Privacy Policy

1.1 This Policy applies to all personal information processed through the Platform, whether relating to account holders, authorised users, or individuals named in records created on the Platform (such as site induction participants, client contacts, booking contacts, plan contacts and staff records).

1.2 Roles under the Privacy Act 2020. The Privacy Act 2020 does not use "controller"/"processor" labels; it imposes obligations on each "agency" that holds personal information. Both the customer organisation and BYT are agencies under the Act, each with its own direct obligations under the IPPs. In plain terms: the customer decides what information is entered into the Platform about its jobs, crews, clients, bookings and induction participants ("Customer Data"); BYT hosts and processes that information to operate, secure and support the Platform, under the limited licence described in the Terms of Use. BYT does not avoid its own statutory responsibility to individuals by describing itself as acting "on the customer's behalf". Where BYT processes information for its own defined operational, security or legal-compliance purposes, it does so only for those narrow purposes and not for any commercial exploitation of Customer Data.

1.3 Reseller relationship. The Reseller, TTM Control Ltd, holds the subscription, billing and commercial relationship with customers. The Reseller agrees commercial terms with each customer directly and enables Platform access on that basis, with a free trial available. Billing is administered by the Reseller via Xero. The Platform does not meter, count or charge for individual jobs or forms. The Platform continues to store historical billing records in support of that relationship, but BYT does not operate a card-payment processor, does not itself collect or store payment-card or other payment-account details, and does not transmit any payment or billing-account information to Xero. All payment and billing-account data is collected and held solely by the Reseller through its own arrangements (including Xero) outside the Platform, and is not governed by this Policy.

1.4 Clickwrap acceptance. Every account user must click to accept the Terms of Use and this Privacy Policy on first login, and again whenever a new version is published. When you accept, we record your user ID, email address, the version accepted (recorded as that version's effective date, which is shown at the top of this Policy), your IP address, a timestamp, and your browser user agent as evidence of acceptance. This acceptance binds account users only; individuals whose information is entered into the Platform by others do not accept anything, and for them we and our customers rely on the IPP 3 notice described in clause 2.3. This acceptance record is retained for the period stated in clause 7.5.

1.5 Versioning and fresh acceptance. Each published version of this Policy carries a unique version identifier and effective date shown at the top. Where we make a material change, account users are shown an acceptance prompt the next time they open or sign in to the Platform while connected to the internet, and they cannot keep using the Platform until they freshly accept the updated version. So that crews on a live site are never locked out mid-job, a device that cannot reach our servers is not blocked; the prompt appears the next time the Platform is opened with a connection. Non-material changes take effect on publication.

1.6 Adults acting in trade; third-party data. Platform accounts and logins are for adults acting in trade, and a user must be at least 18 years old. We do not represent that no personal information about people under 18 is ever processed: a worksite induction lawfully entered by a user may, for example, include a 16- or 17-year-old apprentice. Where data about a person under 18 is entered as a record, the customer is responsible for any consent or notice required, and that data is handled for the same safety record-keeping purposes as any other induction record.

2.1 We collect and process the following categories of personal information:

• Account information: user name, email address, company name, and mobile number, and, where a customer uses Microsoft sign-in, the user's Microsoft account identifier.
• Job records: daily job sheets, site addresses and GPS coordinates, hazard and risk assessments, and recorded control measures.
• Uploaded media: site photographs and videos, and uploaded documents (including PDFs and spreadsheets such as hazard registers).
• Site induction records: participant names, roles, company, email address, mobile number, CoPTTM or NZGTTM ID number, personal protective equipment (PPE) worn, a first-aid-trained flag, a fit-for-work tick, the person's daily pre-start answers (including whether they feel safe and well to start work), declaration acceptance, and signatures.
• Client and client-contact details: client company name and address, and client contact name, email address and mobile number.
• Booking details: the booking purchase-order (PO) number and the "booking person" contact (name, email address and mobile number).
• Traffic management plan contacts: for plans prepared in TMP Design, the names of the client, contractor and subcontractor companies and, for each, a contact person's name, phone number and email address; the road controlling authority contact's name, phone number and email address; and a company list a customer may keep for re-use in its plans (company name, contact person, phone number, email address and an optional company logo). These contact details are not sent to the AI services described in section 6.
• Staff and resourcing records: staff records and pay rates, vehicle details (including vehicle registration numbers), and availability and public-holiday data used for scheduling.
• Commercial records: historical billing records from earlier pricing arrangements between the Reseller and its customers (these support the Reseller's billing relationship described in clause 1.3; BYT does not collect, store or transmit payment-card or payment-account details).
• Push notification information: where you enable push notifications, the push subscription endpoint and associated keys issued by your browser's push service, used to deliver notifications as described in clauses 5.9 and 6.5.
• TTM Evidence linkage information (only where a user opts in to link their TTM Evidence account): the user's TTM Evidence user identifier, their TTM Evidence email address, and the CoPTTM or NZGTTM ID number held on TTM Evidence, together with the records pushed to TTM Evidence as described in clause 5.5.
• Technical and usage information: server logs, IP addresses, device and browser information, and usage data generated through your interaction with the Platform.

