Privacy Policy

1. Introduction

Allwise Solutions Limited ("we", "us", "our", "the Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in accordance with the Privacy Act 2020 (New Zealand) and the Information Privacy Principles (IPPs).

By using our website (allwise.co.nz) and services, you consent to the practices described in this policy. If you do not agree, please do not use our services.

2. Information We Collect

We may collect the following types of personal information:

• Identity & Contact: Name, email address, phone number, postal address.
• Property Information: Property address, property type, construction details, photos taken during inspection.
• Assessment Data: Healthy Homes compliance data, heating calculations, insulation details, moisture readings, smoke alarm records, and compliance reports.
• Account Data: Login credentials (hashed), organisation affiliation, user role, activity logs.
• Technical Data: IP address, browser type, device information, pages visited (via standard server logs).
• Payment Data: Transaction records. We do not store full credit card details — payments are processed by third-party providers.

3. How We Collect Information

We collect information through:

• Forms you complete on our website (assessment requests, contractor registration, contact forms).
• Direct communication with you (email, phone, in person).
• On-site inspections conducted by our assessors (photographs, measurements, readings).
• Automated technologies (cookies, server logs) when you browse our website.
• Third-party sources where you have authorised sharing (e.g. property managers providing tenant details).

4. How We Use Your Information

We use your personal information for the following purposes:

• To provide Healthy Homes assessment services you have requested.
• To generate compliance reports, remediation plans, and contractor briefs.
• To communicate with you about your assessment, account, or service updates.
• To send compliance expiry reminders and re-assessment notifications.
• To facilitate the marketplace — matching assessment requests with qualified inspectors.
• To process payments and maintain financial records.
• To improve our services, website, and AI models (using anonymised data only).
• To comply with legal obligations under New Zealand law.

5. Disclosure of Information

We may disclose your information to:

• Inspectors & Contractors: Qualified professionals who need property details to perform assessments or remediation work.
• Landlords & Property Managers: When you are a tenant, your assessment results may be shared with the property owner/manager as required by law.
• Service Providers: Third-party vendors who assist with hosting (Supabase, hosted in Sydney, Australia), AI processing (Google Gemini, United States), email delivery (Resend), payment processing (Stripe, United States), application hosting & edge compute (Vercel, multiple regions), error monitoring (Sentry, United States), and font delivery (Google Fonts). See §11 for details and cross-border transfer information.
• Legal & Regulatory Bodies: Where required by law, court order, or to protect our legal rights.
• Tenancy Tribunal: Assessment reports may be used as evidence in tenancy disputes.

We do not sell, rent, or trade personal information to third parties for marketing purposes.

6. Data Storage & Security

• Personal data is stored on secure servers provided by Supabase (hosted in Sydney, Australia).
• We use industry-standard encryption (TLS 1.3) for data in transit and AES-256 for data at rest.
• Access to personal data is restricted to authorised personnel and contractors on a need-to-know basis.
• We retain assessment data for a minimum of 7 years to comply with NZ tenancy law requirements.
• Account data is retained while your account is active. You may request deletion at any time.

7. Your Rights (Privacy Act 2020)

Under the Privacy Act 2020, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Complaint: Make a complaint to the Privacy Commissioner if you believe your privacy has been breached.

To exercise these rights, contact us at hello@allwise.co.nz. We will respond within 20 working days as required by law.

8. Cookies

Our website uses essential cookies for authentication and security. We do not use tracking cookies or third-party analytics cookies without your consent. You can disable cookies in your browser settings, but this may affect website functionality.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice on our website. Continued use of our services after changes constitutes acceptance.

10. Overseas Disclosure (IPP 12)

Under the Privacy Act 2020 Information Privacy Principle 12, we are required to inform you when your personal information is sent overseas, and to ensure that the destination country provides comparable safeguards (or that you have been informed and have not objected).

