About this policy

EZtms is an online service for courier and freight-forwarding companies shipping between Australia and Korea. It is operated by ST Humans Pty Ltd (ABN 23 613 672 021), an Australian company (“we”, “us”). This policy explains how we collect, use, disclose and protect personal information, in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

EZtms handles two kinds of information.

• Information about EZtms users — the owner and staff accounts of the courier companies that subscribe to EZtms, and people who apply to sign up. We are responsible for this information.
• Information about courier companies’ customers — people who book with a courier company, and senders and recipients. The courier company is the APP entity responsible for this information; EZtms is the service provider that stores and processes it on the company’s behalf. If you are a customer, please first read the privacy policy of the company you used (the “개인정보 처리방침” link at the bottom of its pages).

What we collect

EZtms users

• Company details — company name and company ID; the legal name, ABN, address, email and phone printed on invoices; bank account details shown to customers
• Accounts — owner and staff names, email addresses and roles. Passwords are stored encrypted by Firebase Authentication and are not visible to us
• Subscription and billing — subscription status, add-ons, and the Stripe customer ID. Card details go directly to Stripe and never reach us
• Activity records — who performed each action (such as receiving a parcel or issuing an invoice) and when, and each person’s monthly AI feature usage count
• Sign-up and sign-in security — verification codes are stored only as hashes, and to prevent abuse we keep a hash (an unreadable transformed value) of the requesting IP address with the request times

Courier companies’ customers (processed on the company’s behalf)

• Booking account — the email address used to sign in, and the Google account name when signing in with Google
• Senders and recipients — names in English, addresses, phone numbers and email addresses (where given)
• For shipments to Korea, the recipient’s personal customs clearance code (개인통관고유부호)
• Shipment details — item descriptions, quantities, unit values and HS codes; box weights and dimensions (including staff measurements); drop-off and delivery methods
• Payments — invoices and payment and refund records (we do not receive card details)
• Proof of delivery — the recipient’s signature when collecting from a branch, or a delivery photo when staff or a driver hands over a parcel
• Staff notes and follow-ups, and the local delivery carrier and its tracking number

Collected automatically

• Access logs kept by the web server when pages are opened (IP address, browser details and the address requested) — Google Cloud operational logs
• Device and browser signals checked by bot protection (Google reCAPTCHA Enterprise and Firebase App Check) on booking, sign-up and sign-in screens

Why we use it

• To provide the service — quote, booking and tracking pages and the staff app
• To verify sign-ins, keep the service secure and prevent abuse
• To bill subscriptions, and to process freight invoices and payments for courier companies’ customers
• To send emails the service needs — verification codes, shipment status updates, invoices and payment requests, and staff follow-up reminders
• To answer enquiries and provide technical support
• To keep records and make reports required by law

We do not use personal information for advertising or marketing, we do not sell it, and we do not use it to train AI models. Courier companies’ customer information is used only to provide that company’s service.

AI features and automated decisions

Some features use Google Cloud Vertex AI (Gemini) to process text and photos. The models we use are not available in an Australian region, so we use Google’s global endpoint, and this information may be processed in Google data centres outside Australia. Customer features and the staff AI assistant work only when the courier company has turned them on.

• Item declaration helper · CustomersSent to the AI: Item descriptions, quantities and unit valuesPersonal information: None
• Filling items from photos · CustomersSent to the AI: 1–3 photos of the box contentsPersonal information: Whatever appears in the photo (usually none)
• Booking by chat · CustomersSent to the AI: The conversation and the draft bookingPersonal information: Yes — names, phone numbers, email, addresses and Korean customs codes
• Manifest check · StaffSent to the AI: Item descriptions, HS codes, unit values and destination countryPersonal information: None (names, addresses and phone numbers are not read)
• Reading courier labels · StaffSent to the AI: One photo of a courier labelPersonal information: Yes — the recipient's name, address and phone printed on the label (only the tracking number is returned)
• Rate card import · Company ownerSent to the AI: The company's rate cardPersonal information: None
• Customs broker template mapping · Company ownerSent to the AI: The customs broker's template filePersonal information: Usually none (yes if it contains sample rows)

AI output is only a suggestion. Only details confirmed by the customer or company staff are saved. We do not keep the text or photos sent to the AI, or the AI’s answers — we keep only usage counts and processing volumes (token numbers). Under the Google Cloud terms, Google does not use this information to train AI models; Google may hold it in memory for up to 24 hours to speed up responses, and may log it for abuse monitoring for the period set out in the Google Cloud terms. If you prefer not to use the AI features, you can enter the details yourself and still use every part of the service.

Automated decisions — No decision that could significantly affect a person’s rights or interests is made solely by a computer program in EZtms. Quoted prices and whether a home pickup is available are calculated by applying the courier company’s published rate table to the weight, dimensions and postcode; the actual charge is invoiced by company staff after the boxes are measured. This statement is made for the automated decision transparency requirements of the APPs (APP 1.7–1.9) that apply from 10 December 2026.

Who we share it with

We use the following service providers. They process information only for the work we give them, under their own terms and privacy policies.