2.2 Limited health-related information. Some information handled by the Platform may constitute limited health-related information - for example, the first-aid-trained flag in an induction record, or detail captured in connection with a safety incident. We do not claim never to collect health-related information. We collect it only where it is incidental to safety record-keeping, only for that purpose, and we do not use it for any other purpose. Users must not enter health information beyond what the safety record reasonably requires. Standalone incident, accident and near-miss report forms are not sent to the offshore AI services under section 6. Health and fitness information in site induction records (the first-aid-trained flag, the fit-for-work tick and the daily pre-start answers), and the email addresses and mobile numbers held in a job's induction records, crew list, foreman details and HRC 008 form, are removed before any AI review of a job's paperwork. A number or other detail that a user types into a free-text field (such as notes, comments or the first-aider field) is sent as written. Content embedded inside uploaded documents or photographs cannot be reliably screened before transmission, so any health or incident detail contained within an uploaded hazard register, form, PDF or photo may be transmitted to the AI services as part of that file (see clause 6.3). For this reason, do not upload health information beyond the minimum the safety record requires. To the extent any information we handle is "health information" within the meaning of the Health Information Privacy Code 2020, and to the extent that Code applies to us, we apply the relevant Health Information Privacy Rules to it; we do not represent that the Code necessarily applies to BYT as a general software host.

2.3 Information about third parties (indirect collection). Where users enter personal information about other individuals (for example, induction participants, client contacts, booking contacts, plan contacts or staff), we collect that information indirectly - from the user, not from the individual concerned. The user and the customer are responsible for ensuring they are entitled to provide that information and for making the individual aware, at or before collection, of how the information will be handled, including that it is stored in Australia (with encrypted backups also held in Cloudflare's Oceania storage region, clause 4.7); that, where the customer has turned the AI features on, some Customer Data is processed by AI services overseas, in the United States and other countries; that transactional email is handled by Resend, a United States email provider, which sends our email from Japan; that all traffic between users' devices and the Platform passes through Cloudflare's global network, including outside New Zealand and Australia; and, where the individual is a user who opts in to link a TTM Evidence account, that certain records will be pushed to TTM Evidence (see sections 4, 5 and 6). This allows the customer to meet its own IPP 2 and IPP 3 obligations.

3.1 Collection notice (IPP 1-IPP 4). We collect personal information by lawful and fair means for the purposes set out below. Providing the information is necessary to use the Platform; if it is not provided, the relevant features or the Platform itself cannot be used. The intended recipients of the information are the service providers listed in section 5. Individuals have the access and correction rights described in section 10, and BYT is an agency that holds the information for the purposes of the Privacy Act 2020.

3.2 We use personal information to:

• Provide, operate, maintain and support the Platform and its features;
• Create, store and make available the safety records, job sheets, inductions, assessments and bookings that users generate;
• Where the customer has turned them on, use the AI features described in section 6 to read and extract content from uploaded hazard registers and forms, draft and check the risk register for a traffic management plan, and check a job's completed paperwork for likely errors;
• Authenticate users, manage accounts, and record acceptance of our Terms of Use and this Policy;
• Send transactional email (for example, account, password-reset and notification emails) via the email provider described in clause 5.4;
• Deliver push notifications to users who enable them, via the browser push services described in clause 5.9;
• Maintain historical billing records to support the Reseller's billing relationship described in clause 1.3;
• Where a user opts in, link their TTM Evidence account and push their induction, role and closure records to TTM Evidence as described in clause 5.5;
• Secure the Platform and prevent misuse;
• Diagnose technical problems and monitor performance, and improve the Platform using only aggregated, de-identified data; and
• Comply with our legal obligations and respond to lawful requests.

3.3 No sale; no commercial exploitation. We do not sell personal information. We do not use Customer Data to train AI models for our own commercial purposes, and the Platform's AI features send it only to AI services that do not use it for training (clause 6.4). We do not mine Customer Data for advertising or unrelated commercial exploitation.

4.1 Compute and application server. The Platform's compute and application server run on a single Vultr cloud virtual machine located in Sydney, Australia, within Docker containers.

