Privacy Policy

SYSTEMISE LIMITED ("Systemise", "we", "us") is a New Zealand company and the agency responsible for the personal information described in this policy.

• NZBN 9429046774125
• Registered address 47 Oaklea Lane, RD 3, Hamilton 3283, New Zealand
• Privacy contact [email protected]

We handle personal information in accordance with the Privacy Act 2020 and its Information Privacy Principles.

Systemise is job management software for trade and service businesses. Most of the information in a Systemise account is entered by our customers about their business, their staff and their clients. Where we hold that information on a customer's behalf, the customer is the agency responsible for it and we act as their service provider.

Account information

When you or your employer creates a Systemise account we collect your name, email address, phone number, the business you belong to, your role and permissions, and a securely hashed password.

Business data you enter

Systemise stores the operational records you create: contacts and clients, sites and addresses, quotes, jobs, appointments and schedules, notes, purchases and supplier records, receipts, invoices and payment records. These records frequently contain personal information about your clients and staff. You control what goes in.

What the mobile app asks for

Each permission below is optional, is requested only at the point it is used, and declining one disables that feature rather than the app.

• Location Job navigation and recording where work was carried out. Sent to us when attached to a job. The app requests background location so a job can be located while you work.
• Camera Photographing job sites and receipts. Sent to us when attached to a job.
• Photo library Attaching existing photos to a job. Only the photos you select are sent.
• Saving to your photo library Keeping your own copy of a photo you capture. Nothing is sent to us.
• Files and documents Attaching documents to a job. Only the files you select are sent.
• Notifications Job and schedule alerts. We receive a device token only.
• Face ID, Touch ID and biometrics Unlocking the app. This never leaves your device.

Biometric data is handled entirely by your device's operating system. Systemise receives only a success or failure result; we never see, receive or store your fingerprint or face data.

Diagnostic and usage information

We collect crash reports, error diagnostics, device model, operating system version and app version so we can fix faults. We also keep server access logs containing IP addresses and request metadata.

What we do not collect

We do not collect your contacts list, your calendar, your microphone, your call history, your SMS messages, or your browsing activity on other sites. We do not sell personal information, and we do not use your data to train machine learning models.

We use personal information to:

• Run the service Provide, operate and support Systemise.
• Keep you secure Authenticate you and protect your account.
• Take payment Process your subscription.
• Sync integrations Exchange data with services you have connected, such as Xero.
• Support you Respond to the requests you send us.
• Fix faults Diagnose errors and improve reliability.
• Keep you informed Send service and billing notices.

We rely on your consent for optional device permissions, and on the performance of our contract with you for everything necessary to run the service. We do not use your business data for advertising.

We do not sell personal information. We share it only with the service providers below, each bound to use it solely to provide their service to us.

• Amazon Web Services Application hosting, database and file storage, in Australia.
• Amazon SES Sending service and notification email, in Australia and the United States.
• Sentry Crash and error diagnostics, in the United States.
• Stripe Subscription payment processing, in the United States.
• Xero Accounting sync, in Australia and New Zealand, and only if you connect it.
• Cloudflare Website delivery and security, across a global edge network.

We also disclose information where the law requires it, where it is necessary to prevent a serious threat to safety, or to enforce our terms.

Subscription payments are processed by Stripe. Systemise never receives or stores your full card number.

Your Systemise data is stored in Australia, in Amazon Web Services' Sydney region. Some of our service providers, listed above, process information in the United States.

This means your personal information is disclosed outside New Zealand. Under Information Privacy Principle 12 of the Privacy Act 2020 we only do this where the receiving provider is subject to privacy safeguards comparable to those in the Act. Australia's Privacy Act 1988 provides comparable safeguards, and our United States providers are contractually bound to equivalent protections.

By using Systemise you acknowledge that your information is stored and processed outside New Zealand.

• Account and business data, while active Kept for the life of the account.
• Account and business data, after cancellation Deleted 90 days after cancellation.
• Items you delete in the app Recoverable for 30 days, then permanently purged.
• Encrypted backups Purged within 35 days of deletion.
• Our own billing and tax records Kept 7 years, as the Tax Administration Act 1994 requires.
• Crash and error diagnostics Kept 90 days.
• Server and access logs Kept 90 days.
• Support correspondence Kept 2 years.

Export your records before you cancel

This matters. New Zealand businesses must keep invoices, receipts and GST records for seven years under the Tax Administration Act 1994. That obligation is yours and it survives the closure of your Systemise account.

We delete your data 90 days after cancellation. Export everything you need before that window closes, because once deleted we cannot recover it. If you need help exporting, contact us before you cancel and we will assist.

You can request deletion of your account and all associated personal information at any time.

To request deletion, email [email protected] from the address on your account, stating that you want your account and data deleted. We will confirm your identity, tell you what will be deleted, and complete the deletion within 30 days.

If you are an employee on a business account, your employer controls that account. We will refer your request to them and let you know we have done so.

Two things survive deletion: our own billing and tax records, which we are legally required to keep for seven years, and anonymised statistics that cannot identify you.

Under the Privacy Act 2020 you have the right to:

• Access the personal information we hold about you.
• Correct it if it is wrong.
• Request deletion, as described above.
• Complain if you believe we have mishandled your information.

To exercise any of these, email [email protected]. We will respond within 20 working days.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner at privacy.org.nz, or on 0800 803 909.

We protect your information with encryption in transit and at rest, hashed passwords, role-based access controls that limit what each user in a business can see, revocable per-device sessions you can terminate at any time, and short-lived access tokens.

On mobile, authentication credentials are held in the device's hardware-backed keystore — the iOS Keychain and the Android Keystore — not in ordinary app storage.

No system is perfectly secure. If a privacy breach occurs that is likely to cause serious harm, we will notify affected people and the Office of the Privacy Commissioner as the Privacy Act 2020 requires.

Systemise is business software and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact [email protected] and we will delete it.

We may update this policy as the service changes. The date at the top of this page shows when it was last revised. If a change materially affects how we handle your personal information, we will notify account holders by email before it takes effect.

If you have a question about any of this, email [email protected] or use our contact page.