The short version:
- Your 3CX passwords, API secrets and holiday data never leave your PC.
- Our licence service stores only what it needs to check your licence and count your systems. Most of it is hashed or encrypted so we can't read it.
- Lemon Squeezy handles payments and tax. We never see your card details.
- We keep licence data until 12 months after your licence ends, then delete it.
- This website doesn't use cookies, analytics or tracking.
1. Who we are
This privacy policy explains how Matthew Ising, a sole trader trading as Zexus (ABN 21 199 784 783), of Melbourne, Victoria, Australia (Zexus, we, us) handles personal information in connection with Clocked Off and the zexus.tech website.
We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
2. What we collect
When you use Clocked Off
Clocked Off contacts our licence service to check your licence key and count your systems. The licence service stores:
| Information | Why we need it |
|---|---|
| A hash of your licence key (not the key itself) | To recognise your licence |
| Hashed identifiers for each 3CX phone system | To count unique systems across all your PCs, so the same system on two PCs counts once |
| System labels, encrypted so the licence service can't read them | So Clocked Off can show you the systems on your licence, for example on the Licence screen |
| An install ID, which identifies each installation of Clocked Off | To tell installations apart |
| The PC name | To show which PC last used each system, so you can manage your licence |
| The Clocked Off version | For compatibility and support |
| Your email address, from Lemon Squeezy | To link your licence to your purchase and contact you about your licence |
What Clocked Off never sends us
Your 3CX passwords and API secrets are stored in Windows Credential Manager on your PC. Your holiday data, closures and backups are stored on your PC. None of these leave your PC or are sent to us.
When you buy
Lemon Squeezy, our merchant of record, collects your payment and billing details to process your purchase and handle tax. We don't receive or store your card details. Lemon Squeezy shares your order details with us, including your name, email address, country and plan, which we can see in our Lemon Squeezy account.
When you email us
If you email us, including to register interest or ask for support, we receive your email address, name and anything you include in your message. Please don't send 3CX passwords or API secrets.
When you visit this website
This website doesn't set cookies, and it doesn't use analytics, advertising or tracking scripts. The site is hosted on Cloudflare, which processes standard technical information about each request, such as your IP address and browser type, to deliver the site and protect it from attacks.
3. How we use it
We use personal information to:
- issue, check and manage your licence, including counting systems and releases;
- provide support and answer your questions;
- tell you about your licence, trial, renewal, price changes and important updates;
- tell you when Clocked Off launches, if you've registered interest;
- prevent misuse of licence keys; and
- meet our legal, tax and accounting obligations.
We don't sell personal information, and we don't use it for advertising.
4. Who we share it with
We share personal information only with service providers who help us run Clocked Off, and only as much as they need:
- Cloudflare, Inc. hosts the licence service and this website.
- Lemon Squeezy is our merchant of record and handles payments, tax and the billing portal.
- Our email provider stores emails you send us.
We may also disclose personal information if the law requires us to, or to protect our rights.
5. Overseas storage
Our service providers may store and process personal information outside Australia, including in the United States and other countries where Cloudflare operates its network. We choose providers with strong security and privacy practices.
6. How we protect it
- Licence keys and phone system identifiers are stored as hashes, not in readable form.
- System labels are encrypted so the licence service can't read them.
- Information sent between Clocked Off and the licence service is encrypted in transit.
- 3CX passwords and API secrets stay in Windows Credential Manager on your PC.
- Access to our accounts with service providers is limited and protected.
To report a security issue in Clocked Off, the licence service or this website, email security@zexus.tech.
No system is perfectly secure. If we become aware of a data breach that's likely to cause serious harm, we'll tell the people affected and, where required, the Office of the Australian Information Commissioner.
7. How long we keep it
- Licence service data: kept until 12 months after your licence ends, then deleted.
- Emails: kept for as long as we need them to help you. Register-interest emails are kept until we've told you about the launch, unless you ask us to delete them sooner.
- Purchase records: kept for as long as tax and accounting laws require.
8. Accessing, correcting and deleting your information
You can ask us for a copy of the personal information we hold about you, or ask us to correct or delete it, by emailing privacy@zexus.tech. We'll respond within 30 days. If we can't do what you ask, for example because we need to keep purchase records for tax, we'll explain why.
Deleting licence data while your licence is active will stop Clocked Off from checking your licence.
9. If you're in the EU or UK
We process personal information to perform our contract with you (your licence and support), for our legitimate interests (preventing licence misuse and improving Clocked Off), and to meet legal obligations. You have rights to access, correct, delete, restrict or object to processing, and to receive your information in a portable form. You can also complain to your local data protection authority.
10. Complaints
If you have a concern about how we've handled your personal information, email privacy@zexus.tech and we'll respond within 30 days. If you're not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
11. Changes to this policy
We may update this policy. We'll post the new version on this page with a new date, and email customers about significant changes.
12. Contact
Matthew Ising, a sole trader trading as Zexus (ABN 21 199 784 783), of Melbourne, Victoria, Australia
Email: privacy@zexus.tech