4.2 Uploaded media. Uploaded media files (site photos, videos and uploaded PDFs) are stored in managed object storage (Supabase Storage, backed by AWS) in the Sydney region (ap-southeast-2). That storage is access-controlled and is encrypted at rest by AWS, and uploaded media is protected in transit by HTTPS/TLS. Our own backup copies of uploaded media are described in clause 4.7.

4.3 Structured database. The structured database is a Supabase PostgreSQL instance hosted on Amazon Web Services (AWS) in the Sydney region (ap-southeast-2). This database is encrypted at rest by AWS.

4.4 Network, CDN and security. Cloudflare, a United States-headquartered company operating a global edge network, provides the public domain, a secure tunnel, content delivery network (CDN) and DDoS protection. All traffic between users' browsers or devices and the Platform passes through Cloudflare's network, usually through the edge location nearest the user. Cloudflare decrypts that traffic at its edge so it can deliver and protect it, so the content of requests and responses (including Customer Data) is processed by Cloudflare in transit. Content may also be cached transiently at edge locations, which can include locations outside New Zealand and Australia. This is therefore a cross-border disclosure and is addressed under the accountability rules in clause 6.5.

4.5 Encryption. Personal information is encrypted in transit using HTTPS/TLS. Both the Supabase/AWS-hosted structured database (clause 4.3) and uploaded media held in Supabase/AWS object storage (clause 4.2) are encrypted at rest by AWS. The working backup copy of uploaded media on our application server (clause 4.7) is protected by access controls rather than separate encryption; the backup copies we keep away from that server are encrypted.

4.6 Offshore processing and disclosure. In addition to the Sydney hosting above, where the customer has turned the AI features on, some Customer Data is sent to the AI services on the AI Provider List, overseas in the United States and other countries (section 6); transactional email (including email addresses and message content) passes through Resend, a United States email provider that sends our email from Japan (clause 5.4); push notifications are delivered through offshore browser push services (clause 5.9); map tile requests, which reveal the map view and the user's IP address, are sent to the OpenStreetMap tile service (overseas) and, in the site designer, to Land Information New Zealand (clause 5.6); and address and road lookups send address text, coordinates and road names to the OpenStreetMap Foundation's Nominatim service, the NZ Transport Agency's road data on Esri ArcGIS Online and public OpenStreetMap Overpass servers (clause 5.6). The Sydney-based recipients (Vultr and Supabase/AWS) are within Australia, a jurisdiction subject to its own privacy legislation; the overseas AI services, the email provider (Resend), the offshore push services, the OpenStreetMap tile, Nominatim and Overpass services, Esri, Google (Gmail) (clause 5.1) and the global Cloudflare network are genuinely offshore relative to New Zealand and are subject to the safeguards in clause 6.5.

4.7 Backups. Our database host (Supabase) takes daily backups of the database and keeps them for about 7 days. Every night BYT also takes its own encrypted copy of the database (and of TTM Evidence's database and files), which is uploaded to Cloudflare R2 (placed in Cloudflare's Oceania region) and kept for about 35 days. BYT keeps its own backups of uploaded media: a working copy on our application server in Sydney and, every night, an encrypted copy, which is uploaded directly to our encrypted off-site backup provider (Cloudflare R2, placed in Cloudflare's Oceania region, which does not guarantee a particular country). Older encrypted copies made before 15 October 2026 are also held on backup equipment BYT controls in Queensland, Australia, and its encrypted off-site copy, until they age out. A file deleted from the Platform is removed from these backups within about 13 months. This does not govern other provider-side snapshots, caches or logs held by our sub-processors (such as Supabase/AWS, Cloudflare or Resend), which are governed by those providers' own retention arrangements, or records already pushed to TTM Evidence, which are kept as described in clause 7.6.

5.1 We disclose personal information to the following service providers and sub-processors who help us operate the Platform. This is the canonical, version-controlled list of sub-processors engaged by BYT for the Platform:

