Quimzy Marketplace Privacy Policy v3.0
Operator: quimzy, ABN 53 460 022 170
Support and privacy: contactus@quimzy.com
Effective date: 17 September 2026
1. What this policy covers
Quimzy helps customers find independent service providers, compare quotes and contact a selected provider. This policy covers public account registration, provider review, service requests, paid provider lead access, quoting, acceptance, messaging and support. It replaces the earlier invitation-only description for new public-release activity; older records retain the notices and choices recorded when they were created.
Quimzy has chosen to operate to Australian Privacy Principles standards and applicable Privacy Act requirements. This commitment is not a statement that a turnover threshold alone determines legal coverage. You can ask a general question without identifying yourself. An account email and the details needed for a particular function are required to use that function; without them we may be unable to verify access, match a request or resolve an account-specific issue.
2. Information we collect and create
- Account details: name, username, email, customer/provider role, protected password records, email-confirmation status, access status and the versions of terms and notices acknowledged.
- Provider details: business name, description, categories, declared working area and any optional profile details supplied, plus records of the checks actually carried out. We do not treat an approval label as proof of insurance, licensing or every business claim.
- Marketplace activity: request description, service area/postcode, timing and status; lead unlocks; quotes and their amounts; accepted-quote snapshots; contact-sharing choices; and messages.
- Wallet and payment records: account and order identifiers, amount and currency, purchased and complimentary funding sources, recorded credit spending and corrections, refund requests and their reasons, reserved-credit amounts and status, Stripe transaction references, payment/refund/dispute updates, and event and integrity data used to reconcile the ledger.
- Support, privacy, complaint and account-closure correspondence, together with relevant administrative decisions and audit records.
- Security and technical information such as IP address, browser/device and session information, sign-in events and hosting/mail logs where collected by the operating systems.
- Cookies and browser storage described in the Cookie Policy.
Do not put passwords, payment-card details, identity documents, government identifiers, health information or unnecessary personal information in requests, quotes or messages. We do not ask for sensitive documents through those fields. If a separate check genuinely needs additional information, we will explain why and provide a suitable collection method.
3. How and why information is handled
We receive information when you register, confirm your email, complete a profile, request a service, unlock a lead, quote, accept, message, fund your wallet or contact us. Our systems create status, security and audit records. Payment updates come from Stripe; relevant support or incident information may also come from another participant or service provider.
We use this information to provide and secure accounts, review provider access, match requests within the selected category and area, charge for lead access, reconcile credit and payments, display quotes, carry out the contact-sharing choice below, support messages, investigate problems and fraud, maintain backups, and meet applicable record-keeping duties. We limit access to people and services that need it for those purposes. Acknowledging this policy does not authorise unrelated marketing, tracking or selling your information.
4. What another participant can see
Eligible providers can see the request information displayed for matching. The customer’s account email is not revealed just because a provider views or unlocks a request. Do not include your email, phone number, exact address or other unnecessary identifying information in a description.
Before submitting a quote, the provider actively confirms the request-specific contact-sharing notice. Before accepting that exact quote, the customer sees the provider’s business name and a notice explaining the exchange. After the customer confirms and accepts, Quimzy releases the customer’s account email to that provider and the provider’s account email to that customer. That acceptance step does not release phone numbers or a provider website, book the job or pay for the underlying service.
Other providers do not receive that acceptance’s account-email exchange. The selected participants can message about the request. A recipient must not use the other’s information for unsolicited marketing or another unrelated purpose. Once disclosed, we cannot retrieve a copy a participant has independently kept.
5. Stripe and wallet payments
Provider wallet funding uses a redirect to Stripe-hosted Checkout, not a card-entry form embedded on Quimzy. Card details are entered with Stripe. Quimzy does not collect or store full card numbers or card security codes in its application. We send order/account identifiers, the amount/currency and relevant transaction-policy metadata to Stripe, and receive transaction status and references needed to credit or reconcile the wallet. Stripe may collect payment, contact, billing and fraud-prevention information on its own page; its Privacy Policy explains that handling.
Quimzy’s stored payment-event records can contain payer contact or billing information included in Stripe’s transaction updates. Access is restricted and these records are considered in privacy requests and retention reviews. Wallet payments buy Quimzy lead-access credit, not the provider’s job. Quimzy does not operate job escrow, split a job payment or make a connected-account payout to a service provider.
6. Service providers and overseas handling
Quimzy uses HostGator for hosting and the associated operating arrangements for email and backups, and Stripe for wallet payments. Authorised operators, relevant support providers and advisers may receive information reasonably needed to provide, secure or support these functions. We may disclose information when required or permitted by law, including an appropriately assessed safety or legal request. We do not sell personal information or use it for third-party advertising.
