Trust at Jaspyr

Privacy policy

Jaspyr AI Limited, a New Zealand company, provides software that connects information across our customers' systems and supports search, analytics and workflows. This policy explains how we handle personal information when you visit our website, contact us or use our services. It also explains how we process personal information for our customers.

We handle personal information under New Zealand's Privacy Act 2020. Contact our Privacy Officer at privacy@jaspyr.ai with questions, requests or complaints.

Our responsibilities and our customers' responsibilities

We handle account information, business contacts, correspondence and operational records to run our own business and service. Jaspyr is responsible for that information.

When a customer connects its systems or submits information for processing, we generally act on that customer's instructions. For information held solely on the customer's behalf, the customer is treated as holding the information under the Privacy Act. The customer determines the permitted purposes and is usually responsible for telling individuals about the collection and responding to their privacy requests. The actual arrangement and use of the information determine these responsibilities.

If your information is in a council's or another customer's records, its privacy notice also applies. You can contact that organisation first or contact us for help identifying the appropriate organisation. Customer agreements set out service-specific instructions and commitments. They do not remove rights or obligations under the Privacy Act.

What information we handle and where it comes from

• Account and sign-in information, including names, email addresses, account identifiers, organisation membership, authentication settings and sign-in events. This comes from users, customer administrators and, where configured, the customer's identity provider.
• Business contact and correspondence information, including names, roles, work contact details, enquiries and support messages. You, your organisation or another business contact may provide this information.
• Customer content from connected systems and information uploaded or entered by authorised users. Depending on the customer's use, this may include contact details, addresses, locations, service requests, project or matter records, documents, attachments and information about staff or other people.
• AI inputs and outputs, including questions, instructions, documents, relevant information retrieved from connected systems, generated answers and records of model usage. These may contain personal or sensitive information present in the source material.
• Technical and security information, including IP addresses, user and organisation identifiers, request metadata, access events, errors and audit records generated when the website or service is used.

We collect information for lawful purposes connected with our business or the service requested by the customer, and only where it is necessary for those purposes. Please avoid supplying personal information that is unnecessary for your enquiry or task.

You can choose whether to contact us or provide information. If you withhold information needed to answer an enquiry, create an account or deliver a requested feature, we may be unable to do so. Our ordinary account and enquiry collection is voluntary rather than required by a specific law. If a particular collection is authorised or required by law, the relevant collection notice will identify that law and explain what is required.

Information we receive from someone else

We may receive information about you from your employer, a customer administrator, another business contact or a system that a customer connects. For example, an administrator may create your user account, or a customer may ask us to process a service request containing your contact details.

Where Jaspyr is responsible for an indirect collection, we take reasonable steps to tell you about it as soon as reasonably practicable, unless you already know the required details or a Privacy Act exception applies. That notice identifies the collection, its purpose, intended recipients, the collecting and holding organisation and its contact address, any law authorising or requiring the collection, and your access and correction rights. Where we act solely on a customer's behalf, the customer is responsible for the applicable collection notice.

Why we use personal information

We use personal information to provide and support the services our customers request, manage accounts and access, respond to enquiries, communicate about the service and manage business relationships. We also use necessary operational information to protect the service, investigate incidents, maintain audit records and meet applicable legal obligations.

We use information for the purpose for which it was collected, a directly related purpose, or another purpose permitted by the Privacy Act. We do not sell personal information or use customer content for unrelated advertising.

How our AI features use information

Our AI features can process a user's question or document together with relevant context retrieved from the customer's connected systems. The model may therefore receive personal information contained in that material. We do not automatically remove every personal detail before a model processes it.

The AI route depends on the customer's configuration. Some customers use Anthropic Claude models through Amazon Bedrock in Australia. Other customers use direct Anthropic or OpenAI services with their own provider accounts and API keys. OpenAI may also process document or question text to create search embeddings where that feature is enabled. Address lookup uses Amazon Location Service where enabled.

We do not use customer personal information to train or fine-tune AI models. When a customer selects a direct provider, that provider's handling of information, including retention and any permitted use, depends on the customer's provider terms and account settings. The customer's choice of a provider does not remove applicable privacy obligations.

