Privacy Notice

1. Who collects your personal information

KoruAI Trades Systems Limited (“we”, “us” or “our”) is the agency that collects personal information through the KoruAI Trades Systems service (“the Service”).

We are based in New Zealand and act as the controller for the personal information described in this notice.

If you want us to act on your behalf under the NZ Privacy Act 2020 — to access, correct, or delete records we hold about you — send a request to the privacy-contact address at the bottom of this page.

2. What /compare and the demo form capture

The /compare quote-draft tool: your selected trade (plumber | gasfitter | electrician | other), the free-text scope notes you paste in describing the job, your name, your email, and (behind the scenes) the request IP used to enforce a per-IP daily quota so the public tool stays free.

A UTM triplet (utm_source, utm_medium, utm_campaign) is read from the page URL when you arrive from a marketing campaign — for example a Meta ad click — so we know which campaign the lead came from. If you arrive without a campaign tag, those three columns stay empty.

The /compare demo-lead form (the “Send me this draft” panel): your name, your email, and the message you type. Submitting it triggers a founder-notification email to the operator at the address shown on the site footer.

The /contact form: name, email, and the message you type. Submitted via POST /api/contact and stored alongside other lead messages for the operator to action.

Cookies and analytics on this page are covered in section 7 below. Authentication-required surfaces (login, signup, dashboard) collect additional personal information under their own on-page notices.

3. Where the data is stored

Quote-draft submissions land in a row in the QuoteDraftFunnel table (schema: prisma/schema/quote-draft-funnel.prisma). /contact submissions land in a row in the ContactMessage table (schema: prisma/schema/contact.prisma). Both tables live in the Postgres database provisioned for this app and hosted on Polsia’s Render infrastructure.

Outbound email — the founder-notification fired by a fresh quote draft, the contact-form delivery, and every other transactional email — rides through the Polsia email proxy (src/lib/email/send.ts → POLSIA_EMAIL_BASE_URL). The proxy is the only path that delivers email; we never call a vendor SMTP service with a direct API key.

The per-IP daily quota on /compare, /contact, and the /api/tools/* checklists is held in an in-memory bucket keyed by the request IP. It is process-local: it is NOT persisted to the database and does not survive a server restart. It exists to keep the public tools available, not to identify you.

Backups of the Postgres database follow Polsia’s standard rolling backup schedule. A row removed on request will roll off the backups on the same window as the rest of the database.

4. How we use it for AI quote drafting

When you submit a /compare quote draft, your scope-notes text is sent to the Polsia AI proxy (src/lib/ai/client.ts → generateObject) as a single prompt under task = "quote_draft" using the model gpt-4o-mini. The model returns a structured draft — summary, line items, subtotal, and follow-up questions — that we render in the page.

No direct OpenAI or Anthropic API key is stored in this app and no third-party SDK runs from this codebase. Every LLM call goes through the platform proxy, which means the same code path runs in development and production and the platform meters the prompt on our behalf.

Your name and email are not sent to the language model — only the scope notes. We persist the AI’s reply (line items, summary, follow-up questions) on the funnel row alongside your name and email so the operator can pick up the lead; the raw prompt text is not stored.

5. How long we keep it

A new /compare submission lands with status = "new". It stays in that state until the operator reviews the inbox at /admin/quote-drafts, sends a quote (status → "emailed"), and closes it out as won or lost. There is no automatic expiry step: retention is operator-driven. Operator-driven deletion within 20 working days of a Privacy Act request is the formal backstop (see section 6).

A /contact submission is stored in the ContactMessage table with the timestamp of receipt and is held until the operator triages and (if asked) deletes it. There is no automatic TTL on the row either.

Billing records created when you sign up for a paid plan are kept for at least 7 years to meet NZ Inland Revenue record-keeping obligations.

If you would like a record removed sooner than the operational default, send a request to the privacy-contact address at the bottom of this page

6. Your rights under the NZ Privacy Act 2020

Information Privacy Principle (IPP) 6 — access: you can ask for a copy of the personal information we hold about you. We will reply with what is on file for the identifier you provide (most commonly an email address).

IPP 7 — correction: you can ask us to correct any information that is wrong or misleading.

IPP 8–12: you can ask us to be more accurate in how we use your information, to be more careful about how we store it, to be more transparent, and to be more accountable for how we handle it. You can also raise concerns about how we handle your information.

IPP 13 — deletion on request: where IPP 6 / 7 don’t apply, you can still ask us to delete a record you previously submitted. We confirm scope before deletion so we don’t over-delete.

We respond to all of the above within 20 working days as required by the Privacy Act 2020. If you are not satisfied with our response you can complain to the Office of the Privacy Commissioner at www.privacy.org.nz.

7. Cookies and tracking on the marketing site

We use the Meta Pixel (src/components/custom/meta-pixel.tsx) on our marketing pages to measure how paid Meta advertising drives visits. Meta uses that signal under their own privacy policy and they receive a small set of page-view events when you land on the site.

On the authentication and dashboard surfaces we use session cookies so you stay signed in. Those cookies are essential to the Service and cannot be removed without breaking the session.

We do not sell personal information, and we do not share it for third-party direct marketing. The marketing-site data we hold stays with us and the service providers listed in section 3.

You can block or remove cookies through your browser settings; some Service features may not work if essential session cookies are disabled.

8. Data location and cross-border transfers

The Postgres database that holds QuoteDraftFunnel and ContactMessage rows is hosted on Polsia’s Render infrastructure, which runs in an overseas region to the visitor but inside Polsia’s managed-cloud tenancy.

Some of our service providers — Polsia’s email proxy, the Polsia AI proxy, Stripe for payments — process personal information outside New Zealand. Where information leaves NZ we take reasonable steps to ensure it is handled in accordance with IPP 11 (disclosure) of the NZ Privacy Act 2020.

If you choose to share personal information with a third party through the Service — for example by emailing a quote draft to your own customer — that information flows under your instructions and on your behalf, not ours.

9. Updates to this notice

We may update this Privacy Notice from time to time. The “Last updated” date at the bottom reflects the current version.

For material changes we will give you reasonable notice by email (using the address on file) and/or by an in-app or on-site notice before the change takes effect.