Privacy Policy

Overview

Nexxis ("we", "our", or "us") operates a document review service for New Zealand building consent documentation at https://nexxis.co.nz. This Privacy Policy explains what personal information we collect, how we use, store, and disclose it, and the choices and rights you have. We handle personal information in line with the New Zealand Privacy Act 2020 and its information privacy principles. If you have any questions, our privacy officer, Lee McKenzie, can be reached at hello@nexxis.co.nz.

Information We Collect

We collect the following types of information:

Account Information: Your name, email address, and (optionally) your company or practice name when you create an account. Passwords are stored only as cryptographic hashes. If you sign in with Google, we receive your name, email address, and profile photo from Google.
Documentation: Building consent documents you upload for review, and the reports we generate from them.
Billing Information: Payments are handled by Stripe. We store transaction records (customer and payment identifiers, amounts, currency, and billing status) but never your full card number or card security code, which go directly to Stripe.
Technical and Usage Information: When you use the service we record your IP address, browser and device type, operating system, pages visited, referring page, session identifiers, and sign-in history.
Security and Audit Records: An append-only log of significant account activity (such as sign-ins and report generation), including the IP address and browser involved, kept to protect accounts and investigate security incidents.
Correspondence: Messages you send to our support or contact addresses.

Personal Information About Other People

Building consent documentation can contain personal information about people other than you — for example property owners, clients, neighbours, or other project parties. Where we receive that information indirectly through your upload, we use it solely to carry out the document review you requested. We do not use it for any other purpose, contact those individuals, or disclose it except as described in this policy. By uploading documents, you confirm that you are entitled to share them with us, and we ask that you take reasonable steps to make the people concerned aware that their information will be handled by Nexxis as described in this policy, consistent with information privacy principle 3A of the Privacy Act 2020.

How We Use Your Information

Your information is used to:

Provide the document review service and generate reports
Operate your account and send service emails (such as email verification, password resets, sign-in codes, review completion or failure notices, and payment receipts)
Process payments and maintain billing records
Understand how the product is used, in order to improve it (see Analytics and Error Monitoring below)
Detect, investigate, and prevent security incidents, fraud, and misuse
Meet our legal obligations

We do not sell personal information, and we do not use your documents for advertising or share them with third parties for marketing or commercial purposes.

Third-Party Services

We use third-party service providers to operate the service. They process information on our behalf and only to provide services to us:

AI Processing (Google Vertex AI): Your documents are analysed using Google's Vertex AI platform. Document content is sent to Vertex AI for inference only and is not used to train Google's models.
Cloud Storage (Google Cloud Storage): Uploaded documents and generated reports are stored in Google Cloud Storage with encryption at rest and in transit.
Database (Neon): Account information, project metadata, and report data are stored in a Neon PostgreSQL database with encryption at rest.
Hosting (Vercel): The application is hosted on Vercel, which processes requests to serve the site.
Payments (Stripe): Payments are processed by Stripe. We do not store your full payment card details.
Email Delivery (Resend): Service and account emails are delivered through Resend.
Error Monitoring (Sentry): We use Sentry to capture application errors so we can fix them. See Analytics and Error Monitoring below.

Analytics and Error Monitoring

We collect usage and diagnostic information to understand how the product performs and to fix problems:

First-party usage records: We record page views, referrers, and device, browser, and operating system type in our own database. Product event records (such as "report exported") are stored against an internal account identifier and deliberately exclude your email, name, IP address, and browser details.
Vercel Analytics: Aggregated, first-party page analytics served from our own domain.
Google Analytics: When enabled in production, Google Analytics measures page views and product events and sets its own cookies. Google may process this data on its own infrastructure.
PostHog: When enabled, we use PostHog for anonymous product analytics. It is configured without individual profiles, without session recording, and it honours your browser's Do Not Track setting.
Sentry: When an error occurs, Sentry may capture a replay of the page interactions leading up to it to help us diagnose faults. Replays are configured to mask all text and block media, so document content and form input are not readable in them.

Where Your Information Is Stored

Our service providers store and process information on infrastructure located outside New Zealand, primarily in the United States (including Google Cloud, Neon, Vercel, Stripe, Resend, and Sentry). These providers hold and process information only as our agents, for the purpose of providing their services to us, and do not use it for their own purposes except as described above. The Privacy Act 2020 continues to apply to personal information we hold this way, and we remain responsible for it. We use providers that apply encryption in transit and at rest and contractual data protection commitments.

Document Security

We take the security of your building consent documentation seriously. All uploaded documents are encrypted in transit and at rest, access is restricted to your account and to the systems that perform the review, and significant actions are recorded in an audit log. Documents are processed for the review you request and are not shared with third parties for marketing or commercial purposes, and are not used to train AI models.

Data Retention

We keep personal information only as long as it is needed for the purposes described in this policy:

Account information: Retained while your account is active.
Documents and reports: Retained until you delete the project they belong to, or your account is deleted.
Product usage events: Retained for approximately 12 months.
Security and audit logs: Retained for up to 7 years to support security investigation and record integrity.

You can delete individual projects, and the documents in them, from within the app at any time. To request deletion of your account and associated personal information, contact us at hello@nexxis.co.nz. We will action deletion requests unless we need to retain specific records for security, billing, or legal reasons, in which case we will tell you what is retained and why.

Marketing Communications

If you subscribe to updates or agree to receive them, we may send you marketing emails about Nexxis. Every marketing email includes an unsubscribe link, and you can opt out at any time. Service emails about your account, reviews, and payments are not marketing and are sent as part of operating the service.

Your Rights

Under New Zealand's Privacy Act 2020, you have the right to:

Request access to the personal information we hold about you (information privacy principle 6)
Request correction of personal information you believe is wrong (information privacy principle 7)

You can also ask us to delete your personal information (see Data Retention above) and unsubscribe from marketing emails at any time. To exercise any of these rights, contact us at hello@nexxis.co.nz. We will respond as soon as practicable and within 20 working days, as the Act requires.

Notifiable Privacy Breaches

If a privacy breach occurs that is likely to cause serious harm to anyone whose information is involved, we will notify the Office of the Privacy Commissioner and the affected individuals as soon as practicable, as required by Part 6 of the Privacy Act 2020.

Privacy Complaints

If you believe we have breached the Privacy Act 2020, you have the right to make a complaint to the Privacy Commissioner. You can contact the Privacy Commissioner at privacy.org.nz or by calling 0800 803 909. We encourage you to contact us first at hello@nexxis.co.nz so we can address your concerns.

Cookies

We use a small number of cookies and similar technologies:

Essential cookies: A sign-in cookie that keeps you logged in (up to 7 days), a session cookie used to operate the site and record first-party usage (24 hours), and short-lived cookies used during two-factor authentication and Google sign-in.
Analytics cookies: Google Analytics sets its own cookies when it is enabled. Vercel Analytics runs from our own domain.
Preferences: Your theme choice is kept in your browser's local storage.

We do not use third-party advertising cookies or ad-targeting trackers. You can control or delete cookies through your browser settings, although blocking essential cookies will prevent you from staying signed in.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or through a notice on our website, and the "Last updated" date above will always show the current version.

Contact Us

If you have questions about this Privacy Policy, want to exercise your rights, or wish to raise a privacy concern, please contact our privacy officer, Lee McKenzie, at hello@nexxis.co.nz.