HostGator’s published terms state that its service and hosted data are in the United States unless otherwise provided. U.S. handling is therefore likely for Quimzy’s hosting arrangement, but the exact account data centre and the locations of email, support, backup and disaster-recovery copies, and onward recipients have not been verified. We do not claim Australian-only storage.
Stripe describes U.S. and global transfers and identifies infrastructure in the United States and India for some authentication and security information. This is not confirmation that every Quimzy payment record goes to both countries, or an exhaustive country list. Locations depend on the service, information and recipient. Contact us for the current information we can provide about a particular arrangement.
7. Cookies and preferences
Quimzy uses necessary sign-in, security, settings and consent-choice storage. The measured first-party inventory is retained in the Cookie Policy; it distinguishes cookies from WordPress session storage. Quimzy has not introduced advertising or analytics into this release. Stripe-hosted Checkout has its own storage and privacy notices when you leave Quimzy to pay. A Quimzy consent choice does not manage Stripe-domain storage.
8. Security
We use proportionate access controls, email verification, protected passwords, HTTPS, role and account boundaries, controlled contact release, audit records and backups. No online system is risk-free. Keep your credentials and confirmation links private and report suspected misuse promptly.
We assess and contain suspected incidents, preserve relevant evidence and make required notifications to affected people or authorities. We do not promise that a processor’s security features eliminate every risk.
9. Keeping and deleting information
We keep information while it is needed for the service or a documented support, security, complaint, accounting or legal purpose. Record categories have separate reviews; payment records do not give us a reason to retain every request or message indefinitely. Account closure does not automatically remove a valid payment, consent or dispute record.
Refund requests and credit reservations remain recorded while their outcomes need reconciliation. Account closure or an erasure request does not cancel a refund or release reserved credit. A supported privacy export can include your refund reference, owned order, amount, status, dates and an appropriate reason; it does not expose internal request payloads or another participant’s information. After reconciliation, retained records are reviewed for the minimum evidence needed for a documented purpose, rather than kept automatically forever.
When information is no longer needed for a permitted purpose and no applicable law or order requires retention, we take reasonable steps to destroy or de-identify it. This includes archives and backups we control. Reviews document any continuing purpose or hold and the next review date. A review date is not a promise of automatic deletion from every copy.
Backup and export copies are access-restricted. Where selective removal is not feasible, we record the constraint and control use until appropriate disposal. Before an old backup returns to ordinary use, later restrictions, corrections and deletion decisions must be reapplied; payment, consent and ledger events must also be reconciled. We cannot erase another participant’s independent copy or promise deletion of Stripe’s records that Stripe must retain.
Quimzy’s owner maintains a private category-specific review register recording each purpose, custodian, review trigger, next review, decision and any justified hold. Ordinary account, profile, request, quote, message and support records are reviewed within 30 calendar days of account closure, request completion or abandonment, or case resolution. Signup-policy proof, contact-sharing evidence, paid orders, refunds, credit reservations, disputes and reconciliation or replay records receive separate reviews on the relevant event or case-resolution trigger. Necessary minimum evidence stays access-restricted while settlement, reconciliation, a documented accounting or legal obligation, or a justified hold remains unresolved; unrelated information stays on its own review schedule. Operator-controlled backup and export copies are reviewed at least monthly. These are reviews, not uniform deletion deadlines.
Quimzy’s operator is a sole trader. We generally keep the minimum tax/accounting payment, order, refund and ledger/reconciliation facts for five years after the records are prepared or obtained, or the relevant transaction is completed, whichever is later. Longer retention may apply where an actual legal obligation or a documented tax review, dispute or justified hold requires it. This is not a five-year rule for raw payment-event payloads, profiles, messages or contact data, which receive separate necessity reviews. It is not a promise of automatic deletion from every copy when a period ends.
10. Access, correction, closure and complaints
Email contactus@quimzy.com to request access or correction, a supported export, account closure, or deletion/de-identification of information no longer needed. We may need proportionate evidence that you control the account and must protect other people’s information. We explain a refusal or limitation and the available complaint route where required.
Send privacy complaints to the same address. Quimzy will assess the concern and respond within a reasonable period. If it remains unresolved after giving us a reasonable opportunity to respond, you can contact the Office of the Australian Information Commissioner about available complaint options. There is no universal right under Australian law to delete or transfer every record.
11. Changes
We publish the effective version and provide appropriate notice before materially changing information handling. Where fresh agreement or a specific consent is required, we will request it rather than treating silence as consent. Editing this policy does not retrospectively change a previously recorded contact-sharing choice.