Privacy Policy

1. Our Commitment to Your Privacy

Corvidae Limited ("we", "our", or "us") is committed to protecting your privacy and handling your personal information with care and respect. This Privacy Policy explains how we collect, use, store, and protect your information in accordance with the New Zealand Privacy Act 2020 and its Information Privacy Principles.

By using our website, applications, and services (collectively, the "Services"), you agree to the collection and use of your information as described in this policy.

2. Information We Collect

2.1 Personal and Business Information

To provide our Services, we may need to collect the following personal and business information:

• Contact Information: Name, email address, and phone number.
• Account Information: Login details, authentication information, user roles, organisation membership, settings, preferences, and security records.
• Business Information: Trading name, legal structure, NZBN, GST number, business address, industry, financial year settings, GST filing settings, and other business profile details.
• Financial and Accounting Information: Bank account details, transaction data, categories, GST treatment, invoices, clients, assets, depreciation records, reports, notes, imports, approvals, business/private use settings, and other bookkeeping records you enter, import, connect, or generate.
• Files and Receipts: Receipts, invoices, PDFs, images, bank statements, supporting documents, file metadata, extracted text, and any information contained in files you upload.
• Payment Information: Billing address, subscription status, plan, invoices, payment history, and payment processor references. We do not store full card numbers where payments are processed by our payment provider.
• AI Preferences and Consent Records: Whether you have enabled AI features, when consent was given or changed, and related settings needed to respect your choices.

2.2 Usage Information

We automatically collect technical information about how you interact with our Services to help us improve your experience:

• Device Information: IP address, browser type, and operating system.
• Usage Data: Pages visited, features used, and time spent on our platform.
• Log Data: Access times, error logs, audit logs, security events, diagnostic data, and performance data.
• Cookies: We use cookies and similar technologies to enhance functionality. Please see our Cookie Policy for more details.

3. How We Use Your Information

We use your personal information for the following purposes:

• Service Provision: To provide, maintain, and improve our Services.
• Account Management: To create and manage your account and subscriptions.
• Financial Processing: To process your financial and accounting data, connect bank feeds where authorised, import transactions, store receipts, generate invoices, calculate reports, and deliver the tools and outputs you request.
• AI-Assisted Features: To provide AI categorisation, receipt extraction, import assistance, matching suggestions, and similar features only where you have enabled or consented to those features.
• Communication: To send you service updates, newsletters, and other important notices. You can opt out of marketing communications at any time.
• Support: To provide customer support and respond to your enquiries effectively.
• Security: To protect our Services and your information from fraud, abuse, malware, unauthorised access, and other security risks.
• Analytics: To analyse usage patterns, diagnose issues, improve reliability, and develop new features.
• Legal Compliance: To meet our legal and regulatory obligations in New Zealand.

We do not sell your personal information or business data.

4. Information Sharing and Disclosure

4.1 Third-Party Service Providers

We may share your information with trusted third-party service providers who assist us in areas such as:

• Cloud hosting, infrastructure, storage, backup, logging, monitoring, and security through Amazon Web Services.
• AI processing through Amazon Bedrock using Anthropic models where you have enabled AI features.
• Bank feed and open banking connections where you choose to connect an account.
• Payment processing, billing, subscription management, and invoice history.
• Customer support, transactional email, service communication, analytics, diagnostics, and fraud prevention.

We require service providers to use your information only for the services they provide to us, and to apply appropriate confidentiality, security, and privacy safeguards.

4.2 Connected Services You Authorise

If you connect a bank account, payment service, file import, or other integration, we may receive and process information from that provider as authorised by you. You can disconnect integrations where the Services provide that option, but we may retain information already imported where needed to provide the Services, preserve records, resolve disputes, meet legal obligations, or maintain backups.

4.3 Legal Requirements

We may disclose your information if required by law, regulation, or a valid legal process, such as:

• Compliance with court orders or government requests.
• Protection of our rights, property, or safety, and that of our users.
• Investigation of potential fraud or security issues.
• Enforcement of our Terms of Service.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you of any such change and outline your choices.

