Privacy Policy

01Introduction

This policy explains how Able collects, uses and protects your information when you use the platform. It applies to every Able surface — the app, public pages and the agent. We collect the minimum we need to run the service and we never sell your data. Essential operational telemetry (pages viewed, errors, device type) is collected to keep the platform working; sharing your interest signals with organisations stays off until you opt in.

02Information We Collect

When you create an account we collect your email address and sign-in credentials (or your Google/Apple identity), and optionally a display name, photo, phone number, name, date of birth and address if you add them to your profile. Guest sessions hold no identity until you sign up.

When you create or join an organisation we collect its business details (name, type, NZBN where provided, address, operating hours and services) and your membership record — your role, title and status within that organisation.

Listings you author — titles, descriptions, links and images — are collected to build your public business profile. Uploaded images are stored with your organisation's account.

When you subscribe to a paid plan we record your subscription, its line items, and a ledger of charges. Bank authorisation happens with Akahu (an accredited NZ open-banking intermediary) — we never see or store your bank credentials, and account numbers are stored masked wherever they are shown.

When you connect a bank account, Akahu (New Zealand’s accredited open finance intermediary) gives us an access token and basic account information: account name, number, type and payment capabilities. We request no balances, no transaction history and no identity records. Your online-banking credentials are entered only on Akahu’s own pages — we never receive them. The token is stored encrypted on our servers and account numbers are masked wherever they appear.

When you talk to the agent, the messages you type are sent to our servers together with the minimal account and organisation context needed to answer — who you are, which organisation you are acting in, and what you are permitted to do. Conversations are stored so that we can see where the agent answers badly and fix it. You choose how long they are kept, in your account settings: indefinitely, 90 days, 45 days, or not at all. Indefinitely is the default, and choosing not to keep them deletes what is already there straight away. The choice is yours alone — a business cannot set it for you, and cannot read what you typed. You can also delete them yourself at any time.

03How We Use Information

Identity data is used to sign you in, keep your sessions secure (including SMS verification codes if you add a phone number), and show your profile to organisations you join.

Organisation data powers the organisation workspace: role-based access, member management, and the business profile behind your public listing. NZBN lookups query the official NZ Business Number register.

Published profile content is public by design: it is shown to visitors and indexed for search (including AI-assisted generation and semantic search over your published text). Unpublished profiles are visible only to your organisation.

Agent messages are processed server-side by a cloud AI model to work out what you are asking for and to describe what was found. Everything it can reach is re-checked against your own permissions on our servers before it runs, and anything that changes data is shown to you as a card stating what it will do — nothing happens until you confirm it. When a conversation reaches the end of its retention period, the words are deleted; a record that the conversation happened, and how much it cost to answer, is kept. Your conversations are not used to train AI models.

We use your email address to deliver the notifications you have enabled (account and payment notices by default). Marketing messages are sent only if you opt in. Email delivery can be switched off per category at any time; account and payment notices always remain available in your in-app inbox.

The Purchases and Akahu sections of your settings assemble, on our servers, a view of the payer data we already hold about you: your memberships and subscriptions across organisations, your connected bank accounts and payment consents, and your payment history. This view is built only for you, only while you are signed in, and only from records that belong to your account — it is never shared with organisations or other users, and it collects no new personal information.

04Legal Basis for Processing

We process identity data to perform our contract with you (providing your account) and to meet our legitimate interest in keeping the platform secure.

05Sharing & Disclosure

Your name, photo, role and title are visible to other accepted members of the same organisation. Organisation data is never shared with other organisations.

Subscription payments move directly from your bank account via Akahu under an enduring payment consent you approve, with a fixed payee and limits. You can revoke the consent at your bank or at my.akahu.nz at any time; revocation stops all future charges.

If an organisation connects a third-party service and runs a sync, the data covered by that sync (such as invoices, contacts or calendar events) flows to the connected provider under its own terms and privacy policy. Only the fields the organisation maps are sent, and each transfer is recorded in the connection history.

Account-to-account payments are initiated through Akahu under a payment consent you approve at your own bank, with a fixed payee and limits a payment can never exceed. We share with Akahu only what initiating the payment requires: the consented account, the payee, the amount and a reference. Akahu’s own handling of your data is governed by its privacy policy at akahu.nz.

06Data Retention

We keep your information only while your account is active or as needed to provide the service, meet legal obligations and resolve disputes. When you delete your account, your personal data is removed from the live systems; residual copies in backups expire on their rotation schedule.

You can withdraw bank access at any time — in your Able settings, at my.akahu.nz, or at your bank — and all future payments stop immediately. When you disconnect or delete your account we revoke our access token with Akahu and delete the connection data we exchanged, as the Privacy Act 2020 requires. Payment records themselves are retained as tax law requires of the businesses involved.

07Security

Your data is stored with Google Cloud (Firebase) with encryption in transit and at rest. Access inside Able is role-scoped: organisation data is only readable by that organisation's accepted members, and every server operation re-checks authorisation independently of the app.

When an organisation connects a third-party service (for example an accounting or calendar provider), the access tokens that service issues are encrypted and stored only on our servers. They are never sent to your browser, never shown to staff, and are deleted when the connection is disconnected.

08Your Rights & Choices

Under the New Zealand Privacy Act 2020 you may request access to, and correction of, the personal information we hold about you. You can update most of it yourself from Settings, delete your account and its data, and withdraw analytics consent at any time. To request a copy of your information, contact us using the details below.

You can revoke any payment consent you have granted from the Akahu section of your settings at any time. Revocation takes effect on our payment rails immediately: future payments that relied on the consent stop, and memberships or subscriptions it paid for may lapse or be cancelled by the organisation under their own rules. We keep a record of the revoked consent (who granted it, when, and when it was revoked) as required for our financial audit trail.

09Cookies & Tracking

Able uses only the cookies and local storage needed for sign-in sessions, your preferences, and essential operational telemetry (pages viewed, errors, device type) that keeps the platform working. Interest-signal tracking for organisations you engage with is OFF by default and only starts if you consent; withdrawing consent stops it immediately. We do not use third-party advertising trackers.

10International Transfers

Our infrastructure runs on Google Cloud, which may store data outside New Zealand. Wherever data is processed, it remains protected by safeguards comparable to the New Zealand Privacy Act 2020, as required by that Act.

11Children

Able is a business platform and is not directed at children under 16. We do not knowingly collect personal information from children; if you believe a child has provided us data, contact us and we will remove it.

12Changes to This Policy

When this policy changes, the "Last updated" date above changes with it. For material changes we will notify you in the app before they take effect.

13Contact Us

Questions or requests about your privacy can be sent to privacy@able.kiwi. You may also complain to the Office of the New Zealand Privacy Commissioner.