Privacy Policy
This policy explains what Blackhaven Software S.A. (we, us), the company behind our products, does with personal information.
1. Who this policy covers, and who it does not
This policy covers information about: people who sign up for or hold an account with one of our products; staff of a business using our products who have their own login; billing and administrative contacts; people who contact our support or sales; people who subscribe to our emails; visitors to our websites; and people who apply to work with us.
This policy does not cover the customers of businesses that use our products. If you booked an appointment, bought something, or were sent a reminder by a business that uses one of our products, that business decides what happens to your information and is the one to ask. We hold it on their behalf and act on their instructions. We will pass your request to them rather than answer it ourselves, and we will tell you who they are.
2. What we collect, and why
| What | Why we need it | Our basis |
|---|---|---|
| Name, business name, email, phone | To create and run your account, and to contact you about the service | Performing our contract with you |
| Login and security information, including passkeys and session records | To let you sign in and to keep the account secure | Performing our contract; our legitimate interest in security |
| Billing contact and payment records (not your card number) | To bill you and keep records we are required to keep | Performing our contract; legal obligation |
| How you use our products — pages visited, features used, errors, approximate location from your IP address | To keep the service working, fix faults, and decide what to build | Our legitimate interest in providing and improving the service |
| Support messages and their contents | To answer you, and to improve our help and our product | Performing our contract; legitimate interest |
| Marketing preferences and whether you opened or clicked our emails | To send you things you asked for, and to stop sending what you did not | Consent, and legitimate interest for messages about the service you use |
| Job application information | To consider your application | Legitimate interest; consent where you give us extra information |
We do not collect special category or sensitive information about you for our own purposes, and we ask you not to send it to our support channels.
3. Where the information comes from
Mostly from you. We also receive: your payment status from our payment provider; delivery and engagement information from our email provider; and, where you sign in with Google or a similar service, your name and email address from them. We do not buy personal information, and we do not build profiles from data brokers.
4. Who we share it with
We share personal information only with:
- Service providers who help us run our products — hosting, storage, email and messaging delivery, error monitoring, AI model providers, payments, and support tooling. Each is bound to protect it and to use it only for what we have asked.
- Our payment provider acting as merchant of record, which is the seller of record for your subscription and handles tax.
- Professional advisers, and a buyer if we sell the business — in which case we will tell you.
- Anyone we are legally required to share it with, where we will tell you if we are permitted to.
We do not sell personal information. We do not share it for anyone else's advertising.
5. The AI assistant
Our products include an AI assistant. The assistant runs on models provided by third parties. We do not train, fine-tune or improve any AI model of ours on your business's customer information, and our agreements with model providers are on terms that do not allow them to train on it either.
6. Where it is stored
Information about the businesses that use our products, and their customers, is stored in the region assigned to that business. Information about you as an account holder — your name, login, billing contact and support history — and a small set of identifiers used to link accounts across regions, are held in our global systems. We will tell you before we change the region your business's data is stored in.
7. Sending information overseas
We are a Panamanian company and our people work in Australia. So your information may be accessed from Australia and Panama, and from the countries where our service providers operate.
Where we disclose personal information outside New Zealand, we do so on a basis permitted by Information Privacy Principle 12, including by requiring the recipient to protect it to a comparable standard by contract.
Under Australian Privacy Principle 8 we remain accountable for what an overseas recipient does with information we disclose to them, unless an exception applies.
8. Automated decisions
We use software to make or help make some decisions. Where a decision is made, or substantially affected, by a computer program and it could significantly affect your rights or interests, we tell you here.
The decisions in this category are:
- Automated fraud and abuse controls — we use automated signals to detect fraudulent sign-ups, abusive sending and artificially inflated messaging traffic, and these can throttle or suspend an account automatically.
- Automated billing and usage controls — metered usage is calculated automatically, and an account can be automatically limited when it reaches a cap it has set or a published limit.
- Automated complaint-rate controls — where messages sent from an account draw complaints above a published threshold, sending can be throttled or paused automatically.
In every case you can ask a person to look at it. Email privacy@blackhavensoftware.com or use the contact in the product, and a person will review the decision and tell you the outcome. We do not use automated decisions to assess your character, creditworthiness or personal qualities.
9. Cookies and similar technologies
In our products we use only what is necessary for the service to work: a session cookie so that you stay signed in, and a cookie that authorises a preview of your own unpublished website before it is live. We do not use advertising or cross-site tracking cookies in our products, and we do not use cookies to track you across other websites.
This website uses no cookies and no analytics.
10. How long we keep it
We keep personal information only for as long as we need it for the purposes in this policy, or as long as the law requires us to (for example, tax and corporate record-keeping). When we delete information, it is first removed from the live service and then permanently destroyed; backups cycle for up to 35 days, so deletion completes within that period.
11. How we protect it
We use encryption in transit and at rest, access controls with multi-factor authentication, secrets held in a managed vault, continuous automated security testing, an append-only audit trail, and regular tested backups. Each business's data is separated from every other's at the database level, enforced independently of our application code.
12. If something goes wrong
If there is a data breach that is likely to cause you serious harm, we will tell you and the relevant regulator, as quickly as we can and within the time the law requires. Where we hold information on behalf of a business using our products, we tell that business within 24 hours so they can meet their own obligations.
13. Your rights
Depending on where you live you can ask us to: tell you what we hold; give you a copy; correct it; delete it; limit or stop how we use it; object to use based on our legitimate interests; and stop marketing to you at any time. You can also withdraw consent where we relied on it.
Email privacy@blackhavensoftware.com. We will respond within 30 days, and sooner where the law requires. We will not charge you and we will not make it difficult.
If you are unhappy with our response you can complain to your data protection authority: in Australia the Office of the Australian Information Commissioner, and in New Zealand the Office of the Privacy Commissioner. We would rather you told us first, but you do not have to.
14. Our representatives
| EU representative (GDPR Article 27) | to be appointed before our UK and EU launch |
|---|---|
| UK representative | to be appointed before our UK and EU launch |
| Contact for privacy matters | privacy@blackhavensoftware.com |
15. Changes
We will post any change here and update the version and date. If a change materially affects you we will tell you directly.