ZealVM Privacy Statement
Last updated: 08/08/26
ZealVM is a voicemail service operated by Zeal Consultants Limited ("Zeal", "we", "us"), a New Zealand company. This statement explains what information ZealVM collects, how it is used, and the choices available to you. It applies to the ZealVM application at vm.zeal.net.nz and to any customer-branded instance we operate on a customer's behalf.
We handle personal information in accordance with the Privacy Act 2020 (NZ).
Who is responsible for your information
If you use ZealVM through your employer (an organisation that has subscribed to ZealVM), that organisation decides what information is collected and how long it is kept. In Privacy Act terms, they are the agency responsible for the information and Zeal processes it on their behalf and on their instructions. If you have questions about your organisation's use of ZealVM, contact your own IT administrator first.
If your organisation is Zeal itself, or you contract with us directly, Zeal is responsible for the information.
What ZealVM collects
Account information, when you sign in with your Microsoft 365 work account: your name, work email address, and the identifiers Microsoft provides for your user account and organisation. ZealVM never receives or stores your password.
Your mobile number, which you enter during setup. This is how a missed call is matched to your mailbox.
Voicemail recordings left by people who call you, together with the caller's phone number (where the caller has not withheld it), the date, time and duration of the call, and which greeting was played.
Transcripts of those recordings, generated automatically, plus any corrections you make to them.
Greetings you record or upload.
Contact names, only if you choose to use the "Caller names from Outlook" feature. When you do, ZealVM reads your Microsoft 365 contacts and stores name and phone number pairs so that voicemails can display who called. No other contact details (addresses, notes, email addresses) are stored. This feature is optional; if you never use it, ZealVM never accesses your contacts. Some organisations disable it entirely.
Technical information necessary to operate the service: notification subscriptions for the device you enable notifications on, and standard server logs recording activity such as sign-ins, calls received and administrative changes.
We do not use cookies for advertising or tracking. ZealVM sets one cookie to keep you signed in.
Information about callers
When someone leaves you a voicemail, ZealVM records their message and their phone number. Callers are not ZealVM users and have not agreed to anything with us — their information is collected because your organisation operates a voicemail service, in the same way it would with any phone system.
We keep this information only for as long as your organisation's retention setting allows, use it only to deliver the voicemail to you, and never use it for any other purpose. If a caller contacts us about a recording of their voice, we will direct them to the organisation responsible and assist that organisation in responding.
How the information is used
Information in ZealVM is used only to provide the service: playing your greeting to callers, recording and storing messages, transcribing them, showing them to you, and notifying you.
We do not sell information, share it with advertisers, or use voicemail recordings, transcripts or contacts to train artificial intelligence models.
Where the information is held, and who else is involved
ZealVM runs on infrastructure operated by Zeal in New Zealand. Voicemail recordings and transcripts are stored there.
Transcription is performed locally on our own servers. Voicemail audio is not sent to any third-party transcription or AI service.
We rely on the following service providers:
ProviderRoleWhat they handle
Voyager Internet Limited (NZ)Telephone carriageCarries the phone calls, as any phone company does
SMTP2GO (NZ-founded, operating internationally)Email deliveryDelivers voicemail notification emails, which may include a transcript and audio attachment
Microsoft Identity, and push notification delivery Verifies your sign-in; delivers notification alerts (alert content is limited and voicemail audio is never sent through it)
If you turn off email copies in Settings, voicemail content is not sent through the email provider.
How long information is kept
Voicemails are deleted automatically after the retention period configured for your organisation (90 days by default; this can be changed, including to keep messages indefinitely). Deleting a voicemail in the app removes it. Greetings are kept until you delete them. Synced contact information is replaced each time you re-sync and removed when your mailbox is deleted.
When an organisation stops using ZealVM, its data is exported on request and then deleted.
We keep encrypted backups for a limited period for disaster recovery; deleted information persists in those backups until they expire in the normal rotation.
Security
Access to ZealVM requires signing in with your organisation's Microsoft 365 account, so your organisation's own security controls — including multi-factor authentication and conditional access — apply. All connections use encrypted HTTPS. Recordings are stored on access-controlled servers operated by Zeal, and each user can only access their own mailbox. Administrators within your organisation can manage settings for their organisation but cannot access other organisations' information.
The permissions ZealVM requests from Microsoft 365 are "delegated" only, meaning the application can act only in the context of a signed-in user and never independently or in the background. Your organisation's administrator can revoke ZealVM's access at any time.
Your rights
Under the Privacy Act 2020 you may ask to see the personal information we hold about you and to have it corrected if it is wrong. Within ZealVM you can already play, download, correct transcripts of, and delete your own voicemails at any time.
If you use ZealVM through your employer, please make requests to your own organisation, who will contact us if needed. Otherwise, contact us using the details below. We will respond within 20 working days as the Act requires.
Changes to this statement
If we make material changes, we will update the date at the top of this page and notify organisations using the service.
Contact us
Zeal Consultants Limited Email: privacy@zeal.net.nz Website: https://zeal.net.nz
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner: https://www.privacy.org.nz