, education and work history.
• Business content: everything you create or upload in Colabi, including routines, jobs, tasks, projects, customer records, notes, forms, documents, quotes, invoices, emails, messages, files and AI chat conversations.
• Payment and payout details: card payments go directly to Stripe and we never see full card numbers. We keep a record of payments, and for people paid through Colabi, the payout details needed to pay them.
• Things you send us: enquiries through our website form (name, email, company, message), support requests and feedback.

Information collected when you use the Services

• Device and usage data: IP address, browser and device type, operating system, language, pages viewed, and how and when you use the Services. We use your IP address to estimate your country so we can show prices in your currency.
• Location (only if you turn it on): if you switch on location sharing in the mobile app, we record your current location while you are on shift and show it to your team. We keep only your latest position, not a history, and clear it when you go off shift or switch sharing off. If you start an "On my way" visit, your location is updated during the trip and the customer you are visiting receives a link to follow your arrival; this stops when the visit ends.
• Voice and audio: audio you record for dictation or transcription, and calls handled by Colabi voice agents (see below).
• Cookies and similar technologies: see section 9.

Information from other people and services

• From the business that uses Colabi: for example, your details as one of its customers, staff or freelancers.
• Calls, texts and chats with Colabi AI agents: when a business uses Colabi to answer or make phone calls, reply to texts or chat on its website, we process the phone numbers, audio, transcripts and messages. Callers are told they are speaking with an AI agent and whether the call is recorded. The AI may pick out details you give (such as your name, email and address) and add them to the business's customer records.
• Upwork: if a business connects its Upwork account, we receive information about freelancers from Upwork, such as name, profile headline, rate, rating and job proposals, so the business can shortlist and hire. Proposal and search content is deleted from Colabi within about 24 hours; we keep the Upwork ID, shortlist and the business's own notes about people it engages.
• Accounts you connect: if you connect Google (including Gmail and Google Calendar), Microsoft Outlook, Xero, Zapier, Cronofy, Meta, LinkedIn, Google Ads, Meta Ads or LinkedIn Ads, we receive sign-in tokens and only the data allowed by the permissions you grant.
• Public sources: when you ask Colabi to research a business or topic, it may look up public web pages, search results and public reviews.

Colabi is for people aged 18 and over. We do not knowingly collect information from children. Customers should not use Colabi to collect sensitive information (such as health information) unless they have a lawful basis and have told the people concerned.

3. How we use it

• To provide Colabi: running your routines, jobs and AI agents, sending messages and emails you ask for, making and answering calls, and showing information to the people in your business you choose.
• To create and secure your account, including sign-in, two-factor authentication and fraud prevention.
• To bill you, pay freelancers and keep financial records.
• To send service, security and account messages.
• To support you and respond to enquiries.
• To improve Colabi, using usage information and feedback. We do not use your business content to train AI models, and we do not let our AI providers do so.
• To market Colabi to you, where the law allows. You can opt out at any time using the unsubscribe link or by emailing us.
• To comply with the law and enforce our terms.

Legal bases (UK and EU)

Where the GDPR or UK GDPR applies, we rely on: contract (to provide the Services you signed up for); legitimate interests (to secure, support, improve and market Colabi, where these are not overridden by your rights); consent (for non-essential cookies and optional features such as location sharing, which you can withdraw at any time); and legal obligation (for example tax records).

4. AI in Colabi

Colabi uses AI models from third-party providers to write content, plan and run work, answer calls and messages, transcribe audio, and analyse your business information. To do this we send the relevant content (for example your request, the task, and related customer or business records) to the provider listed in section 5. You can also choose a different model, or connect your own API key, in which case your own agreement with that provider applies.

AI output can be wrong. Check important results before relying on them.

Google API data. Colabi's use and transfer of information received from Google APIs, including Gmail and Google Ads, follows the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve or train generalised or foundational AI or machine-learning models, and we do not allow people to read it except with your permission, for security, to comply with the law, or where it has been aggregated and anonymised.

Advertising accounts. If you connect Google Ads, Meta Ads or LinkedIn Ads, Colabi reads your ad accounts, campaigns and performance figures to show and explain them to you. If you give it permission to make changes, Colabi can create, pause or adjust campaigns and budgets only when you ask it to or approve a suggested change, and within any monthly spending cap you set. You can remove access at any time from Colabi or from the ad platform.

5. Who we share information with

We share personal information with the service providers below, who process it for us under contracts that require them to protect it and use it only to provide their service. We do not sell personal information.

The current list is also published at colabi.co/subprocessors, and we update it before adding a new provider that handles customer data.

We also share information:

• With services you connect (such as Gmail, Outlook, Upwork, Xero, Zapier or social and ad platforms) when you ask Colabi to act there. Those services handle the information under their own privacy policies.
• Inside your business: with the people your account owner gives access to.
• With professional advisers such as lawyers, accountants and auditors.
• If the law requires it, or to protect the rights, safety or property of people or of Colabi.
• If our business is sold or restructured, with the new owner, who must protect it in line with this policy.