The following categories of your information may be transferred to and processed in countries outside New Zealand:

• United States: Stripe (payments), Vercel (hosting), Resend (transactional email), Google Gemini (AI evaluation), Sentry (error monitoring). These providers participate in the EU-US Data Privacy Framework, which the NZ Privacy Commissioner recognises as providing comparable safeguards.
• Australia / Singapore: Supabase regional replicas for read performance. Both jurisdictions have privacy laws the Commissioner recognises as comparable.

Where we transfer your information to a country that does not have comparable safeguards, we will obtain your informed consent before the transfer, or apply contractual safeguards (Standard Contractual Clauses) to protect your information to the standard required by NZ law.

11. Third-Party Processors

To operate the ALLWISE service we share specific categories of personal information with the following third-party processors. Each processor is bound by their own privacy policy and (where applicable) a Data Processing Agreement with us. We have selected these providers with regard to their security posture and data-handling practices, but you should review their policies independently.

Cross-border disclosure (IPP 12)

Because we use processors located outside New Zealand — specifically in Australia (Supabase) and the United States (Stripe, Gemini, Resend, Sentry, Upstash, parts of the Vercel edge network) — personal information you provide may be transferred to, stored in, and processed in those countries. By using our services you consent to these transfers. We rely on the receiving providers' participation in recognised cross-border privacy frameworks (such as the EU-US Data Privacy Framework where applicable) and on contractual safeguards in our data processing agreements. Where you are a New Zealand user, IPP 12 applies and you may request more detail about the safeguards in place by emailing privacy@allwise.co.nz.

12. Data Retention & Deletion

We retain personal information only for as long as necessary to provide our services and meet our legal obligations. The table below summarises our retention periods by data category.

Deletion requests

You may request deletion of your personal information at any time via Settings → Account → Delete account in the app, or by emailing privacy@allwise.co.nz. When you request deletion in-app, your account is immediately soft-deleted (login blocked) and permanently hard-deleted 30 days later. We will action email requests within 20 working days as required by the Privacy Act 2020. Where retention is required by law (e.g. financial records, assessment evidence for active tenancy disputes), we will retain only the minimum necessary subset and explain what we have retained and why.

You can download a copy of all personal information we hold about you at any time via Settings → Account → Download my data. This is your Subject Access Request (SAR) under IPP 6 and the export is a single JSON file containing every row associated with your account.

13. Breach Notification Commitment

The New Zealand Privacy Act 2020 requires agencies to notify the Office of the Privacy Commissioner and affected individuals of notifiable privacy breaches. As part of our commitment to you, we operate the following process:

1. Detection. We monitor our systems 24/7 via Sentry error tracking and Vercel infrastructure logs for anomalies (unauthorised access attempts, unusual data egress, suspicious admin actions).
2. Containment. Upon detection of a potential breach, we immediately revoke compromised credentials, isolate affected systems, and preserve forensic evidence for the investigation.
3. Assessment. Within 24 hours of detection, our Privacy Officer assesses whether the breach is "notifiable" under s.115 of the Privacy Act 2020 — i.e. whether it has caused (or is likely to cause) serious harm to an affected individual.
4. Notification. If the breach is notifiable, we will:
   • Notify the Office of the Privacy Commissioner as soon as practicable
   • Notify all affected individuals directly (via email) within 72 hours of confirming the breach
   • Provide a clear description of what was breached, what personal information was involved, and what steps you should take
5. Remediation. Following any breach, we conduct a post-incident review and publish material changes to our security practices in this Privacy Policy.

To report a suspected privacy breach, email privacy@allwise.co.nz with "PRIVACY BREACH" in the subject line.

14. Related Documents

This Privacy Policy should be read together with:

• Terms of Service
• Service Agreement
• Acceptable Use Policy
• Cookies Policy
• Data Processing Addendum (for B2B customers)
• Complaints & Disputes Procedure
• Disclaimer

15. Contact

For privacy-related enquiries or to exercise your rights, contact our Privacy Officer:

Allwise Solutions Limited
Registered office: 17 East Street, Petone, Lower Hutt, Wellington, 5012, New Zealand
(NZBN available on request under IPP 6 — see §7 for your right of access)
Email: privacy@allwise.co.nz
Phone: +64 21 024 16717