• Vultr - cloud compute / application server (Sydney, Australia);
• Supabase / AWS - managed PostgreSQL database hosting and object storage for uploaded media, both encrypted at rest by AWS (Sydney, ap-southeast-2);
• Cloudflare - domain, secure tunnel, CDN and DDoS protection; all user traffic to and from the Platform passes through it in transit; and storage of encrypted backups of uploaded media in Cloudflare R2 (US-headquartered; transient global edge caching, see clause 4.4; R2 placed in the Oceania region, see clause 4.7);
• OpenRouter (United States) and the AI services on the AI Provider List in clause 6.2 - AI processing as described in section 6, only where the customer has turned the AI features on (overseas: the United States and other countries);
• Resend - transactional email delivery, including email addresses and message content (United States company; sent from Japan; see clause 5.4);
• Google (Gmail) - the email inbox of BYT's operator, which receives platform alerts and email sent to BYT. If a Reseller staff member marks in-app feedback as an emergency, the alert quotes up to 1,500 characters of that feedback with the sender's name, email address and company identifier (United States and other countries);
• Browser push services (for example Google, Apple, Mozilla and Microsoft push infrastructure) - delivery of web push notifications to subscribed devices (offshore; see clause 5.9);
• OpenStreetMap Foundation - map tiles for the Platform's maps, requested by the user's browser (United Kingdom, via a global content-delivery network; see clause 5.6);
• Land Information New Zealand (LINZ) - aerial imagery, elevation data and map label fonts for the TMP Design site designer, requested by the user's browser (New Zealand; see clause 5.6);
• OpenStreetMap Foundation's Nominatim service - turning an address into a map position and back, receiving the address text or coordinates from our server (overseas; see clause 5.6);
• NZ Transport Agency road data on Esri ArcGIS Online - road details for a site, receiving the site's approximate coordinates, or the road's name or identifier, from our server (Esri is a United States company; see clause 5.6);
• Public OpenStreetMap Overpass servers - road lines and mapped cycle lanes for a site, receiving the site's coordinates (overseas; see clause 5.6);
• TTM Evidence (app.ttmevidence.co.nz) - a separate app also operated by BYT, hosted in Australia (on a BYT-controlled Vultr server in Sydney, with its database and file storage on Supabase (Amazon Web Services) in Sydney) and covered by this Policy; only where a user opts in to link their TTM Evidence account, to build that worker's portable experience record (see clause 5.5); and
• TTM Control Ltd (the Reseller) - for the commercial, subscription and support relationship. Payment and billing-account data handled by the Reseller (including via Xero) sits outside the Platform and is not disclosed to it by BYT (see clause 1.3).

5.2 Lawful basis for disclosure (IPP 11). Each disclosure above is made for, or directly related to, a purpose for which the information was obtained (operating, securing and supporting the Platform, including delivering transactional email and push notifications, displaying maps, and, where the user opts in, building the worker's portable experience record), or under a permitted exception in the Privacy Act 2020.

5.3 Other disclosures. We may also disclose personal information where required or authorised by law, or where reasonably necessary to comply with the law or to protect against an imminent threat to the safety of any person. In connection with any sale or restructuring of our business, Customer Data will only be transferred to an acquirer on terms that bind the acquirer to this Policy (or terms no less protective) and the limited-licence and data-ownership provisions of the Terms of Use; we will notify the contracting customer before any such transfer so the customer may export its data and terminate before the transfer takes effect.

5.4 Transactional email (Resend). We send transactional email (for example, account, password-reset and notification emails) through Resend, a United States-based email provider. Our email is sent from Resend's Tokyo, Japan sending region. To do so, the recipient's email address and the content of the message pass through Resend. This is a cross-border disclosure to Japan and the United States and is addressed under the accountability rules in clause 6.5.

5.5 TTM Evidence (optional, user-initiated linking). TTM Evidence (app.ttmevidence.co.nz) is a separate app, also operated by BYT and hosted in Australia (on a BYT-controlled Vultr server in Sydney, with its database and file storage on Supabase (Amazon Web Services) in Sydney), that maintains workers' verifiable traffic-management experience records. Personal information in TTM Evidence is handled under this Policy. Linking is optional and user-initiated: a user who wishes to link enters their TTM Evidence email address, receives a six-digit verification code, and confirms it. If a user does not link their account, no information is pushed to TTM Evidence. Once a user has linked their account, the Platform automatically pushes, server-to-server, that user's own activity records to TTM Evidence as they are created - specifically the user's induction sign-ons and STMS, TMO and closure records. The information pushed is scoped to the linking worker's own record and includes the worker's email address and Platform user identifier, the record type (induction sign-on, STMS role, TMO role, or closure), the job or site title, the site name (the site address or job description), the relevant timestamps, the customer's account identifier and the Platform's job and induction reference numbers, the worker's name, company and CoPTTM or NZGTTM ID number as entered on their induction (or their name as entered on the job, for STMS and TMO roles), and, for closures, the closure types and the number of temporary speed limits recorded as installed; we do not push the contact details or personal information of other individuals as part of this linkage. The purpose of this disclosure is to build the worker's portable experience record on TTM Evidence. This is a cross-application and cross-border disclosure of personal information, made only for that user and only after that user has opted in.

