Privacy policy

Scope and our role

This policy covers our website visitors, people who contact us, prospective and current clients, and information processed through assistants we operate for trade businesses. It explains current website behaviour separately from production assistant services.

What we collect and why

• Website requests: a hosting/CDN provider can process IP address, device/browser information, requested URLs and security/traffic logs to deliver and protect the site. Cloudflare Pages is the configured hosting platform.
• Website sample: a rule-based fictional chat runs in browser memory. It sends no chat text to us or an AI provider and uses no local storage or tracking cookies. Restart or reload clears its in-memory conversation.
• Demo enquiries: the optional email composer uses name, business, trade, region, optional website and message locally. We receive those details, your sender address, signature and email metadata only if you choose to send an email. No direct form submission or third-party form account is used.
• Clients: business contact, approved website/FAQ content, service settings, support correspondence, agreements and billing records needed to set up and maintain an agreed service.
• Client end-customers: where a production assistant is agreed, it may process contact details, job type, suburb, approximate scope, timing, optional budget and messages necessary for the trade business to respond. Photos/full addresses are not collected by this sample and require separate secure arrangements if needed in a client service.

Direct and indirect collection — IPPs 2, 3 and 3A

We normally collect from you or through your authorised instructions. An indirect source, such as a referral, client contact list or public business website, must have a valid basis under IPP2; public availability is not unlimited permission. We check necessity and fairness, including when information concerns children.

IPP3A, introduced by the Privacy Amendment Act 2025, commenced on 1 May 2026. For personal information collected indirectly from that date, we take reasonable steps to notify the individual as soon as reasonably practicable unless a statutory exception applies and has been assessed. The notice explains that collection occurred, its purpose, intended recipients, the names and addresses of the collecting and holding agencies, any authorising/requiring law and access/correction rights. A general website policy does not replace a needed individual notice. We assess and record any exception rather than assuming consent or an exemption.

For direct collection we provide an appropriate point-of-collection notice, including purpose, recipients, agency identity/contact address, whether information is optional or required by a particular law, consequences of not providing it and access/correction rights. Ask the privacy officer for our business contact address; we do not publish a registered residential address on this site.

When we act for a trade business — section 11

For a production client assistant, Fafo Limited normally stores/processes enquiry information solely on the trade business’s instructions as its service provider/agent. Under section 11 of the Privacy Act 2020, information held solely on behalf of a client is treated as held by that client, not independently by us. The client remains responsible for its collection notices, lawful purposes, access/correction decisions and notification duties; we assist with retrieval, security, correction, deletion and incidents under the service agreement.

This treatment depends on actual use, not a label. If we use or disclose information for our own purposes, both parties may be treated as holding it and we must assess our own obligations, including IPPs 11, 12 and 3A. We do not use client enquiry content for our own marketing or shared model training. Client-specific notices must identify the trade business and the actual approved providers before deployment.

Use, accuracy and sharing — IPPs 8, 10 and 11

We take reasonable steps to check accuracy, currency, completeness, relevance and that information is not misleading before use/disclosure. We use information for the stated purpose or a legally permitted related/other use. We share only as necessary with authorised personnel, the relevant client trade business, approved service providers, professional advisers, or where law permits or requires it. We do not sell enquiry lists. An enquiry does not authorise a newsletter or unrelated marketing.

Overseas processing and disclosure — IPP12

Cloudflare operates internationally and may process technical requests outside New Zealand. Our enquiry address uses the Grok Bot email service; messages and metadata can be processed by its service infrastructure and subprocessors overseas. This policy does not promise New Zealand-only hosting or a particular processing country. Production AI, automation and email providers are selected and recorded per client; no production AI provider receives messages from this website sample.

