Privacy policy

1. Two different kinds of information

It matters which one we are talking about, because our role differs.

Information about you, our customer. If you contact us or sign up, we collect your name, email address, company, website address and whatever you put in your message, plus the account and billing details needed to run your subscription. We decide how this is used, so we are the agency responsible for it.

Information about your customers. When Aiva answers enquiries for your business, it handles personal information belonging to the people contacting you: names, contact details, order history, and the conversations themselves. That information is yours. We hold and process it on your instructions, to provide the service, and for nothing else.

2. What this website collects

Only what you type into the enquiry form: name, email address, company, website address and your message. We use it to reply to you and to follow up about Aiva.

This website sets no tracking cookies, runs no analytics or advertising pixels, and does not build a profile of your visit. That is also why you are not being asked to dismiss a cookie banner.

3. Where it is held

In New Zealand, on encrypted storage. Off-site backups are encrypted before they leave the country, in a way that leaves them unreadable to the storage provider. Our security and data handling page explains this properly.

4. Who else sees it

A small number of suppliers help us run the service, including infrastructure, messaging and payment providers, and the AI models that generate Aiva’s replies. They may only use the information to provide their service to us.

We do not sell personal information. We do not share it with other Aiva customers. We do not use your customers’ conversations to train models for anyone else’s benefit.

We will disclose information if the law requires it, and will tell you when we are permitted to.

5. Automated replies

Aiva generates replies automatically. It identifies itself as an AI assistant, and it offers a route to a human at any point. It does not make decisions with legal or similarly significant effects on a person by itself, and anything consequential is put in front of a person before it happens.

6. Marketing and opt-outs

We only send marketing where there is a lawful basis for it, and every message has a working unsubscribe. Aiva honours an opt-out immediately and permanently, across every channel it runs. This applies to your customers as much as to you, and it is enforced by the software rather than left to good intentions, because the Unsolicited Electronic Messages Act 2007 does not accept good intentions as a defence.

7. How long we keep it

For as long as we are providing the service, and afterwards only as long as we need it for the purpose it was collected for, or as the law requires. After that it is deleted. Deletion works through to our backups as those age out on their retention cycle.

8. Your rights

Under the Privacy Act 2020 you can ask what personal information we hold about you, ask for a copy, and ask us to correct it if it is wrong. Email get@aiva.nz and we will respond within 20 working days.

If one of your customers makes a request about information Aiva holds for you, tell us and we will help you answer it. The request is properly directed to you, because that information is yours.

9. If something goes wrong

If a breach affects personal information we hold, we will tell the people who need to know promptly, and notify the Office of the Privacy Commissioner where the Act requires it.

10. Complaints

Come to us first, at get@aiva.nz. If we cannot resolve it, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

11. Changes

If we change this policy we will update the date at the top. If a change materially affects how we handle your information, we will tell you rather than rely on you noticing.