5.6 Maps, address and road lookups. The Platform's maps use OpenStreetMap map tiles. The TMP Design site designer also uses Land Information New Zealand (LINZ) Basemaps aerial imagery, elevation data and map label fonts. To show a map, the user's browser requests these directly from the OpenStreetMap Foundation's tile service (United Kingdom, delivered through a global content-delivery network) or, in the site designer, from LINZ (New Zealand). Each request reveals the approximate area being viewed (and so the approximate location) and the user's IP address to that service. No other Customer Data is sent with these requests. To turn an address into a map position, or a position into an address, our server sends the address text or the coordinates (not the user's IP address) to the OpenStreetMap Foundation's Nominatim service (overseas). When a user looks up road details for a site, in the planning tools or with the Find RP button for a job's site, our server sends the site's approximate coordinates, or the road's name or identifier, to the NZ Transport Agency's road data hosted on Esri ArcGIS Online (Esri is a United States company). Where the road's line is needed (always in the site designer; otherwise only where the road bends or meets another road), our server also sends the coordinates to public OpenStreetMap Overpass servers (overseas). These supply the road lines and mapped cycle lanes. In the public demo of the site designer, used without signing in, the visitor's browser sends the clicked coordinates directly to those Overpass servers.

5.7 Lawful basis for disclosure (IPP 11). Each disclosure above is made for, or directly related to, a purpose for which the information was obtained, or under a permitted exception in the Privacy Act 2020.

5.8 Sub-processor obligations. For our infrastructure sub-processors (Vultr, AWS/Supabase, Cloudflare and Resend) we rely on their published data-processing and security terms, which impose contractual obligations to protect the information. For OpenRouter and the AI services on the AI Provider List, the protections are more limited and rest on their published terms and the no-retention and no-training settings described in clause 6.4; we do not represent that they are bound by obligations identical to this Policy or that they provide comparable-safeguards guarantees. For the map, address and road lookup services, only map-view requests (with the requesting browser's IP address), address text, and a site's approximate coordinates, road names or road identifiers are shared, as described in clause 5.6. For the browser push services, only the push subscription endpoint, associated keys and notification payload are shared, as described in clause 5.9. For TTM Evidence (a separate app also operated by BYT and hosted in Australia, clause 5.5), the user's own records are shared only after the user opts in; BYT remains accountable for those records, which are handled under this Policy. We remain accountable for Customer Data we disclose to any sub-processor, and we will give the contracting customer reasonable notice of any new sub-processor and a reasonable opportunity to object.

5.9 Push notifications (browser push services). Where a user enables push notifications, the Platform uses the W3C Web Push standard. The user's browser issues a push subscription endpoint and associated keys, which are operated by the browser vendor's push service (for example, Google's service for Chrome, Mozilla's service for Firefox, Apple's service for Safari, or Microsoft's service for Edge). To deliver a notification, the Platform sends the endpoint and the notification payload to that push service, which then delivers it to the user's device. These push services are operated offshore. This is a cross-border disclosure and is addressed under the accountability rules in clause 6.5. Users can disable push notifications at any time through their browser or device settings.

5.10 Customer-authorised integrations (Xero, Microsoft sign-in and Connect your AI). These are not sub-processors we choose; they are services a customer connects for itself, used only on that customer's instruction and under the customer's own agreement with the provider. Xero: when an authorised user sends a booking or a TMP record to Xero, the Platform creates a draft invoice in the customer's own Xero organisation, or adds the booking's lines to an existing draft invoice the user names. These invoices contain the client's name, the PO, booking, TMP and job or reference numbers, the site, the dates and hours worked, crew and vehicle counts, rates, fees and any gear hire lines. To help match client names, the Platform also reads the names of the customer's Xero customer contacts. Where the customer turns on payroll export, the Platform reads the employee list (names, email addresses and pay calendars) and earnings rates from the customer's Xero Payroll, so the customer can match staff to employees. It then sends the hours worked on approved time sheets to Xero Payroll as timesheets for the matched employees, replacing any timesheet the Platform sent earlier for the same period. The customer can disconnect Xero at any time in Settings. Microsoft sign-in: where a customer uses Microsoft sign-in (Microsoft Entra ID), its users sign in through the customer's own Microsoft directory, and the Platform receives the user's email address and Microsoft account identifier to match the user to their account. Connect your AI: where we have made it available to a customer, the customer has the AI features turned on, and a user with the customer's Admin role creates an access key, the AI assistant the customer connects with that key (for example Claude) can read, but not change, the customer's records: jobs (job number, date, site address, work description, client name and status), a summary of each job's paperwork including crew names, day sheets (crew names and roles, vehicles and registrations, closure types, planned times and notes), who is booked off and why (for example leave or sick) and normal days off, vehicle registration, WoF/CoF and service dates, and staff qualification expiry dates. Photos and signatures are not included. That information goes to the provider of the assistant the customer chose. We log each request made with a key, and a user with the Admin role can revoke a key at any time in Settings. Xero, Microsoft and the provider of a connected AI assistant may process this information outside New Zealand under their own terms with the customer.