Where a provider processes only on our/client’s behalf without its own purposes, section 11 applies and a transfer is not ordinarily a disclosure for IPPs 11/12, but the responsible agency remains accountable for security and handling. If the recipient uses data for its own purposes, we assess a lawful IPP11 basis and IPP12 before disclosure. We require reasonable grounds for comparable safeguards, such as applicable NZ/comparable law or contractual protections. If relying on individual authorisation where comparable protections are absent, we expressly explain that the recipient may not provide comparable NZ protection before obtaining it. The enquiry checkbox is not blanket authorisation for unprotected overseas disclosure. Actual provider terms, subprocessors and safeguards must be assessed, not assumed from a brand name.

Security — IPPs 4 and 5

Collection must be fair, lawful and not unreasonably intrusive. Our security requirements include least-privilege access, strong account authentication, per-client separation, secure transport where supported, software updates, limited logs and incident handling. Provider/access controls are reviewed before client systems are activated. Email is not a suitable channel for highly sensitive information; ordinary email may be retained by your own provider/device. We cannot guarantee absolute security.

Retention — IPP9

We keep information only for as long as needed for a lawful purpose. Our standard target is to delete routine unsuccessful-enquiry correspondence within 90 days after it closes, unless ongoing discussions, a complaint or legal obligations justify longer retention. Client production chat logs are normally configured for 30 days unless a documented client need requires another period. Client lead records follow the client’s disclosed schedule. Agreements, billing and tax records are retained for applicable legal periods, commonly seven years where NZ tax-record rules apply. Backups and provider logs follow documented provider schedules; deletion may not remove backup copies immediately. Retention settings and exceptions must be verified for the actual system.

Your rights — IPPs 6 and 7

Contact our privacy officer at paulsgotmail-ndgb0d+tradiefuture@mail.grokbot.com to request access or correction. We may verify identity proportionately. We respond as soon as reasonably practicable and make the required decision within 20 working days unless a lawful extension or other statutory rule applies; we explain an extension. Lawful withholding grounds may apply and we give reasons where required. If we decline a correction, you may ask us to attach a statement of correction. For client-held end-customer information, contact the trade business or ask us to help route the request; we assist the client rather than independently changing its records without authority.

Unique identifiers — IPP13

We do not request government identifiers in website enquiries. We assign/use unique identifiers only where necessary for efficient functions, check identity appropriately, protect against misuse and do not adopt another agency’s identifier unless a legal exception permits it.

Privacy breaches

We assess incidents promptly, contain them, preserve relevant evidence and notify the responsible client where we process on its behalf. If a breach has caused or is likely to cause serious harm, the responsible agency must notify the Office of the Privacy Commissioner and affected people as soon as practicable, subject to statutory exceptions. OPC recommends notification ideally within 72 hours of awareness of a notifiable breach; that is guidance, not a universal fixed statutory deadline. We coordinate client/provider roles without treating contractual allocation as removing legal duties.

Cookies, analytics and marketing

This build sets no application cookies, has no analytics/advertising scripts and does not persist the sample chat or email form data. Hosting/security infrastructure may process requests and apply its own necessary protections; any provider cookies depend on deployed configuration. If analytics or additional storage is introduced, we will update the notice and assess any consent/notification requirements before activation. You can control cookies through your browser.

For marketing electronic messages we require an appropriate consent basis under the Unsolicited Electronic Messages Act 2007, identify the responsible sender and provide a working free unsubscribe. We honour unsubscribe requests within five working days and keep the facility working for at least 30 days. Launch policy is express opt-in for unrelated marketing; the demo enquiry consent covers responding to your request only. We keep suppression/consent evidence as necessary and do not use harvested lists.

Complaints and changes

Please email our privacy officer first so we can investigate. You may complain to the Office of the Privacy Commissioner if unresolved or otherwise as allowed by law. We update this policy when practices change and display the updated date.

Privacy principles and source guidance

This policy addresses IPPs 1–13 plus 3A: necessary purpose (1), source (2), direct notice (3), indirect notice (3A), fair collection (4), security (5), access (6), correction (7), accuracy (8), retention (9), use (10), disclosure (11), overseas disclosure (12) and identifiers (13).

• OPC privacy principles
• OPC IPP3A guidance
• OPC third-party/section 11 guidance
• OPC overseas disclosure