PRIVACY POLICY
Last updated: [DATE]
1. Who we are
Komplylab ("we", "us", "our") provides a compliance and asset management software platform for industrial organisations in New Zealand and Australia, accessible at komplylab.com (the "Service"). This policy explains how we collect, use, store, and protect personal information when you use the Service.
[CONFIRM: legal entity name, NZBN/company number, registered address]
2. Information we collect
When you or your organisation uses Komplylab, we collect:
Account information: name, email address, and organisation details, provided when you or your organisation signs up (via our authentication provider, Clerk) Billing information: processed directly by our payment provider, Stripe — we do not store your full card details ourselves Compliance and operational data you enter: asset records, inspection results, incident reports, contractor details, risk assessments, and similar information your organisation chooses to record in the Service Team member information: names, email addresses, roles, and (where applicable) licence/qualification records entered by your organisation for its own team management purposes Usage information: standard technical logs (IP address, browser type, pages visited) collected automatically to help us maintain and improve the Service 3. How we use this information
We use personal information to:
Provide and operate the Service, including compliance tracking, alerts, and reporting features your organisation has enabled Process payments and manage subscriptions Send you service-related emails, including compliance reminders, billing notices, and account communications Respond to support requests Maintain the security and integrity of the Service Comply with our own legal obligations
We do not sell personal information to third parties.
4. Who we share information with
We share information with the following third-party service providers, each of which processes data on our behalf under their own privacy and security terms:
Provider Purpose Clerk User authentication and account management Stripe Payment processing and subscription billing Supabase Database hosting and storage Resend Transactional email delivery (reminders, notifications) Vercel Application hosting
[CONFIRM: any additional sub-processors, and whether any data is transferred outside NZ/Australia — several of the above providers may process data on servers outside NZ, which has specific disclosure requirements under the Privacy Act 2020]
We may also disclose information if required by law, or to protect the rights, safety, or property of Komplylab or others.
5. Data retention
Data associated with your organisation's account is retained for the duration of your active subscription. If a subscription lapses (through cancellation or payment failure), your organisation's data is retained for up to 90 days to allow for reactivation, after which it may be permanently deleted from our systems.
[CONFIRM: this matches the actual 90-day retention/soft-delete pipeline built into the platform]
6. Your rights
Under the Privacy Act 2020 (New Zealand), individuals have the right to:
Request access to personal information we hold about them Request correction of inaccurate personal information Make a complaint to the Office of the Privacy Commissioner if they believe their information has been mishandled
To exercise these rights, contact us at [CONFIRM: privacy contact email].
[CONFIRM: whether equivalent rights disclosures under Australian Privacy Principles are needed for Australian customers]
7. Security
We take reasonable technical and organisational measures to protect personal information, including encryption in transit, access controls, and tenant data isolation between organisations using the Service. No system is completely secure, and we cannot guarantee absolute security.
8. Children's information
The Service is intended for business use by adults. We do not knowingly collect personal information from children.
9. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated to account administrators.
10. Contact us
[CONFIRM: contact email/address for privacy inquiries]