6. Overseas transfers

Our main database and files are stored in Sydney, Australia. Some of the providers in section 5 process information in other countries, mainly the United States. We choose providers that commit by contract to protect it. Where the GDPR or UK GDPR applies, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US Data Privacy Framework where the provider is certified. You can ask us for more detail.

7. Automated decisions

Some Colabi features use computer programs, including AI, to make or help make decisions about people. We tell you about them here because they can affect people's work.

• Assigning work. When a business lets Colabi allocate tasks, the program scores who could do a task (team members, freelancers, AI agents or robots) and assigns it to the best match. It uses skills, availability, workload, cost, location (if shared), ratings and a reliability score. A business can set this up so that tasks are assigned without a person checking first.
• Reliability score. Colabi calculates a reliability score for people who do tasks, based on how often their tasks were reassigned and whether goals were met. It is used in the task assignment above and in reports to the business about work that is falling behind.
• Shortlisting freelancers. When a business hires through Upwork, Colabi ranks applicants and explains why, using their profile, rate, rating and proposal. A person at the business always decides whether to make an offer or hire.
• AI calls and messages. AI agents may answer calls, texts and chats for a business, and may create or update customer records from what was said.

If a decision like this affects you, you can ask the business that uses Colabi (or us, at support@colabi.co) to explain the main reasons for it, to have a person review it, and to give your point of view. In the app, businesses can see why a person was chosen for a task.

8. How long we keep information

• Account and business content: while your account is open, unless you delete it sooner. Jobs, projects, pipelines and customer records you delete stay in "Recently deleted" for 30 days and are then removed.
• Closed accounts: if you close your account in the app it is deactivated and can be restored if you come back. To have your account and content permanently deleted, ask us (see section 10).
• Upwork proposals and search results: about 24 hours.
• Location: only your latest position, cleared when you go off shift, switch sharing off, or an "On my way" visit ends.
• Call recordings, transcripts and messages: until the business deletes them or its account is deleted.
• Connected account tokens: until you disconnect the service or delete your account.
• Billing and tax records: as long as the law requires, generally up to 7 years.
• Server logs: kept for security and troubleshooting, then deleted.
• Backups: deleted information may stay in backups until they are overwritten or deleted.

9. Cookies and tracking

• Essential cookies keep you signed in, protect your account and remember settings. The Services do not work without them. Our sign-in page uses Google reCAPTCHA to block automated attacks, which collects device and browser information under Google's privacy policy.
• Analytics and advertising: we use Google Analytics to understand how our sites are used, and the Meta Pixel to measure our own advertising. These may collect your IP address, device details and pages viewed. You can block them with your browser settings or opt out using Google's opt-out, and your Meta ad settings.
• Our customers' pages: funnel, form and booking pages that businesses publish with Colabi may use their own analytics or advertising tags. That business is responsible for them.

10. Your rights and how to use them

You can ask us to give you a copy of your personal information, correct it, or delete it. Email support@colabi.co from the address on your account, or follow the steps on our Account Deletion page. We will confirm your identity before acting, acknowledge your request promptly, and respond within 30 days. Some information may need to be kept by law, and we will tell you if so. There is no charge unless a request is clearly excessive.

Depending on where you live, you may also have these rights:

• UK and EU: to restrict or object to processing (including direct marketing), to data portability, to withdraw consent at any time, and not to be subject to a decision based solely on automated processing that significantly affects you without the safeguards in section 7. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
• Australia: you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
• New Zealand: you can complain to the Office of the Privacy Commissioner (privacy.org.nz).
• Canada: you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial commissioner.
• United States: residents of some states have rights to know, access, correct and delete personal information, and to opt out of targeted advertising. We do not sell personal information. To opt out of advertising measurement, use the options in section 9 or contact us.

If your information is held for a business that uses Colabi (see section 1), please contact that business; we will pass on any request we receive to it.

11. Complaints

If you are unhappy with how we have handled your information, email support@colabi.co with "Privacy complaint" in the subject. We will acknowledge your complaint within 30 days, investigate, and tell you the outcome. If you are not satisfied, you can contact the regulator listed in section 10.

12. Security

We protect information with measures including encryption in transit (TLS 1.2 or higher), encryption of stored data, optional two-factor sign-in, access controls, signature checks on incoming webhooks, and hosting in AWS data centres in Sydney. No system is completely secure. If a data breach is likely to cause serious harm, we will notify affected people and regulators as the law requires, including the Office of the Australian Information Commissioner and, where the GDPR or UK GDPR applies, the relevant authority within 72 hours. Where we hold information for a business, we will tell that business without undue delay.

13. Changes to this policy

We will update this policy when how we handle information changes, and change the date at the top. For significant changes, we will tell account holders by email or in the app before the change takes effect.

14. Contact us

Zenyx Pty Ltd, trading as Colabi
Email: support@colabi.co