• Google Cloud and Firebase (Google LLC) — the database (Firestore), file storage (Storage) and server functions (Functions) are in Sydney, Australia (australia-southeast1); the web server that builds the pages (App Hosting) is in Singapore (asia-southeast1). Sign-in (Firebase Authentication and Sign in with Google), bot protection (reCAPTCHA Enterprise and App Check) and AI (Vertex AI) are also provided by Google.
• Stripe — EZtms subscription payments and, for courier companies that accept online card payments, customers’ freight card payments. Card details are collected directly by Stripe.
• Resend (United States) — sends service emails such as verification codes, shipment updates and invoices. The recipient’s email address and name and the email content pass through Resend.

EZtms operators can see courier companies’ business information to run and support the service. “Support view”, which lets an operator look at a company’s screens, is recorded first and is read-only for 60 minutes. We do not disclose personal information to anyone else unless the law requires or permits it (for example, a court order or a lawful request from a law enforcement agency).

Overseas disclosure and processing

Information is stored in Sydney, Australia, but it may be processed outside Australia or sent overseas as follows.

• Singapore — the web server. All information passing through the pages (including bookings, addresses and phone numbers) goes through it
• Google data centres outside Australia — AI features (see “AI features and automated decisions”)
• United States and other countries — email delivery by Resend, payment processing by Stripe, and Google sign-in and bot protection
• Korea — disclosures the courier service itself requires (below)

Disclosure to Korea — for a parcel to clear customs and be delivered in Korea, the recipient’s name, address, phone number and personal customs clearance code, together with the item details, must be given to the Korea Customs Service, the customs broker or express carrier handling clearance, and the delivering carrier in Korea. The courier company makes this disclosure under its contract with its customer; EZtms produces the manifest and waybill files the company uses. Details are in that company’s privacy policy.

Cross-border transfer notice (Korean Personal Information Protection Act) — for people in Korea (mainly recipients), this is how their information is transferred to our service providers. In every case the timing and method is “each time the service is used, over an encrypted connection (HTTPS)”.

Cookies and browser storage

We do not use advertising or tracking cookies or visitor analytics. We keep only what the service needs in your browser.

• Sign-in session — Firebase Authentication keeps your sign-in in this browser
• Small preferences — the last company ID you used, which staff app tours you have seen, whether you dismissed the install prompt, the boxes received on this device today, and whether a detail panel is expanded
• Booking in progress — a booking you are writing and a booking-by-chat conversation are kept only in the current tab and are cleared when you close the tab or finish the booking
• Security checks — on screens that call our servers, such as booking, sign-up and sign-in, Google reCAPTCHA Enterprise may use cookies or device information to detect bots

You can clear these in your browser settings. Doing so signs you out and resets your preferences.

How long we keep it

• Records are kept while the courier company subscribes to EZtms, and for longer where the law requires (for example, tax records for 5 years under Australian tax law).
• Records are not deleted straight away when a subscription ends or is suspended, so the company can restart or take its data. When a company leaves EZtms and asks us to, we delete or de-identify its data, except records we must keep by law.
• We do not keep text or photos sent to the AI. Verification codes are stored only as hashes and stop working once used.
• Personal information we no longer need is deleted or de-identified.

How we protect it

• All traffic is encrypted with HTTPS, and stored information is encrypted at rest by Google Cloud.
• What staff can see depends on their role (owner, staff, warehouse or agent). Drop-off agents (outside shops) see only the sender’s name and phone and the number of boxes.
• Public tracking by tracking number shows the recipient’s name masked, and signatures and delivery photos are visible only to the booking account and staff.
• An EZtms operator’s support view is recorded and ends after 60 minutes.

Data breaches

Under the Notifiable Data Breaches scheme, if a data breach is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC). Where a courier company’s customer information is involved, we will tell that company promptly and work with it on the response. Where the Korean Personal Information Protection Act applies, we will also make the notifications and reports it requires.

Access and correction

• EZtms users — email us at hibrizkr@gmail.com.
• Courier companies’ customers — please ask the company you used first. If your request comes to us, we will pass it on and help the company deal with it.

We respond within 30 days and do not charge for making a request. We may ask a few questions to confirm your identity. If the law allows us to refuse a request, we will tell you why.

Complaints

If you have a complaint about how we handle personal information, email hibrizkr@gmail.com. We will acknowledge it and give you our response within 30 days. If you are a courier company’s customer, you may also raise it with that company first.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au, phone 1300 363 992.

People in Korea

The Korean Personal Information Protection Act may also apply to information about people in Korea (mainly recipients). You may ask to access, correct or delete your personal information, ask us to stop processing it, and withdraw consent. Please ask the courier company you used or EZtms (hibrizkr@gmail.com). Information needed for customs clearance or delivery in progress, or that the law requires us to keep, may not be deleted immediately. You can also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118 in Korea).

Changes to this policy

When we change this policy we update the date on this page, and we tell subscribing companies’ owners about significant changes in advance by email or in the staff app.

Contact

ST Humans Pty Ltd (ABN 23 613 672 021)
Privacy enquiries: hibrizkr@gmail.com

Our agreement with subscribing companies is in the Terms of Service.