1. Scope and application
This Privacy Policy applies to:
- Visitors to the Airclerk website
- Customers and authorised users of the Services
- Individuals whose personal information is submitted to the Services by our customers (for example, insurance applicants or insured parties)
Airclerk primarily provides Services to businesses. Where we process personal information on behalf of our customers, we act as a "processor" (or service provider), and our customers act as the "agency" (or controller) of that information under the Privacy Act 2020.
2. Compliance with New Zealand law
Airclerk complies with the Privacy Act 2020 (New Zealand) and the Information Privacy Principles (IPPs).
Where applicable, we also take reasonable steps to align with international privacy standards relevant to our customers, including GDPR-inspired safeguards for cross-border data transfers.
3. Personal information we collect
3.1 Information you provide directly
We may collect personal information that you or your organisation provide, including:
- Name, email address, phone number
- Business name, role, and organisation details
- Account credentials and authentication information
- Support requests and communications
- Billing and payment-related contact information
3.2 Customer-submitted data
When you use the Services, you may submit or upload data that includes personal information relating to third parties, such as:
- Insurance applicants or policyholders
- Directors, employees, contractors, or beneficiaries
- Claims history, underwriting information, or policy details
3.3 Automatically collected information
We may automatically collect limited technical information, including:
- IP address
- Device and browser type
- Usage logs and activity metadata
- Date, time, and duration of access
This information is used primarily for security, reliability, and service improvement.
4. How we use personal information
We use personal information only for legitimate business purposes, including to:
- Provide, operate, and maintain the Services
- Process and respond to support requests
- Authenticate users and secure accounts
- Monitor usage, performance, and security
- Improve and develop our Services
- Meet legal, regulatory, and contractual obligations
- Communicate important service updates or notices
Airclerk does not use personal information to provide regulated financial advice.
5. Use of artificial intelligence
Human-in-the-loop requirement
The Services are assistive only.
All AI-generated outputs must be reviewed and approved by a human before being relied upon or shared externally.
In accordance with our Terms and Conditions, the user remains the system of record. Airclerk's AI tools are designed to assist, not replace, the professional verification of data.
No model training on customer data
Airclerk does not train its own foundation models using customer data.
Where available, we configure third-party AI providers to disable the use of customer data for model training or improvement. However, the practices of third-party providers may evolve, and we will take reasonable steps to maintain configurations that protect customer data.
AI limitations
AI-generated outputs may be incomplete, inaccurate, or misleading. You remain responsible for validating all outputs and for any decisions made using the Services.
6. Disclosure of personal information
We may disclose personal information only in the following circumstances:
6.1 Subprocessors and service providers
We use trusted third-party providers to support our Services, including:
- Cloud hosting and infrastructure providers
- AI model providers
- Security, monitoring, and analytics providers
- Customer support and communication tools
These providers process personal information only under our instructions and are subject to contractual confidentiality and security obligations.
A current list of subprocessors is available via our Trust Centre or on request.
6.2 Legal and regulatory requirements
We may disclose personal information where required to do so by law, court order, or regulatory authority, or where disclosure is reasonably necessary to protect our legal rights or prevent harm.
6.3 Business transfers
If Airclerk is involved in a merger, acquisition, or asset sale, personal information may be transferred as part of that transaction, subject to appropriate confidentiality safeguards.
7. Cross-border data transfers
The Services rely on infrastructure and subprocessors located outside New Zealand, primarily in the United States.
Airclerk takes reasonable steps to ensure that overseas recipients provide comparable safeguards for personal information, including:
- Contractual data protection obligations
- Data processing agreements
- Security and access controls
By using the Services, you acknowledge that personal information may be processed outside New Zealand.
8. Data security
Airclerk implements reasonable technical and organisational safeguards to protect personal information, including:
- Encryption in transit and at rest where appropriate
- Access controls and least-privilege principles
- Monitoring, logging, and incident response processes
- Secure development and deployment practices
Airclerk maintains a formal information security program and is actively pursuing independent security certifications to validate our controls.
No system is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.
9. Data retention
During subscription
Personal information is retained for the duration of your active subscription to enable delivery of the Services.
After termination
Following termination or expiry:
- Customer data is retained for 30 days to allow data export or account reactivation
- After this period, customer data is deleted from production systems within a reasonable timeframe, unless retention is required by law or for legitimate business purposes
Backups
Encrypted backup copies may persist for a limited period in accordance with our backup retention policies and are automatically purged thereafter.
10. Your privacy rights
Subject to the Privacy Act 2020, you may request to:
- Access personal information we hold about you
- Request correction of inaccurate or incomplete information
- Request deletion of personal information, which will be handled in accordance with our data retention policy and legal obligations
Requests can be made by contacting us using the details below. We may need to verify your identity before responding.
Where we process personal information on behalf of a customer, requests should be directed to that customer as the data controller.
If you are an individual whose data was submitted by one of our customers (e.g., an insurance client of a broker), please direct your access, correction, or deletion requests to that broker. We will support our customers in responding to such requests as required by law.
11. Cookies and tracking
We may use cookies or similar technologies to support basic website functionality, security, and analytics.
Essential cookies are used for authentication, security, and core functionality.
Analytics cookies may be used to understand how visitors interact with our website. We use Google Analytics, which may transfer data to the United States.
You can control cookie settings through your browser. Disabling cookies may affect certain features of the Services.
12. Privacy breach notification
In the event of a privacy breach that poses a risk of serious harm, Airclerk will:
- Notify the Office of the Privacy Commissioner as required under the Privacy Act 2020
- Notify affected individuals where required by law or where appropriate in the circumstances
- Take reasonable steps to contain the breach and prevent further unauthorised access
Where Airclerk is acting as a processor on behalf of a customer, we will notify the affected customer promptly so they can meet their own notification obligations.
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time.
Material changes will be communicated via the Services or by email where appropriate. Continued use of the Services after an update constitutes acceptance of the revised Privacy Policy.
14. Contact us
If you have questions, concerns, or requests relating to privacy or this Privacy Policy, contact us at:
Airclerk Limited
Email: support@airclerk.ai
Website: https://www.airclerk.ai