Privacy Policy

This privacy policy explains how LAXXY Technology and Innovation Limited (NZBN 9429052478567, NZ Company Number 9295806) collects, uses, stores and shares personal information about you. We comply with the New Zealand Privacy Act 2020 and the 13 Information Privacy Principles ("IPPs") it contains.

If you have any questions about this policy or how we handle your information, contact us at [email protected].

Quick summary: We collect what we need to run the service — your email, payment info, business details and how you use LAXXY. We don't sell your data. We use trusted third-party services (Cloudflare, Google Firebase, Stripe, Anthropic) to run the system. You can ask to see, correct, or delete your information at any time.

Contents

Who we are
Information we collect
How we use it
Who has access
Where data is stored
How long we keep it
Cookies and tracking
Your rights
Children's privacy
Security
Data breaches
Changes to this policy
Contact and complaints

1. Who we are

LAXXY Technology and Innovation Limited is a New Zealand registered company providing AI-powered website creation, hosting, and related services. We are the "agency" for the purposes of the Privacy Act 2020 — meaning we are the entity responsible for the personal information we collect and hold.

2. Information we collect

We collect personal information in three main ways: when you give it to us, when our service automatically records it, and when other services share it with us as part of running the system.

Information you give us

Account details — name, email address, phone number (optional), password (encrypted).
Business brief — business name, location, what you do, your differentiator, your target audience, and any other information you enter into the website builder.
Site content — text, images, logos and other media you upload for use on your generated website.
Payment information — your card details are entered directly into Stripe's payment form. We don't see or store your full card number, only a token from Stripe identifying your subscription.
Support communications — emails you send us, chat messages in the in-builder support, and any feedback you provide.

Information collected automatically

Usage data — which pages you visit, when you log in, what features you use, errors you encounter.
Device data — browser type, operating system, screen size, approximate location based on IP address.
IP address — used for security, fraud prevention, and approximate geolocation for analytics.
Cookies — see section 7.

Information from third parties

Stripe — payment confirmations, subscription status, billing history.
Email provider — delivery confirmations and bounces.
GoHighLevel (CRM) — payment events and customer record information.

3. How we use it

We use your information for the following purposes:

Providing the service — generating your website, hosting it, processing edits, providing support.
Billing and account management — processing payments, sending invoices, managing your subscription.
Communication — service announcements, billing notifications, support replies, and (with your consent) occasional product updates.
Improving our service — analysing aggregated usage data to fix bugs, improve features, and prioritise new tools.
Security and fraud prevention — detecting suspicious logins, preventing chargebacks, blocking abuse.
Legal compliance — responding to lawful requests from authorities, complying with our tax and accounting obligations.

We do not use your business brief or site content to train any AI model. We do not sell your personal information to anyone, ever.

4. Who has access

Only the people and services that need access to run LAXXY can see your information. The main parties are:

Party	What they access	Why
LAXXY staff	Your account, brief, and site content as needed for support	To provide the service, support you, and operate the business
Stripe	Your payment details	To process payments securely
Google Firebase	Your account data, brief, and site versions	Database hosting (region: Sydney, Australia)
Cloudflare	HTTP requests, IP addresses, hosted site content	Worker compute, content delivery, DDoS protection
Anthropic	Your business brief during AI generation	Powers the AI website builder. Anthropic does not use this data to train their models.
OpenAI	Image prompts during image generation	AI image generation for hero sections and gallery placeholders. Not used for training.
GoHighLevel	Email, payment events, contact record	Customer relationship management (CRM)
Email provider	Email address, message content sent to you	Sending account and support emails

Each of these third parties has their own privacy practices. We choose providers that meet reasonable security and privacy standards.

We do not share your personal information with anyone outside this list except where required by law (e.g. a court order or police request) or with your specific permission.

