Privacy Policy

Last Updated: October 2025

1. INTRODUCTION

This Privacy Policy explains how Bundle Holding Limited ("Bundle", "we", "us") collects, uses, and protects your personal information when you use our property documentation and management service.

By using Bundle, you agree to the collection and use of information as described in this Policy.

"Owner" means a person who controls a Bundle Account for a property they own. "Professional" means a person or entity using Bundle in a business capacity for a property they do not own. "Archive Copy" means the copy of a property record created on transfer under the Professional's account (see Terms of Service §4.2A/§7).

2. INFORMATION WE COLLECT

2.1 Information You Provide

Account Information: Name, email address, phone number, password
Property Information: Property addresses, details, and all documentation you upload
User Content: Documents, photos, notes, and any other content you add to Bundle
Communications: Messages and other interactions between us
Archive Copy Information: content duplicated at the moment of a Professional-to-Owner transfer. Archive Copies are stored independently under the Professional's account.

2.2 Information Collected Automatically

Usage Data: Features used, actions taken, time spent, search queries
AI Interactions: Questions you ask and how you interact with AI features
Device Information: IP address, browser type, device type, operating system
Log Data: Access times, pages viewed, errors encountered
Guest Access Logs: (name, email, timestamps and IP address, where available)

2.3 Google Authentication

If you sign in with Google, we receive your basic profile information (name and email) from Google.

2.4 Indirect Collection (Guests)

If you invite a guest, we receive their Personal Information (for example, name and email) from you for the purpose of providing guest access. We will present guests with our Terms of Service and this Privacy Policy when they access a Property Account so they can understand how their information will be processed. Guests, by accepting access, also agree that their information may be processed by our service providers for the purposes described in this Policy.

You do not have to provide us with the personal information we request but if you do not then we may be unable to provide you with all or some of our services.

3. HOW WE USE YOUR PERSONAL INFORMATION

We use your information to:

Provide and maintain Bundle's services
Process and respond to your AI queries about your property
Generate maintenance recommendations and insights
Improve and develop new features
Process payments and manage subscriptions
Ensure security and prevent fraud
Comply with legal obligations
Communicate with you about the Service (including important service notifications and security alerts)
Marketing communications (only with your consent; you can withdraw at any time)

4. HOW WE SHARE YOUR PERSONAL INFORMATION

4.1 We Don't Sell Your Data

We never sell your personal information to anyone.

4.2 Service Providers

In providing our services, we generally act as a service provider/processor on behalf of account holders. For certain limited purposes (such as maintaining security, complying with law, or generating anonymised analytics), we act as the agency/controller.

We also use third-party service providers ("sub-processors") who help us operate Bundle, including:

Cloud hosting and storage (e.g. Amazon Web Services)
Application hosting and databases (e.g. Render)
Web application hosting and content delivery (e.g. Netlify)
AI processing (e.g. OpenAI, for language model queries)
AI processing and optical character recognition (OCR) (e.g. OpenAI for language model queries; Google Gemini for document text extraction – used for inference only, not training of models).
Payment processing (e.g. Stripe)
Email delivery (e.g. Postmark)
Logging, search, and analytics (e.g. Elastic Cloud)
In-memory caching (e.g. Upstash)

Most of these providers currently host data in the United States. All service providers are contractually required to protect your information and may only use it to deliver the services we have engaged them for. We may add or change service providers as our platform evolves. We'll update this section when we do.

4.3 Guest Access

You can share access to property information (which may include your personal information) via email or QR codes you generate.

4.4 Account Transfers

When you transfer account ownership, property information (which may include your personal information) transfers to the new Owner. When a Professional transfers a property to its Owner, Bundle also creates an Archive Copy of the property as it existed at that time. The Archive Copy remains under the Professional's account and is stored separately from the new Owner's property. Each copy can be viewed or updated by its respective holder, but changes in one copy do not affect the other. Bundle maintains minimal metadata linking the two for auditing and traceability purposes, but property content is not shared between them. Archive Copies remain visible only to the originating Professional and are not accessible to property Owners or other users without explicit consent. Professionals are responsible for deleting Archive Copies when no longer required for their legal/record-keeping obligations.