We keep protected records of model requests and responses for service operation, usage accounting and customer audit purposes. These records are separate from any copies the AI provider retains. AI outputs may contain errors. Please contact us or the responsible customer if an output contains inaccurate personal information about you.

Service providers and other recipients

Authorised Jaspyr personnel and service providers may handle information where needed for the purposes described in this policy. The main providers and customer-selected services are set out below. Not every service applies to every customer.

We require providers acting on our behalf to protect information and handle it for the agreed purposes. We may also disclose information to professional advisers where necessary, to recipients you authorise, or where the Privacy Act or another law permits or requires disclosure. Customer content is made available within the service according to the customer's authorised access and workflows.

Storage and processing outside New Zealand

Our core production hosting is in Australia. Other providers and customer-selected integrations may process information in the United States or other countries, as described above. An Australian hosting location does not mean that every configured service processes information only in Australia.

Where an overseas provider acts solely as an agent, we remain responsible for the information we hold through that provider and for reasonable security safeguards. Where an arrangement is an overseas disclosure covered by information privacy principle 12, it must meet that principle's requirements, such as comparable safeguards or another lawful basis. A customer's selection of a provider is not, by itself, informed authorisation from every affected individual.

Customers with specific location requirements should agree the permitted services, regions and access arrangements with us before enabling processing.

How we protect information

We use access controls, encrypted connections, encryption of production data stores and backups, protected credentials and security logging. Additional encryption protects certain personal fields, integration credentials and model audit content. Authorisation checks restrict access by organisation and the user's permissions. Security measures depend on the information and service involved.

If a privacy breach causes or is likely to cause serious harm, we notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, as required by law and subject to applicable exceptions. For information held solely for a customer, we support that customer's response and meet applicable customer notification commitments.

Retention and deletion

Retention depends on the purpose of the information, the service configuration and applicable legal requirements. Customer content is subject to the customer's lawful instructions and agreed retention arrangements. Business correspondence and operational records are kept for the purposes for which they may lawfully be used. We must not retain personal information longer than necessary for a lawful purpose.

Core automated database and volume backups have a 30-day retention cycle. Application and access logs are generally retained for 365 days, and the main cloud audit trail for 400 days. Files, analytics data and model audit records have separate retention settings. These periods do not mean that all copies of a record disappear immediately when a user deletes it.

Where deletion is appropriate, it may involve removing active records, expiring stored copies or deleting encryption keys so protected content becomes unreadable. Some historical event records remain after particular personal fields have been made unreadable. Offboarding a customer does not automatically delete every platform user account or every operational record. We can explain the applicable process and any retained copies in response to a request.

Copies held in customer source systems, recipients' mailboxes or customer-contracted AI accounts are subject to those organisations' arrangements.

Website information

When you visit our website, our hosting service may process your IP address and standard request information to deliver and protect the site. If you email us through a website link, we receive the information you include in your message. The signed-in platform separately processes account, authentication and usage information as described above.

Your access and correction rights

You can ask whether we hold personal information about you, request access to it and ask us to correct it. Contact privacy@jaspyr.ai and describe the information or service involved. We may need to verify your identity or the authority of someone acting for you.

Where we are responsible for the request, we decide and notify you as soon as reasonably practicable and within 20 working days after receiving it, unless a lawful extension applies. If we extend the time, we tell you within the original period, explain why and give the revised timeframe and your right to complain. Identity checks do not restart the response period. If we grant access, we provide it without undue delay.

If we refuse access or correction, we explain the reason and your complaint rights as required by law. If we do not make a correction you request, you can ask us to attach a statement of correction to the information. So far as reasonably practicable, we inform previous recipients when we correct information or attach a statement.

If the information is held solely on a customer's behalf, we help route the request to the responsible organisation. You can also ask about deletion. We assess deletion requests against the purpose, applicable law and customer arrangements. The Privacy Act does not provide a general right to require every record to be erased.

Complaints and contact

Contact our Privacy Officer if you are concerned about how we have handled your information or a request. You can also complain to New Zealand's Office of the Privacy Commissioner.

Changes to this policy

We review this policy annually and when our processing materially changes. We publish updates with their effective date and version. Where a change requires a separate collection notice, customer communication or authorisation, we address that separately. Publishing this policy does not replace those obligations.