5. Data Security and Retention

We take the security of your data seriously and implement industry-standard measures to protect it, including:

• Encryption of data in transit (using TLS/SSL) and at rest.
• Secure server infrastructure hosted in reputable data centres.
• Malware and virus scanning for uploaded files where supported by the Services.
• Security monitoring, vulnerability management, and access review processes.
• Strict access controls and authentication measures.
• A data breach response plan. Where a notifiable privacy breach occurs, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, in accordance with the Privacy Act 2020.

No system can be guaranteed to be completely secure. You are responsible for using strong authentication, keeping your login details confidential, managing user access, and maintaining your own records where required for accounting, tax, audit, or legal purposes.

We retain your personal information and business data only for as long as necessary to provide our Services, comply with legal obligations, maintain security and audit records, resolve disputes, enforce agreements, and fulfil the purposes outlined in this policy. Deleted information may remain in backups, logs, or archives for a limited period before being securely deleted or overwritten.

6. Your Rights and Choices

Under the New Zealand Privacy Act 2020, you have the right to know what information we hold about you and to make certain requests. You have the right to:

• Access Your Information: Request confirmation of, and a copy of, the personal information we hold about you (Information Privacy Principle 6).
• Correct Your Information: Ask us to correct any information you believe is inaccurate, out of date, incomplete, irrelevant, or misleading (Information Privacy Principle 7).
• Request Deletion: Ask us to delete your personal information. The Privacy Act 2020 does not provide a general right to deletion, and we may need to retain certain information to meet legal, tax, audit, accounting, security, contractual, or record-keeping obligations. Where we are not required to retain information, we will delete it on request.
• Manage AI Preferences: Enable or disable optional AI features in your settings where available.
• Manage Integrations: Disconnect supported bank feeds and integrations where available.
• Marketing Choices: Opt out of marketing communications while still receiving important service, security, billing, and legal notices.

To exercise these rights, please contact our Privacy Officer using the details in the "Contact Us" section below. We may need to verify your identity and authority before actioning a request, especially where the request relates to an organisation, financial records, or another user's information. We will respond to access and correction requests within 20 working days of receiving them, in accordance with the Privacy Act 2020.

If you have concerns about how we are handling your information, you also have the right to make a complaint to the New Zealand Office of the Privacy Commissioner.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience and collect usage information. You can control cookie settings through your browser preferences. For more information, please see our Cookie Policy.

8. AI Processing

Some Moniaro features use optional AI assistance for tasks such as transaction categorisation, receipt extraction, import assistance, and matching suggestions. We ask for your permission before sending your data to AI features, and you can change your AI preferences in your settings.

If you enable AI features, the relevant transaction details, receipt content, file content, notes, categories, metadata, or other information needed to provide the feature may be processed through Amazon Bedrock using Anthropic models in the AWS Asia Pacific (New Zealand) Region, ap-southeast-6.

AI processing is used to provide suggestions and automation, not professional accounting, tax, financial, or legal advice. You should review AI outputs before relying on them. Disabling AI features stops new AI requests from being made for those features, but it does not automatically remove information already processed, stored in your account, retained in logs, or held in backups according to this policy.

9. Children's Privacy

Our Services are not intended for children under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected such information, we will take immediate steps to delete it.

10. Data Storage & International Transfers

Our primary data servers are hosted with Amazon Web Services (AWS) in the AWS Asia Pacific (New Zealand) Region, ap-southeast-6. This includes database, application, file upload, receipt storage, S3 object storage, AI processing through Amazon Bedrock where enabled, logging, backup, monitoring, and other AWS services required to operate Moniaro.

Some of our third-party service providers may operate in other countries or may provide support from other locations. Where we disclose personal information to a recipient outside New Zealand, we comply with Information Privacy Principle 12 of the Privacy Act 2020. This means we will only do so where the recipient is subject to comparable privacy safeguards (for example, through contractual protections, a recognised privacy framework, or a jurisdiction with comparable privacy law), or where another lawful basis applies.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on our website and updating the "Last updated" date. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact our Privacy Officer: