Last updated: 3 October 2026 · Version: 1.2
This Privacy Policy explains how Zpark Pty Ltd (ABN 86 688 518 069), trading as WriteAuto (“WriteAuto”, “we”, “us”, “our”), collects, uses, discloses, stores and protects personal information when you visit writeauto.com or use the WriteAuto application and related services (the “Service”).
We are based in Adelaide, South Australia. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Because we serve users worldwide, we also aim to meet the requirements of the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA) and other applicable privacy laws.
Disclaimer: This policy describes our practices at the date above. Where a law gives you stronger rights than this policy describes, that law applies. This policy does not create contractual rights beyond those required by law.
1. Who is responsible for your information
Zpark Pty Ltd is the entity responsible for your personal information and is the “controller” for GDPR purposes, except where section 12 says we act as a processor for our business customers.
Contact: Privacy Officer, Zpark Pty Ltd, Adelaide, South Australia, Australia · [email protected] (subject line “Privacy”).
2. Information we collect
2.1 Information you give us
| Category | Examples | Required? |
|---|---|---|
| Account information | Name, email address, password (stored only in securely hashed form), team member invitations | Yes |
| Business and brand information | Brand name, industry, target audience, website, competitor URLs, logo, brand colours, tone and content preferences | Yes, to generate content |
| Connected platform credentials | WordPress site URL, username and application password | Only if you connect a site |
| Billing information | Plan, subscription status and payment reference IDs from Stripe (we never receive your full card number) | Yes, for paid plans |
| Communications | Emails, support requests, feedback and survey answers | Optional |
2.2 Information from sign-in providers
If you sign up or log in with Google or Facebook, we receive the basic profile information you authorise that provider to share, usually your name, email address, profile picture and a unique account identifier. We do not receive your Google or Facebook password.
2.3 Information collected automatically
- Technical and log data: IP address, browser type, device type, operating system, pages and features accessed, timestamps, referring URLs and error information.
- Security data: signals used to detect bots, abuse and attacks, collected by us and our network security provider.
- Cookies: see our Cookie Policy.
2.4 Information we generate
- Generated content: articles, posts, outlines, research summaries and other Output created for your Account.
- Research results: AI-generated analysis of your brand, competitors and market, based on publicly available information.
2.5 Publicly available information about third parties
To perform brand and competitor research, the Service may collect publicly available information about businesses you name, such as content from public websites, public Facebook Pages and search results. This is generally business information, but it may incidentally include names or details of individuals that are publicly posted.
2.6 Sensitive information
We do not ask for sensitive information (such as health, racial or ethnic origin, religious beliefs, sexual orientation, criminal record or biometric data). Please do not include it in the Service.
2.7 Information exchanged through our WordPress plugin
If you install the Write Auto plugin on a WordPress site and connect it to your Account, the plugin exchanges the following information with us:
- Connection key: created on your site and entered by you into WriteAuto. It is stored on your site and, in encrypted form, in our database.
- Site details: the site’s address, language, timezone, WordPress, PHP and plugin versions, the active SEO plugin, and the permalink setting.
- Chosen author: the WordPress user ID and display name of the author you select, and whether that user can publish posts.
- Categories and existing posts: your category list and the titles and links of your published posts. These are used at the time of publishing to select a category and suggest internal links, and are not stored by us.
- Post results: the ID, link and status of each post the plugin creates, and which SEO fields were set.
- Update checks: your site periodically asks our servers whether a newer plugin version is available. WordPress includes your site’s address with these requests, and they are recorded in our standard server logs.
The plugin does not collect information about your site’s visitors, your customers or other WordPress users, and no passwords are exchanged. The plugin keeps an activity log on your own site (for up to 90 days or 1,000 entries). We do not receive that log, and it is removed when you uninstall the plugin. Posts published through the plugin, and their SEO settings, remain on your site under your control.
Disclaimer: If you give us personal information about another person (for example, a team member you invite), you confirm you are allowed to do so and that they are aware of this policy. We are not responsible for information you submit without the necessary authority.
