Privacy Policy

1. What personal information we collect

In short: We collect what you type into the AI chat, your contact details, analytics, and project information.

We collect personal information that you provide and that is generated when you interact with us. This includes the following.

• AI discovery chat content: everything you type into our AI discovery chat, including any details you choose to share about yourself or your business.
• Contact and capture details: your name, email address and business name when you provide them.
• Analytics information: basic, privacy-friendly analytics about how the website is used, such as pages viewed and general device or browser information.
• Engagement information: information exchanged while we scope or deliver a project, which may include access to your systems (for example Xero, job-management tools and customer records) and information about your business.
• Billing information: when you buy an assistant, your business name, address, email, what you have bought and what you have paid. Your card details go straight to Stripe, our payments provider. Buildloop never sees or stores them.
• Assistant information: what your assistants work on, such as customer chats, emails and documents, and what they keep in What we know (the AI control centre your assistants share).
• Facebook and Instagram information, only if you connect a Facebook Page to Live chat: see Facebook Messenger and Instagram below.
• Bank information, only if you connect your bank: the names, types and masked numbers of the accounts you choose, their balances, and their transactions as your bank shows them (date, amount, description, particulars, code and reference). We never see your bank password, and we cannot pay anyone or move money.

2. How we collect it

In short: We collect information directly from you and automatically as you use the site.

We collect most personal information directly from you, when you use the AI discovery chat, submit your details, email us, or work with us on a project.

We also collect some information automatically through cookies and analytics when you use the website. See our Cookies Policy for more detail.

Where you give us access to your business systems during an engagement, we may collect information held in those systems as needed to deliver the agreed services.

Bank information comes through Akahu, New Zealand's open-banking provider. You sign in at your bank on Akahu's screen, choose the accounts, and can withdraw our access at any time at my.akahu.nz or from the Bank feeds page of your AI control centre. Akahu handles your consent under its own privacy policy.

3. Why we collect and use it

In short: We use your information to respond to enquiries, scope and deliver projects, and improve our service.

We collect and use personal information for the following purposes.

• To operate the AI discovery chat and generate general suggestions in response to what you share.
• To follow up on your enquiry; when you complete the discovery chat, a member of our team is notified so we can get in touch.
• To scope, propose, build, deliver and support software projects under a proposal or Statement of Work.
• To run the assistants you buy, and to bill you for them.
• If you connect your bank: to show your owners and admins what is in the bank, to match payments that land to the invoices they pay so an assistant can propose marking them paid in your accounting system, and to warn you when a balance looks low. Each assistant reads only the accounts you tick for it.
• To improve our website, our AI discovery experience and our services.
• To meet our legal obligations and to protect our legitimate business interests, such as security and record-keeping.

4. AI processing and consent to store chat transcripts

In short: Your chat is processed by an offshore AI provider; transcripts are stored only if you consent.

The AI discovery chat is processed server-side by a third-party AI provider (Anthropic), which processes the content of your conversation in order to generate responses. This processing occurs offshore, outside New Zealand.

We store chat transcripts only where you have given explicit consent. If you consent, we keep the transcript so we can follow up properly and improve the service. If you do not consent, we do not retain the full transcript for those purposes, although your capture details and the fact you made an enquiry may still be recorded.

Please do not enter sensitive personal or financial details into the chat. It is intended for a general discovery conversation, not for confidential information.

Bank transactions are matched to invoices by our own code. In this first version they are not sent to the AI provider. If a later version lets an assistant read your bank lines to answer a question you ask it, this policy will say so first, and the lines sent will be the ones the question needs. A bank statement sent as a file, such as one a landlord uploads for their accountant's Rental accounts, is a document like any other: the AI provider reads it to list its lines, and our code checks and adds them. The AI provider does not use what it processes for us to train its models.

5. Disclosure, subprocessors and cross-border (offshore) disclosure

In short: We share information with trusted service providers, some offshore, and address IPP 12.