6.1 Use of AI. Parts of the Platform use large language models (LLMs) to help users with their traffic-management paperwork and plans. They read uploaded hazard registers, forms and photos and turn them into draft hazard, risk and control items for the user to review, including through the in-job "Import other (AI)" option. They draft the hazard, risk and control rows for a traffic management plan from the plan's details and the customer's hazard library. They check a draft plan's risk register for likely gaps, and check a job's completed paperwork for likely errors before it is exported to PDF and when the day is closed out; these checks are advice only. AI features are off for each customer unless a user with the customer's Admin role turns them on in Settings after reading a plain-English disclosure, and any user with that role can turn them off again at any time. While they are off, no Customer Data is sent to the AI services.

6.2 How AI is accessed, and the AI Provider List. We reach the AI models through OpenRouter, a United States-based routing service, which sends each request on to a service that runs the model. The services we currently use (the "AI Provider List", last updated 15 October 2026) are:

• OpenRouter (United States): routes each request; it does not run the models.
• Google Cloud Vertex AI, run by Google: runs the Claude models, made by Anthropic, and the Gemini models, made by Google.
• Microsoft Azure, run by Microsoft: currently runs the GPT models, made by OpenAI.

These services run in the United States and may run in other countries where those providers operate. We do not limit AI processing to New Zealand or Australia. Requests made by the Platform's AI features are not sent to Anthropic's or OpenAI's own services. When this list changes, we update it here with its date and give notice under clause 5.8 before a new service starts processing Customer Data. A change to this list alone is not a new version of this Policy and does not need fresh acceptance.

6.3 What is sent, and cross-border transfer. To provide these features, we send to the AI services the uploaded hazard-register files (including spreadsheets, PDFs rendered to images, and photographed forms), the hazard, risk and control text within them, and job form data, including a job's site induction records when the paperwork check in clause 6.1 runs, with the health and fitness fields removed, and with the email addresses and mobile numbers in those induction records, the crew list, the foreman details and the HRC 008 form removed (see clause 2.2). For a traffic management plan, we send the plan's details (such as its title, site address and road, speed limits, closure types, work description and affected parties), the customer's hazard library and the draft risk register. Because files are sent in full, any personal, health or incident detail embedded within an uploaded document or photograph is sent with it; we do not, and cannot reliably, pre-screen the contents of unstructured uploads before transmission. This means some Customer Data is sent overseas for processing (clause 6.2), and some of that Customer Data may relate to people who are not the user submitting it (for example, individuals named in a hazard form). For that reason, we do not rely on the submitting user's click-acceptance as the legal basis for this transfer; instead we rely on the cross-border accountability basis in clause 6.5. Customers are responsible for ensuring third-party individuals have been made aware that their data may be processed overseas, in the United States and other countries (see clause 2.3), and users should not upload personal, health or incident information beyond the minimum the safety record requires.

6.4 No retention and no training. On each AI request we instruct OpenRouter to send it only to services that OpenRouter lists as zero data retention, and only to services that do not use data to train AI models. Under the terms OpenRouter has with them, those services may hold the data briefly while they produce the answer, but do not store it after the answer is returned and do not use it for training. OpenRouter passes the request on without keeping its content, and keeps a record of each request (such as its time, model, size and cost). These are commitments made by OpenRouter and the providers under their own terms. We set and test these settings, but we do not control OpenRouter or the providers and cannot independently verify or guarantee their conduct. A provider may also keep or disclose data where the law requires it.

6.5 Cross-border accountability (IPP 12). Where we disclose personal information to a recipient outside New Zealand, we remain accountable under IPP 12 for that information after it has been transferred offshore. For our infrastructure recipients (Cloudflare (clause 4.4), the email provider Resend (a United States company, sending from Japan; clause 5.4), the browser push services (clause 5.9) and Google (Gmail, clause 5.1)), we rely on those recipients' published data-processing and security terms, which we consider provide protections comparable to the safeguards in the Privacy Act 2020. For the map, address and road lookup services (clause 5.6), we rely on sending them only what each request needs (map tile requests, address text, coordinates and road names or identifiers) rather than on their terms. For OpenRouter and the AI services on the AI Provider List (clause 6.2), our reliance is more limited: it rests on their published terms and the no-retention and no-training settings in clause 6.4, rather than on a verified comparable-safeguards guarantee, and as clauses 5.8 and 6.4 explain we cannot independently verify or guarantee how those settings are honoured. We do not represent that the United States, Japan, or any other country where these recipients or the AI services run, is prescribed as having comparable privacy law. Where the comparable-safeguards basis cannot be assured for a particular transfer, that transfer proceeds only on the basis described here and with the data minimisation we ask of users in clauses 2.2 and 6.3.