3. How we use your information
| Purpose | Information used | Legal basis (GDPR) |
|---|---|---|
| Create and manage your Account, authenticate you and keep sessions secure | Account, sign-in, technical data | Contract |
| Generate content, research brands and competitors, and publish to your connected sites | Business and brand information, credentials, generated content | Contract |
| Process payments, manage subscriptions, prevent payment fraud | Billing references, account data | Contract; legal obligation |
| Send transactional emails (invitations, approval links, payment and security notices) | Name, email address | Contract |
| Provide support and respond to requests | Communications, account data | Contract; legitimate interests |
| Keep the Service secure, detect abuse, fix errors and monitor performance | Technical, log and error data | Legitimate interests |
| Improve the Service using aggregated or de-identified usage information | Usage data | Legitimate interests |
| Send marketing emails about WriteAuto | Name, email address | Consent (or as permitted by the Spam Act 2003) |
| Comply with law, enforce our Terms and handle disputes | Any relevant information | Legal obligation; legitimate interests |
We do not use your personal information to make decisions based solely on automated processing that produce legal or similarly significant effects on you.
Disclaimer: Where we rely on legitimate interests, we have balanced those interests against your rights. You can object at any time (see section 9).
4. Artificial intelligence and your data
4.1 To generate content and research, we send relevant parts of your business and brand information (for example, brand name, industry, audience, location and competitor details) to third-party AI model providers listed in section 5. Their systems process this information and return results to us.
4.2 We do not use your Customer Content or generated content to train our own AI models. Where available, we choose AI service arrangements that, under the provider’s published terms, do not use API inputs or outputs to train their models. However, these providers process data under their own terms and we cannot control their internal practices.
4.3 Please do not include personal information about individuals, confidential information or sensitive information in prompts, brand descriptions or other fields unless it is necessary.
Disclaimer: AI providers may retain inputs and outputs for limited periods for abuse monitoring or legal reasons under their own policies. We are not responsible for a provider’s handling of data beyond what our agreements with them require.
5. Who we share information with
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only with the service providers below, who process it on our behalf to run the Service, and in the other limited cases in section 5.2.
5.1 Service providers
| Provider | Purpose | Information involved |
|---|---|---|
| Stripe | Payment processing, checkout, invoices and billing portal | Name, email, billing details, payment card data (collected directly by Stripe) |
| Contabo | Application hosting | All Service data processed by the application |
| Neon (on Amazon Web Services) | Database hosting | Account, brand, credentials (encrypted), billing references, generated content |
| Amazon Web Services, Google Cloud | Cloud infrastructure | Service data hosted on their infrastructure |
| Hostinger | Domain registration and related hosting | Technical data |
| Cloudflare | DNS, content delivery, encryption in transit and security (bot and attack protection) | IP address, technical and request data |
| Resend | Transactional email delivery | Recipient names and email addresses, email content |
| Atlas Cloud (serving DeepSeek models) | AI content generation | Brand and business information in prompts, generated content |
| Google (Gemini API, including search grounding) | AI competitor and market research | Business name, industry, location, research prompts and results |
| OpenAI | AI content generation | Brand and business information in prompts, generated content |
| Meta (Facebook) | Facebook sign-in; analysis of public Facebook Pages during brand research | Sign-in profile data; public Page data |
| Google (sign-in) | Google sign-in | Sign-in profile data |
| Sentry | Error and performance monitoring (may be enabled from time to time) | Technical data and error details, with cookies and request bodies removed before sending |
This list may change as we add or replace providers. We will update this policy when it does.
5.2 Other disclosures
- Connected platforms: when you connect a site such as WordPress, we send your Output to it at your direction.
- Your team: information may be visible to other users you invite to your workspace.
- Legal and safety: where required or authorised by law, or to protect the rights, safety or property of WriteAuto, our users or others.
- Professional advisers: lawyers, accountants and auditors, under confidentiality obligations.
- Business transfers: a buyer or successor in a merger, acquisition, restructure or sale of assets, subject to this policy.
Disclaimer: Third-party providers are independent businesses with their own privacy policies. Sign-in providers (Google and Facebook) and Stripe also act as independent controllers of the information you give them directly.
6. Overseas storage and transfers
6.1 Our main database is hosted in the European Union (Frankfurt, Germany) and our application servers are hosted primarily in the European Union. Our service providers may also process information in the United States, the United Kingdom, other EU countries and other countries where they or their sub-processors operate. AI providers may process prompts in the countries where their models are hosted.