5. Where data is stored

Your personal information is stored across services located outside New Zealand:

Firebase / Firestore — Sydney, Australia (region: australia-southeast1).
Cloudflare — distributed globally; primarily routed through their nearest datacentre to your visitors.
Stripe — primarily United States; subject to Stripe's privacy practices.
Anthropic and OpenAI — primarily United States.
GoHighLevel — primarily United States.

By using LAXXY you consent to your information being stored and processed in these countries. Where personal information leaves New Zealand, we take reasonable steps to ensure it is protected by comparable safeguards as required by IPP 12 of the Privacy Act 2020.

6. How long we keep it

We keep personal information only as long as needed for the purpose it was collected:

Active accounts — for the duration of your subscription, plus 12 months after cancellation in case you reactivate.
Site content — kept while your site is hosted with us, plus 12 months after cancellation. After that we delete your generated site versions.
Billing and payment records — kept for 7 years to comply with NZ tax and accounting law.
Support emails — kept for 3 years for reference and quality.
Logs and usage data — most logs are retained for 30-90 days and then automatically deleted.

You can request earlier deletion at any time — see section 8.

7. Cookies and tracking

LAXXY uses minimal cookies, only what's needed to run the service:

Authentication cookies — keep you logged in across pages.
Session cookies — track your current builder session and preferences.
Security cookies — used by Cloudflare for fraud detection and DDoS protection.

We do not use cookies for advertising, retargeting, or tracking you across other websites. We do not sell cookie data to advertisers.

If you visit websites that LAXXY hosts on behalf of customers, those websites may use their own analytics or marketing tools (e.g. Google Analytics). Each customer's site is responsible for its own cookie disclosure.

8. Your rights

Under the New Zealand Privacy Act 2020 you have the following rights regarding your personal information:

Right to access — request a copy of the personal information we hold about you.
Right to correction — ask us to correct information that is wrong or out of date.
Right to deletion — request that we delete your personal information when you no longer need our service. Some information may need to be kept for legal reasons (e.g. tax records).
Right to data portability — request your site's HTML and content in a transferable format. We provide this as an HTML file via email.
Right to withdraw consent — opt out of optional marketing emails at any time.
Right to complain — to the Office of the Privacy Commissioner (see section 13).

To exercise any of these rights, email [email protected] from the email address on your account. We respond to access and correction requests within 20 working days as required by law.

9. Children's privacy

LAXXY is not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from children. If you become aware that a child has provided personal information to LAXXY without their parent's consent, contact us at [email protected] and we will delete it promptly.

10. Security

We take reasonable steps to protect your personal information from loss, unauthorised access, modification or disclosure. These steps include:

Encryption of data in transit (HTTPS/TLS) for all connections.
Encryption at rest for stored data on Firebase.
Restricted internal access — only authorised LAXXY staff can access customer records, on a need-to-know basis.
Strong password and credentials handling — passwords are hashed, not stored in plain text.
Regular review of security practices and partner services.

No system is 100% secure. If you suspect a security issue, please notify us immediately at [email protected].

11. Data breaches

If a privacy breach occurs that is likely to cause serious harm, we will notify you as soon as reasonably practicable, and notify the Office of the Privacy Commissioner as required by the Privacy Act 2020.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will email you and update the "Last updated" date at the top of this page. We will also display a notice on the LAXXY website for at least 14 days. Continuing to use LAXXY after the changes take effect indicates that you accept the updated policy.

13. Contact and complaints

Contact us

Support email: [email protected]
Company: LAXXY Technology and Innovation Limited
NZ Company Number: 9295806
NZBN: 9429052478567

Our registered office address is on the public Companies Office register and can be searched at companies-register.companiesoffice.govt.nz.

Complaints to the Privacy Commissioner

If you believe we have not handled your personal information appropriately and we haven't been able to resolve your concern directly, you can complain to the Office of the Privacy Commissioner:

Website: privacy.org.nz
Phone: 0800 803 909
Email: [email protected]
Post: PO Box 10094, Wellington 6143, New Zealand