We do not sell your personal information. We disclose it only as needed to operate our website and deliver our services, including to the service providers below, and where required or permitted by law.

Some of these providers are located outside New Zealand, which means your personal information may be disclosed offshore. This is a cross-border disclosure under Information Privacy Principle 12 of the Privacy Act 2020. Before disclosing personal information overseas, we take reasonable steps to ensure it is protected by comparable safeguards, for example through the provider's contractual commitments and security practices, or we rely on a lawful exception such as your authorisation.

• Anthropic, in the United States, which reads AI discovery chat messages and the messages and documents an assistant works on, to write replies. If Anthropic's service is down, we may run the same model in Sydney through Amazon Bedrock instead.
• Resend, in Tokyo, Japan, which sends the emails Buildloop and your assistants send, and receives emails sent to an assistant's address.
• Stripe, which takes payments, keeps your card details and sends invoices.
• Supabase and Vercel, in Sydney, Australia, which store and run everything else (see Where your information is stored and processed).
• Meta Platforms, which carries the Facebook Messenger and Instagram messages between a business's customers and Live chat, when the business connects its Facebook Page.
• Akahu Technologies Limited, in New Zealand, which connects to your bank with your consent and passes us the account and transaction information you chose to share. Akahu keeps its own record of your consent, and your bank and Akahu each have their own privacy policies.
• Other tools used to run our business, such as analytics and, during engagements, integrations like Xero, messaging providers (for example Twilio or Modica) and banking services, as relevant to a project.

6. Where your information is stored and processed

In short: Your information is stored in Sydney; AI requests go to the United States and email passes through Tokyo.

Buildloop's database and files are kept with Supabase in Sydney, Australia, and our app runs on Vercel in Sydney. This includes your account, your assistants' records, the AI control centre, uploaded files and billing records. Searching the AI control centre by meaning also happens in Sydney.

Some information is processed outside Australia and New Zealand.

• United States: when an assistant or the AI discovery chat needs the AI model, the text and documents it is working on are sent to Anthropic in the United States, which writes the reply and sends it back. If Anthropic's service is down, we may send the request to the same model in Sydney through Amazon Bedrock instead.
• Japan: emails go through Resend in Tokyo. That includes each email's address, subject and body, both for emails we send and for emails sent to an assistant's address. We keep what we put in emails to what the person needs.
• Payments: Stripe takes payments and keeps card details, under its own privacy policy.
• Bank information is stored in Sydney with your other business data. Account numbers are masked before they are stored. The connection to Akahu is held as an encrypted token that is opened only on our servers and never shown in the browser.

7. Storage, security and retention

In short: We use reasonable measures to protect your information and keep it only as long as needed.

We take reasonable, industry-standard steps to protect personal information from loss, misuse and unauthorised access, as described in our Data Security statement. No system can be completely secure, so we cannot guarantee absolute security.

We keep personal information only for as long as we need it for the purposes above or as required by law, and then take reasonable steps to delete or de-identify it. Stored chat transcripts are kept only where you have consented and for as long as relevant to follow-up and service improvement. Emails sent to a business's memory email address are read to suggest notes for its AI control centre, with personal details left out of the notes, and the emails are deleted after 90 days (14 days for one held because its sender isn't on the business's list).

Bank information is kept for as long as your bank is connected. When you disconnect, or withdraw access at Akahu, nothing more is read, and your balances and transactions are deleted 30 days later. The exception is a transaction an assistant has used in a record you keep, such as a payment matched to an invoice or a figure in a report: that line stays with the record for as long as the record is kept, which for tax records is seven years under the Tax Administration Act 1994. You can ask us to delete bank information sooner, and we will say what we deleted.

8. Facebook Messenger and Instagram

In short: If a business connects its Facebook Page, we receive the messages its customers send it on Messenger and Instagram so Live chat can answer them. You can remove our access and ask us to delete what we hold at any time.

