Privacy Policy

Last updated: 12 May 2026  ·  Effective: 12 May 2026

1. Introduction

This Privacy Policy explains how Ingenia Labs ("we", "us", or "our") collects, uses, stores, and discloses personal information about you when you use our platform located at ingenialabs.co.nz (the "Service").

We are committed to complying with the Privacy Act 2020 (New Zealand) and the 13 Information Privacy Principles (IPPs) set out in that Act. This policy should be read alongside our Terms of Service.

If you have joined our early access list but do not yet have an account, the Privacy Policy for Early Sign Ups applies to you instead.

2. Who We Are

Ingenia Labs is operated from New Zealand. For privacy enquiries, contact us at:

  • Email: privacy@ingenialabs.co.nz
  • Country: New Zealand

3. Information We Collect

We collect the following categories of personal information:

3.1 Information you provide directly

  • Name and email address (when you register)
  • Password (stored as a one-way cryptographic hash — we cannot read it)
  • Profile preferences (display name, region, timezone)
  • Content you create: documents, chat messages, blueprints, knowledge base files
  • Files you upload for processing (text, PDF, Word documents, CSV)

3.2 Information collected automatically

  • Authentication tokens stored in your browser's local storage
  • Usage data: features used, models selected, token counts for AI calls
  • Error and diagnostic information to maintain service reliability

3.3 Information we do not collect

  • Payment card details (we do not currently process payments)
  • Sensitive information as defined in the Privacy Act 2020 (health, ethnicity, religion, etc.) — please do not submit this through the Service
  • Information about children — the Service is not directed at persons under 16

4. How We Use Your Information

We collect and use personal information only for the purposes for which it was collected or a directly related purpose, in accordance with IPP 10. Specifically, we use your information to:

  • Create and manage your account
  • Provide and improve the Service, including AI-powered features
  • Process your content through third-party AI model providers (see section 6)
  • Send administrative communications (account confirmation, security alerts)
  • Enforce our Terms of Service and protect the security of the platform
  • Comply with legal obligations under New Zealand law
  • Respond to your support requests and enquiries

We do not use your content to train AI models. We do not sell your personal information to third parties. We do not use your information for direct marketing without your explicit consent.

5. Legal Basis for Processing

Under the Privacy Act 2020, we collect and hold personal information only where it is necessary for a lawful purpose connected with a function or activity of ours, and the collection is reasonably necessary for that purpose (IPP 1). Our lawful purposes are:

  • Performing the contract between you and us (providing the Service)
  • Our legitimate interests in operating, improving, and securing the platform
  • Compliance with legal obligations

6. Third-Party Service Providers

To deliver AI features, your content (chat messages, document text, uploaded files) is transmitted to the following third-party AI providers when you use those features. Each provider processes your data under their own privacy and data processing terms:

  • Anthropic (Claude models) — anthropic.com/privacy
  • OpenAI (GPT models) — openai.com/policies/privacy-policy
  • Google (Gemini models) — policies.google.com/privacy
  • Tavily (web search) — tavily.com/privacy

We also use the following infrastructure providers:

  • Supabase (database hosting) — supabase.com/privacy
  • Vercel (frontend hosting) — vercel.com/legal/privacy-policy
  • Railway (backend hosting) — railway.app/legal/privacy

We take reasonable steps to ensure these providers protect your information consistently with the Privacy Act 2020 (IPP 11 — limits on disclosure).

7. Data Storage and Security

Your data is stored in cloud infrastructure hosted outside New Zealand (primarily in the United States and other regions). By using the Service, you consent to this transfer. We take reasonable steps to protect your personal information from unauthorised access, loss, use, modification, or disclosure, including:

  • Encrypted connections (HTTPS/TLS) for all data in transit
  • Passwords stored using bcrypt hashing (one-way, not reversible)
  • Two-factor authentication (TOTP) available and encouraged for all accounts
  • Access controls limiting who can access your data within our systems

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

8. Data Retention

We retain your personal information for as long as your account is active, or as long as needed to provide the Service. When you delete your account:

  • Your profile information and credentials are deleted
  • Your documents and content are permanently deleted
  • Chat history is permanently deleted
  • Anonymised usage statistics (e.g. aggregate token counts) may be retained

We may retain information for a reasonable period where required by law or for the purposes of resolving disputes.

9. Your Rights Under the Privacy Act 2020

Under the Privacy Act 2020, you have the right to:

  • Access your personal information (IPP 6) — you may request a copy of the personal information we hold about you
  • Correct your personal information (IPP 7) — you may request correction of information that is inaccurate, out of date, incomplete, or misleading
  • Know why we collect your information and who we share it with (IPPs 3 and 11)
  • Complain to the Office of the Privacy Commissioner (OPC) if you believe we have breached the Act — see privacy.org.nz

To exercise your rights, contact us at privacy@ingenialabs.co.nz. We will respond within 20 working days as required by the Act.

10. Privacy Breach Notification

Under section 113 of the Privacy Act 2020, we are required to notify the Privacy Commissioner and affected individuals of any privacy breach that has caused (or is likely to cause) serious harm. We will notify you as quickly as practicable if your personal information is involved in such a breach.

11. Cookies and Local Storage

We use your browser's local storage (not cookies) to store your authentication token and user preference cache. We do not use third-party tracking cookies or advertising pixels. We do not use analytics platforms that track you across websites.

12. Children's Privacy

The Service is not intended for use by persons under the age of 16. We do not knowingly collect personal information from children. If we become aware that a child under 16 has provided us with personal information, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this page and, where appropriate, by notifying you via email. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

14. Contact Us

For any privacy-related questions, requests, or complaints, please contact us at:

  • Email: privacy@ingenialabs.co.nz
  • Country: New Zealand

If you are not satisfied with our response, you have the right to contact the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909.