Privacy policy
What personal information Typestream collects, why, where it's kept, who we share it with, and your rights under New Zealand's Privacy Act 2020.
This policy explains what personal information Typestream Limited ("Typestream", "we") collects, why, where it's kept, who we share it with, and your rights. It's written to meet New Zealand's Privacy Act 2020.
It covers you when you visit our website, contact us, or use Typestream. When an organisation puts personal information into Typestream (in its chats or subject profiles, say), that organisation decides what happens to it, and we process it for them under our data processing agreement.
Our privacy officer
Our privacy officer handles privacy questions, requests and complaints. Write to privacy@typestream.nz.
What we collect
- Your account: your name, email address, profile picture if you add one, and, if you sign in with Microsoft or your organisation's SSO, the account identifier they send us. Your password is stored only as a secure hash.
- Your organisation: its name, logo, members and their roles, invitations, and sign-in settings.
- What you put in: subjects and their profiles, chats and questions, dashboards, monitors, notification settings and channels.
- Billing: your plan, credit purchases and invoices. Card details go to Stripe directly and never reach us.
- Technical information: requests to our servers, with their time, a request id, your IP address and browser, used to run the service, keep it secure and limit abuse. Error reports never include personal information.
- Messages: what you send through our contact form, in-app Feedback (with the page you were on and a request id), and email.
- Email delivery: whether emails we send you arrived, bounced or were marked as spam.
We also process public news articles, which mention people: journalists in bylines, and people in the news. We keep an article's headline, byline, dates and text to answer our customers' questions about coverage, show them only a headline, a snippet and a link, and delete articles' stored text when publishers ask us to.
How we use it
To provide Typestream: signing you in, running your organisation's subjects, answering questions, sending alerts and emails you've asked for, billing, and support. To keep it secure and working: preventing abuse, investigating errors, and planning capacity. To tell you about changes to the service or these policies. We don't sell personal information, and we don't use your content to train AI models.
Our marketing website uses Vercel Web Analytics, which counts visits without cookies and without identifying you.
Where it's kept, and who we share it with
We store personal information in New Zealand, in Amazon Web Services' Auckland region. Some service providers process it elsewhere, as our subprocessor list sets out. Most importantly:
- Your chat messages, questions and subjects' profiles are sent overseas to the AI model providers (through OpenRouter) that answer them.
- Stripe processes billing, Resend sends email, Better Stack receives service logs, and Vercel serves the website.
When we send personal information overseas, we do so under the Privacy Act's rules for cross-border disclosure (information privacy principle 12): to providers subject to comparable safeguards, or under contracts that require them. We share personal information with others only if the law requires it, or to protect someone's safety.
How long we keep it
- Your account and your organisation's content: while the organisation exists. After it's deleted, 30 days, so it can be restored, then it's gone.
- Service logs: 90 days.
- Billing records: as long as tax law requires, seven years in New Zealand.
- Contact form and feedback messages: as long as we need them to help you.
- Database backups expire on their own schedule, after 14 days.
Security
Data is encrypted in transit and at rest, access is limited to the people who need it, and every change to an organisation is recorded in its audit log. See Security and data.
If a privacy breach is likely to cause someone serious harm, we'll tell the Privacy Commissioner and the people affected as soon as we practicably can, as the Privacy Act requires.
Your rights
You can ask for the personal information we hold about you, and ask us to correct it. We'll respond within 20 working days. You can also delete your account; if you're in an organisation, its owners may need to remove you first.
If you're not happy with how we've handled your information, tell our privacy officer. You can also complain to the Office of the Privacy Commissioner at privacy.org.nz.
Cookies
Typestream sets only the cookies it needs to sign you in. See our cookie policy.
Changes
We'll post changes here, and tell account holders by email before a significant change takes effect.