For Archive Copies, the Professional is the agency/controller for personal information they retain; Bundle processes that information on their behalf.

Archive Copies are treated as independent property records. Professionals may use Bundle's standard guest access tools to share them, subject to the same access logging and privacy safeguards described elsewhere in this Policy.

4.5 Legal Requirements

We may disclose information when required by law, court order, or to protect:

Our legal rights
The safety of users or the public
Against fraud or security threats

4.6 Business Transfers

If Bundle is acquired or merged, your information may transfer to the new owner. We'll notify you before this happens.

5. DATA RETENTION

Active accounts: We retain your data while your account is active
User-initiated deletions: You can delete items at any time from within your account. Deletions are permanent. Guests cannot delete data. Guests may add their own contributions, which account owners may also delete. If you intend to keep records for the next owner, do not delete them.
Closed accounts: At your request, we delete your account and personal data within 30 days, but believe this is unfortunate as property records may be needed later by future property owners. Deleted data may persist briefly in encrypted backups maintained by our providers, until those backups expire, but these are not accessible during normal operations. If you have already transferred a property, its record continues for the new owner.
Inactive/Orphan accounts: We reserve the right to delete or anonymise data from accounts with no verified contact details, unclaimed transfers, unpaid fees, or no activity for 12 months, after giving 30 days' notice.
Anonymized data: We may retain anonymised analytics indefinitely to improve our services.
Legal obligations: Some data may be retained longer if required by law (e.g. transaction records, builder statutory obligations).
Audit trail: We may retain limited logs or records if required by law or for security, fraud prevention or auditing.
Archive Copies: When a Professional transfers a property to an Owner, the resulting Archive Copy is retained under the Professional's account for long-term record keeping obligations until deleted. Archive Copies are subject to the same deletion and anonymisation rules as all other data within that account.
Linked metadata: Minimal identifiers linking Archive Copies to their originating property may be kept for audit and security purposes.

6. DATA BREACHES

If a privacy breach occurs that poses a risk of serious harm, we'll notify affected users and, where required, the Office of the Privacy Commissioner in accordance with the Privacy Act 2020.

7. YOUR RIGHTS AND CHOICES

7.1 Access and Correction

You can access and update your information through your Bundle account or by contacting us. If you need a copy of your information, contact support@mybundle.app and we'll assist (export may be a manual process at this time).

7.2 Account Closure

You can request account closure and data deletion. While we believe property records have long-term value for all future owners, we respect your right to deletion. Contact us at support@mybundle.app to discuss your options.

7.3 Marketing Communications

You can opt-out of marketing emails you have opted in to using the unsubscribe link or contacting us.

7.4 Cookies

Most browsers allow you to control cookies. Disabling cookies may limit some Bundle features.

8. INTERNATIONAL DATA TRANSFERS

Some of our current sub-processor service providers (for example, cloud hosting, AI processing, and payment providers) process information outside New Zealand, including in the United States. We take reasonable steps to ensure these providers protect your information and only use it to deliver the services we have engaged them for. These steps may include contractual safeguards consistent with international data transfer requirements.

9. NEW ZEALAND PRIVACY ACT

You have rights under the Privacy Act 2020:

Right to access your personal information
Right to request correction of errors
Right to complain to the Privacy Commissioner

We act in accordance with the Information Privacy Principles under the Act.

If you access the Service from outside New Zealand, you are responsible for complying with local laws.

10. CHANGES TO THIS POLICY

We may update this Policy occasionally. We'll notify you of material changes via email or Service notification. Your continued use after changes means acceptance.

11. CONTACT US

For privacy questions or to exercise your rights contact our Privacy Officer at:

Email: privacy@mybundle.app

Address: Bundle Holding Limited

For complaints, you may also contact:

Office of the Privacy Commissioner