Privacy Policy
Last updated: 2026-05-16 · Effective in NZ + AU · This document is a draft pending NZ legal review.
Who we are
Wyrefront Ltd is a New Zealand company providing document-intelligence software to businesses in NZ and Australia. This Privacy Policy describes what personal information we collect, how we use it, and the rights you have under the Privacy Act 2020 (NZ) and the Australian Privacy Principles. If you are a tenant of Wyrefront and the personal information being processed belongs to your end users, our Data Processing Addendum (available on request to legal@wyrefront.com) governs that relationship — this Policy covers our direct relationship with account holders and visitors to this website.
Information we collect
We collect: account information you provide (name, email, organisation, role); authentication artefacts (password hashes, optional TOTP secrets); billing information processed by our payment provider; product usage data (queries, documents uploaded, integrations connected); browser metadata (IP address, user agent) recorded in audit logs; and any documents you choose to upload or connect via integrations. Documents and document content remain under the control of your tenant — Wyrefront staff do not access tenant content except via a documented break-glass process recorded in the audit log.
How we use your information
We use personal information to provide the service, authenticate access, enforce per-user access controls, deliver tenant-admin notifications and transactional emails, troubleshoot incidents, and meet our legal and regulatory obligations under NZ and AU privacy law. We do not sell personal information. We do not train AI models on customer content. We do not send customer documents or queries to OpenAI, Anthropic, Microsoft, Google, or any other third-party AI vendor as part of the answering pipeline.
Cross-border disclosure
Our production and UAT infrastructure is currently hosted in the United States with DatabaseMart. Regional hosting options (NZ, EU) are planned; customers requiring strict jurisdictional residency should contact us about our Region Lock add-on and its current availability. Encrypted backups are stored with Backblaze (US). Off-site disaster recovery escrow is stored with Hetzner Cloud (Germany). For a current list of sub-processors and the data they process, see our Security & Trust page.
Your rights
Under the Privacy Act 2020 (NZ) and the Australian Privacy Principles, you have the right to: access the personal information we hold about you; request correction of inaccurate information; request deletion (subject to our legal record-keeping obligations); receive a machine-readable export of your personal information; and complain to the NZ Office of the Privacy Commissioner or the Office of the Australian Information Commissioner. Tenant-admins can export the full set of tenant-scoped data at any time via Settings → Account → Export my data. Other requests may be directed to privacy@wyrefront.com.
Retention
Document content, queries, and integrations are retained for the duration of your subscription. On account closure they are deleted within 30 days, subject to the closure-flow grace period. We retain a tombstone record of closed accounts (tenant name, primary email, dates of activity, aggregate usage statistics) indefinitely for legal and tax obligations. Audit logs are retained for 7 years in line with the NZ Tax Administration Act and Privacy Act 2020 record-keeping expectations.
Security
We use TLS 1.3 for data in transit, AES-256 for data at rest in our backup chain, application-layer encryption for stored OAuth credentials, multi-layer ACL enforcement, and append-only audit logging. Our full security posture, including our incident response approach and compliance roadmap, is published at wyrefront.com/security.
Changes
We will update this Policy from time to time. Material changes will be notified by email to the tenant-admin address on file at least 14 days before they take effect.
Contact
Privacy enquiries: privacy@wyrefront.com. General: hello@wyrefront.com.