6.6 Transience and retention. Data sent to the AI services is sent only to obtain a result. BYT keeps no separate copy of what was sent beyond the records and files already held in the Platform and the resulting records, and logs each AI request's time, model, size and cost without its content. Retention by OpenRouter and the AI services is described in clause 6.4.

6.7 Human-in-the-loop. AI output is advisory and draft only. Hazard items extracted from an uploaded file are saved only after a person has gone through every row and ticked a box confirming they have reviewed them. Hazard rows drafted for a traffic management plan are added to the plan for review, and the plan can only be accepted when a person ticks a box confirming they have read each line and agree with it. AI output is not a substitute for professional safety judgement, and users remain responsible for the accuracy and adequacy of their safety records.

7.1 Active retention. We retain account information and Customer Data for as long as the relevant subscription remains active.

7.2 On termination. When a subscription ends, we provide a 60-day export window during which we will export the customer's data for it on request, including media files and structured data in a commonly used, machine-readable format. A suspended or ended account cannot be signed in to, so the export is done by us. This export window applies even where an account has been terminated for breach; where an account is suspended for an acceptable-use issue, we will still export the customer's own lawful records for it. Export is available on reasonable request for records the customer is legally required to retain, including during a billing dispute. After the export window ends, we delete the data from our active systems when we close the customer's account. We close an account when the customer asks us to, or once it is clear the customer is not coming back; until then the data stays stored but locked, and the customer's users cannot sign in to it. The customer is responsible for exporting, before the export window ends, any records it must keep under the Health and Safety at Work Act 2015, NZGTTM, its client contracts or any other law, and for keeping them for as long as it is required to.

7.3 Backups. After deletion from active systems, residual copies may persist in the backups described in clause 4.7: for about 7 days in the database host's backups, about 35 days in our own encrypted database backups, and up to about 13 months in backups of uploaded media. Provider-side snapshots, caches and logs held by our sub-processors are outside those backups and are governed by those providers' own retention arrangements, and records already pushed to TTM Evidence are kept as described in clause 7.6.

7.4 Server logs. Our server and infrastructure logs record request details (including the connecting user's IP address, the time and the address requested), account identifiers on security events, diagnostics and internal network addresses. We keep them on our own server for security, misuse tracing, fraud prevention and diagnostics, for up to 90 days, after which they are deleted. Our support staff, including the AI assistant in clause 5.1, may read them to find and fix faults. Cloudflare, which carries traffic to the Platform (clause 4.4), also processes connecting IP addresses at the network edge under its own retention. This period is what we consider necessary for those purposes consistent with IPP 9.

7.5 Acceptance evidence. The clickwrap acceptance records described in clause 1.4 are retained for the duration of the account and for up to 24 months after termination, as evidence of the terms accepted.

7.6 Records pushed to TTM Evidence. Where a user has opted in to link their TTM Evidence account, the records pushed to TTM Evidence (clause 5.5) form part of that user's portable experience record held in TTM Evidence, a separate app also operated by BYT and hosted in Australia (clause 5.5); they are handled under this Policy, and BYT remains accountable for them as operator. Deletion of Customer Data from the Platform does not, by itself, delete records already pushed to and held by TTM Evidence.

7.7 Legal holds. We may retain information for longer where required to comply with a legal obligation, resolve a dispute, or enforce our agreements.

8.1 We take reasonable technical and organisational measures to protect personal information against loss, unauthorised access, use, modification or disclosure. These include encryption in transit (HTTPS/TLS), encryption at rest for both the Supabase/AWS-hosted structured database and uploaded media held in Supabase/AWS object storage (provided by AWS, as described in clause 4.2), and the use of reputable infrastructure providers.

8.2 No method of transmission or storage is completely secure. While we take reasonable steps to protect personal information, we cannot guarantee absolute security. This statement does not limit any liability that arises from our failure to take the reasonable security steps described in clause 8.1; any limits on liability are set out in the Terms of Use and are subject to the non-excludable rights preserved in clause 12.2.

8.3 Data on devices. So that paperwork can be completed without signal, the Platform keeps a copy of the jobs and forms a user can see on the phone, tablet or computer they use. The copy stays on the device after it syncs, so the work is still there with no signal. It is deleted from the device when the user logs out using the Log out button. If the user is logged out automatically, for example because their session has expired, the copy stays on the device so that unsent work is not lost. Customers and users are responsible for keeping those devices secure, and for removing a user's access promptly if a device is lost or stolen (see clause 3.5 of the Terms of Use).