6.2 Australian users (APP 8): by using the Service, your personal information will be disclosed to recipients overseas, including in the countries listed above. We take reasonable steps, including contractual terms with providers, to ensure they handle it consistently with the APPs.
6.3 EU, EEA and UK users: where personal data is transferred to a country without an adequacy decision (including Australia), we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider’s certification under the EU-US Data Privacy Framework.
Disclaimer: Overseas recipients may be subject to foreign laws, including laws that allow government access to data, which may give different protections from those in your country.
7. How we protect your information
We use reasonable technical and organisational measures to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure, including:
- encryption of data in transit using TLS, end to end between your browser and our servers;
- passwords stored only as salted one-way hashes, never in plain text;
- secure, HTTP-only session cookies that browser scripts cannot read, with server-side session revocation on logout;
- encryption at rest (AES-256) of third-party credentials you provide, such as WordPress application passwords and WordPress plugin connection keys;
- no storage of payment card numbers on our systems;
- access to production systems limited to authorised personnel;
- network-level protection against bots and attacks; and
- removal of cookies and request bodies from error reports before they are sent to our monitoring provider.
Data breaches. If a data breach is likely to cause serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and other regulators where required (including within 72 hours under the GDPR where applicable).
Disclaimer: No method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, and you use the Service at your own risk to that extent.
8. How long we keep information
We keep personal information only for as long as needed for the purposes in this policy and to meet legal obligations. Our full retention schedule, and how to delete your data, is in our Data Deletion and Retention Policy.
9. Your rights
9.1 Everyone
You can ask to access or correct the personal information we hold about you, and to delete your Account and data. You can unsubscribe from marketing emails at any time using the link in each email.
9.2 Australia
Under the APPs you may request access to and correction of your personal information. We will respond within 30 days. If we refuse, we will explain why and how to complain. You may deal with us anonymously or by pseudonym where practicable, but we need your name and email to provide an Account.
9.3 EU, EEA and UK
You also have the rights to data portability, restriction of processing, to object to processing based on legitimate interests or for direct marketing, and to withdraw consent at any time. You may lodge a complaint with your local data protection authority.
9.4 California and other US states
You have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of sale or sharing (we do not sell or share it); to limit use of sensitive personal information (we do not collect it); and not to be discriminated against for exercising these rights. You may use an authorised agent. Residents of other US states with comprehensive privacy laws have similar rights.
9.5 How to make a request
Email [email protected] with the subject “Privacy Request”. We may need to verify your identity before acting. We respond within 30 days (or 45 days for CCPA requests), and may extend this where the law allows, telling you why. Requests are free unless manifestly unfounded or excessive.
Disclaimer: Some rights are subject to legal exceptions. For example, we may keep information we are required to retain for tax or legal reasons, or where it is needed to establish or defend legal claims.
10. Children
The Service is intended for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact us and we will delete it.
11. Marketing
We send marketing emails only with your consent or where permitted by the Spam Act 2003 (Cth) and equivalent laws. Every marketing email identifies us and includes a working unsubscribe option. Transactional and service emails (such as security, billing and legal notices) are not marketing and will continue while you have an Account.
12. Business customers and data you control
Where you upload personal information about other people (for example, your team or individuals named in your content), you are responsible for having a lawful basis to do so. For that information we act as your service provider (a “processor” under the GDPR). Our Terms and a data processing agreement, available on request, govern that processing.
13. Third-party websites
The Service and generated content may link to third-party websites. We are not responsible for their privacy practices. Please read their privacy policies.
14. Changes to this policy
We may update this policy from time to time. We will post the new version with an updated date, and for material changes we will notify you by email or in the Service before they take effect.
15. Complaints
If you have a privacy complaint, contact us first at [email protected]. We will acknowledge it within 7 days and aim to resolve it within 30 days. If you are not satisfied, you may complain to:
- Australia: Office of the Australian Information Commissioner (OAIC), oaic.gov.au
- EU/EEA: your local data protection authority
- UK: Information Commissioner’s Office (ICO), ico.org.uk
16. Contact
Zpark Pty Ltd (trading as WriteAuto) ABN 86 688 518 069 Adelaide, South Australia, Australia Email: [email protected]