Privacy Policy

SiteAide is a construction site management application for builders, available at siteaide.co.nz (the "Service"), operated by Orivon Studio Limited, a company incorporated in New Zealand (company number 9444779, NZBN 9429053815903), trading as SiteAide ("we", "us"). This policy explains what information we collect, how we use it, and your rights under the New Zealand Privacy Act 2020. Our Privacy Officer can be contacted at privacy@siteaide.co.nz.

Information we collect

• Account information — your name, email address and password (stored as a secure hash) when you create an account, and your company details if you add them in Settings.
• Business data you enter — jobs, site diaries, receipts, photos, files, contacts, schedules, budgets and invoices you create in the Service. This data belongs to you.
• Voice recordings — when you use a voice feature, your recording is processed to produce text and structured records. We keep the resulting records, not a voice profile.
• Payment information — handled entirely by Stripe. We never see or store your card details; we store only your subscription status and Stripe customer reference.
• Usage information — basic technical logs (such as AI feature usage counts and security logs) needed to operate, secure and rate-limit the Service.

No advertising or tracking. We do not use advertising pixels, cross-site trackers or cookie-based profiling, and we do not sell your information.

Information about other people

Records you create may include personal information about others — such as crew members, clients, subcontractors and suppliers. When you enter that information, we store and process it on your behalf to provide the Service to you: you decide what is entered and how it is used, and we do not use it for advertising, for profiling those individuals, or for training AI models.

You are responsible for ensuring you have lawful authority to collect and record that information and for handling it in line with the Privacy Act 2020 — including, where required by information privacy principle 3A, taking reasonable steps to make those individuals aware that their information has been collected, unless a lawful exception applies.

How we use your information

• To provide, maintain, secure, support and improve the operation of the Service — storing and displaying your business records to you.
• To process AI features you actively use (see "AI processing" below).
• To connect integrations you authorise, such as Xero for invoicing. Connection tokens are stored encrypted on our servers and you can disconnect at any time.
• To process subscriptions and billing, and to communicate essential service messages such as password resets and billing notices.
• To meet legal and regulatory obligations.

AI processing

When you actively use an AI feature, the information required to perform that feature (for example, a receipt image, a voice recording, or text you submit) is sent to our AI providers — Anthropic and OpenAI — to return results to you. We use their business/API services: under their commercial terms, customer inputs and outputs are not used to train their general models by default, and we do not opt in to such use. Providers may process limited information for security, abuse prevention, service operation and legal compliance in accordance with their commercial terms. We do not use your content to train our own AI models. Avoid submitting unnecessary sensitive personal information through AI features.

Where your data is stored, and who processes it

We use a small set of service providers to run the Service. Each processes information on our behalf, only to deliver its function:

• Supabase — database, authentication and file storage (cloud infrastructure in the Asia-Pacific region), with access controlled per-account through row-level security. Files and photos are stored in private storage accessible only through short-lived signed links.
• Vercel — application hosting and delivery.
• Stripe — subscription payments.
• Xero — accounting integration, only if you connect it.
• Anthropic and OpenAI — AI features, as described above.
• Resend — transactional email (such as password resets).
• Zoho Mail — our support mailbox (Australian data centre), which holds the content of support emails you send us.
• PostHog — product analytics and session replay for the signed-in app (hosted in the European Union). Text you type and images (including receipt photos) are masked or blocked before anything is recorded.
• Google Analytics — visit statistics for our public website pages only; it does not run inside the signed-in app.

Some of these providers store or process information outside New Zealand (including Australia, Japan and the United States). Where this occurs, we take reasonable steps to ensure the information is subject to safeguards comparable to the Privacy Act 2020, consistent with information privacy principle 12, including through the providers' contractual data-protection commitments. We may change providers from time to time; material changes will be reflected in this policy.

Security

We take reasonable steps to protect your information — including encrypted connections (HTTPS), encryption at rest, encrypted storage of integration tokens, per-account access controls enforced at the database level, rate-limited and authenticated AI endpoints, and restricted administrative access. However, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential and for the security of any device you use to access the Service.

We maintain procedures for assessing and responding to suspected privacy and security incidents, and our provider arrangements require relevant providers to notify us of incidents affecting information processed on our behalf. If a privacy breach occurs that causes, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected users as soon as practicable, as required by the Privacy Act 2020.

Sharing

We do not sell your information. We share data only with the service providers named above, to the extent needed to run the features you use, or where required by law.

Retention and deletion

Your data is retained while your account is active. You can export your data (JSON and CSV) at any time from Settings, and you can permanently delete your account from Settings → Data & Privacy. Deletion promptly removes your active records, files and authentication account and cancels any active subscription. Residual encrypted copies may remain in system backups for up to 30 days before being overwritten. Limited billing, security and legal records may be retained for longer where reasonably required by law or for fraud prevention, dispute resolution or enforcement; information retained for these purposes is not used for ordinary product purposes. Deleting your SiteAide account does not delete information independently retained by third parties such as Stripe or Xero under their own legal obligations and privacy policies.

Your rights

Under the Privacy Act 2020 you may request access to, or correction of, the personal information we hold about you. Contact us using the details below and we will respond as soon as reasonably practicable, and within 20 working days. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner (privacy.org.nz).

Analytics and session replay

To understand how the Service is used and to fix problems, we use PostHog (hosted in the European Union) for product analytics and session replay inside the app. Replays record which screens are visited and which controls are used — they do not capture what you type (all input is masked on your device before anything is sent) and they do not capture images, including receipt and site photos. Analytics is linked to your account so we can investigate issues you report. Our public website uses Google Analytics to measure visits; that does not run inside the signed-in app. You can ask us to delete analytics data about you at any time via privacy@siteaide.co.nz.

Cookies and local storage

We use essential browser storage (such as login sessions and draft auto-save) required for the Service to function, and analytics storage as described above. We do not use advertising cookies, and we do not sell or share your data for advertising.

Changes and contact

We may update this policy from time to time; material changes will be noted in the app. Privacy questions or requests: email privacy@siteaide.co.nz (or support@siteaide.co.nz), or use the Support section in the app's Settings.