Privacy Policy

1. Information we collect

We collect personal information that you choose to provide, such as:

• Your name, email address, phone number, and date of birth.
• IRD number (if provided during the advisory process).
• Identity documents you may upload as part of the advisory process.
• KiwiSaver-related details you provide, such as provider, fund type, and approximate balance.
• Risk profile information derived from your responses to our assessment questions.
• Usage data such as device information and browser user agent.

2. How we use your information

We use your information to:

• Provide and improve our digital KiwiSaver guidance experience.
• Personalise the questions and insights shown to you.
• Monitor platform performance, security, and usage trends.
• Meet our legal and regulatory obligations in New Zealand.

We do not sell your personal information. We may aggregate and de-identify data for analytics and product-improvement purposes.

3. Legal basis for processing

We process your personal information with your consent, and where required, to meet our legitimate interests in providing digital financial guidance tools in a way that is fair and reasonable under the Privacy Act 2020.

4. Storage and security

We store your data using reputable cloud providers, including Supabase, located in data centres that may be outside New Zealand. We use technical and organisational measures to protect your data from unauthorised access, loss, or misuse, including:

• Role-based access controls.
• Transport-layer encryption (HTTPS).
• Row-level security for database tables accessed from the browser.

5. Disclosure to third parties

We may share your information with:

• Service providers who help us operate the platform (for example, hosting and analytics).
• AI service providers: We use OpenRouter (which routes to large language model providers including OpenAI) to run the conversational intake. To answer you in context, we send your chat messages along with a limited set of profile fields: your first name, age, approximate KiwiSaver balance, current provider, and the risk-profile answers you give us. We do not send your surname, date of birth, email address, phone number, IRD number, home address, or any uploaded identity documents to AI providers. Data sent to these providers may be processed on servers located outside New Zealand (including the United States). By using the chatbot you consent to this overseas transfer under information privacy principle 12 of the Privacy Act 2020.
• Email delivery: We use Resend to send your Statement of Advice. Your email address and advisory summary are shared with this service for delivery purposes only.
• Professional advisers or regulators where required to meet legal, regulatory, or compliance obligations.

We require third parties to handle your personal information in line with New Zealand privacy law.

6. Your rights

Under the Privacy Act 2020 you have rights to:

• Request access to the personal information we hold about you.
• Request correction of that information if you believe it is inaccurate.
• Complain to us, and if you are not satisfied with our response, to the Office of the Privacy Commissioner (OPC).

To exercise these rights, please contact us using the contact details provided in our platform or any correspondence you have received from Staffords.

7. Data retention

We retain personal information only for as long as it is needed for the purposes outlined above or as required by law. Information that is no longer required is securely destroyed or de-identified.

8. Consent

By using our platform, you consent to the collection, use, and storage of your personal information as described in this Privacy Policy. You may withdraw your consent at any time by contacting us, though this may affect your ability to use certain features of the platform.

9. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services or New Zealand legal requirements. Updates will be posted in this app with a revised "Last updated" date.