9.1 Under the New Zealand Privacy Act 2020 (sections 112-118), where it is reasonable to believe a privacy breach has caused, or is likely to cause, serious harm, we will notify the Office of the New Zealand Privacy Commissioner and the affected individuals as soon as practicable after becoming aware of the breach.

9.2 To the extent the Australian Privacy Act 1988 applies to us as an Australian operator, we will also comply with the corresponding obligations under the Notifiable Data Breaches scheme in Part IIIC of that Act, including notification to the Office of the Australian Information Commissioner (OAIC) and affected individuals for eligible data breaches likely to result in serious harm. Where that Act does not apply to us, we will in any event follow breach-handling practices equivalent to the New Zealand notifiable-breach scheme described in clause 9.1.

9.3 Where a breach affects Customer Data, we will notify the contracting customer without undue delay and cooperate with the customer to support any notification obligations the customer may have as an agency in its own right.

10.1 Individuals may request access to, and correction of, the personal information we hold about them under IPP 6 and IPP 7. Where BYT holds the information as an agency in its own right (for example, account and usage data), we will respond directly. Where the information is Customer Data, we will, where appropriate, refer the request to, and assist, the relevant customer so it can respond within the statutory timeframe; but where we hold the information and the individual cannot reasonably obtain it from the customer (for example, where the employer-customer no longer uses the Platform), we will respond directly as required by the Act.

10.2 We will respond to access requests as soon as reasonably practicable and no later than 20 working days, subject to the permitted extensions and withholding grounds under the Privacy Act 2020. If a request is referred to a customer under clause 10.1, the statutory timeframe runs from when the responsible agency receives it, and we will tell the individual where their request has been directed. If we correct information under IPP 7, we will take reasonable steps to do so; if we decline to make a correction, the individual may request that a statement of the correction sought be attached to the information.

10.3 To make a request, or to ask a question about this Policy, contact us at [email protected]. We may need to verify your identity before responding. Where a request concerns records already pushed to TTM Evidence (clause 5.5), those records are held in TTM Evidence, a separate app also operated by BYT, and we will deal with the request for those records as well.

11.1 If you have a complaint about how we have handled your personal information, please contact us first at [email protected] so we can try to resolve it.

11.2 If you are not satisfied, you may complain to the Office of the New Zealand Privacy Commissioner (privacy.org.nz) or, where relevant, the Australian Office of the Australian Information Commissioner (oaic.gov.au).

12.1 This Policy and any dispute relating to it are governed by the laws of New Zealand, and the parties submit to the non-exclusive jurisdiction of the New Zealand courts. Because we are an Australian operator with hosting in Sydney, mandatory provisions of the Australian Privacy Act 1988 and the Australian Consumer Law may also apply to us notwithstanding this choice of law. In broad terms, the handling of personal information through the Platform is addressed under the New Zealand Privacy Act 2020 and the IPPs as described throughout this Policy, and any mandatory Australian obligations that apply to BYT operate in addition to, and are not displaced by, that framework.

12.2 Non-excludable rights. Nothing in this Policy or the Terms of Use excludes, restricts or modifies any right or remedy that cannot lawfully be excluded, including (where they apply) under the New Zealand Privacy Act 2020, the New Zealand Consumer Guarantees Act 1993, the Fair Trading Act 1986, or the Australian Consumer Law (for example, section 64 of the Australian Consumer Law, which voids attempts to exclude certain consumer guarantees). In particular, nothing affects an individual's statutory rights or remedies under the Privacy Act 2020, including any award by the Human Rights Review Tribunal.

12.3 Commercial terms live in the Terms of Use. The binding commercial provisions for the Platform (including any limitation of liability, exclusion of indirect or consequential loss, indemnities, data-ownership and licence terms, and any contracting-out of the Consumer Guarantees Act 1993 (section 43) and the Fair Trading Act 1986 (section 5C) between parties in trade) are set out in the Terms of Use, which form the agreement between the contracting parties. They are not contained in, and are not effected by, this Policy. Any such contracting-out operates only as a written, agreed term between parties acting in trade, only to the extent it is fair and reasonable, and cannot exclude liability for misleading or deceptive conduct under section 9 of the Fair Trading Act. This Policy is a privacy notice and does not by itself create, limit or waive any contractual right or any statutory privacy right.

13.1 Platform provider and operator: Maxwell Van der Leden, ABN 74 848 795 702, trading as Build Your Tools (BYT), Cannonvale, QLD 4802, Australia.

13.2 Email: [email protected].

13.3 Reseller (commercial and subscription matters): TTM Control Ltd (company number 8193035, NZBN 9429049383126), New Zealand.