A business can connect its Facebook Page, and the Instagram professional account linked to it, to its Live chat assistant. The business's admin signs in with Facebook on Meta's own screen and chooses the Page. From then on, Meta sends us the messages customers send that Page on Messenger or that Instagram account by direct message, and Live chat replies in the business's name.

From Meta we receive: the Page's name and ID, and the linked Instagram account's ID and username; an access key for the Page, which we keep encrypted and use only to receive and reply to messages; the Facebook ID of the admin who connected the Page; and each message a customer sends, with the time and the ID Meta gives that customer for this Page. We do not receive the customer's password, friends, posts or anything else on their profile.

We use this information only to answer the business's customers, to show the business its conversations and reports, and to hand a conversation to a person at the business. We do not use it for advertising, we do not sell it, and we do not share it with anyone other than the service providers listed in this policy. The AI provider writes replies from it and does not use it to train its models.

Conversations belong to the business the customer messaged. The business keeps them for as long as it uses Live chat; when a business stops using Buildloop, it can ask us to delete them, and we do.

To remove our access and delete Facebook and Instagram data: a business can press Disconnect on the Channels page of Live chat, which stops new messages and deletes the Page's access key straight away. Anyone who connected a Page can also remove Buildloop in Facebook (Settings and privacy, Settings, Business integrations, then Remove) or in Instagram (Settings, Website permissions, Apps and websites, then Remove). Facebook tells us when this happens, and we delete the access keys and disconnect the Pages that person connected at once. If you messaged a business and want your conversation deleted, ask that business, or email admin@buildloop.co.nz with the business's name and roughly when you wrote, and we will delete it and tell you when it is done.

9. If something goes wrong

In short: How we handle a privacy breach, including one involving bank information.

If personal information we hold is lost, accessed or disclosed without authority, we follow our incident response plan: we contain it, work out who is affected and what was involved, and tell the people affected what happened and what to do. Where the breach is likely to cause serious harm, we notify the Office of the Privacy Commissioner as the Privacy Act 2020 requires, as soon as practicable and within 72 hours of becoming aware of it.

If bank information is involved, we also tell Akahu straight away so that bank access can be withdrawn, and we withdraw it ourselves from our side.

10. Your rights: access and correction

In short: You can ask to see and correct the personal information we hold about you.

Under the Privacy Act 2020 you have the right to ask for access to the personal information we hold about you, and to ask us to correct it if it is wrong.

To make a request, contact our privacy contact (see below). We may need to verify your identity, and there are limited situations where we may decline a request as allowed by law.

11. Personal information about your own customers

In short: When our software processes your customers' data, you control it and we act on your behalf.

Where the software we build for you processes personal information about your own customers or contacts, you are the agency that controls that information under the Privacy Act 2020, and Buildloop processes it on your behalf and on your instructions.

This means you are responsible for your own privacy compliance in respect of that information, including providing privacy notices to your customers and having a lawful basis for the processing.

12. Cookies and analytics

In short: We use privacy-friendly analytics; details are in our Cookies Policy.

We use a small number of cookies and privacy-friendly analytics to understand how the website is used and to keep it working. You can control analytics cookies as described in our Cookies Policy, which also explains the difference between essential and analytics cookies.

13. How to contact us or make a complaint

In short: Contact our privacy contact; you can also complain to the Privacy Commissioner.

If you have any questions, want to access or correct your information, or wish to make a privacy complaint, please contact us at admin@buildloop.co.nz.

Our privacy officer is Kayne Munro, Director, who can be reached at admin@buildloop.co.nz. We are operated by Buildloop Limited (NZBN 9429053909787). General enquiries: admin@buildloop.co.nz.

If you are not satisfied with how we handle your complaint, you can contact the Office of the Privacy Commissioner (www.privacy.org.nz), which oversees the Privacy Act 2020.

14. Changes to this policy

In short: We may update this policy and will show the date it last changed.

We may update this Privacy Policy from time to time. The current version is the one published here, with the 'last updated' date shown above. We encourage you to review it periodically.