Privacy Policy

Effective Date: 23 September 2026

1. Who we are and how to contact us

Southern Vector Limited, NZBN 9429052764448, operates willdo. Our address is 26 Applefield Court, Northwood, Christchurch 8051, New Zealand. Contact [email protected], addressed to Tamas Ham-Szabo, Director and Privacy Officer, for privacy questions or requests.

This Policy covers our website, application, APIs, extensions and related services. It explains our practices under the New Zealand Privacy Act 2020 and other applicable privacy law. It is an information notice, not blanket consent to every possible use of information.

For account administration, our own marketing, and other purposes we determine, we are responsible for our information handling. When we process customer work on a business customer's behalf, that customer normally determines the purpose and instructions and our DPA applies. We remain responsible for our own obligations. A customer or its user cannot consent on behalf of another person without authority.

2. Information we collect and its sources

Account and contact information: names, business contact details, organisation, roles, invitations, authentication and security records, preferences, correspondence and, when relevant, billing and tax information.

Customer content: instructions, prompts, agent configurations, playbooks, messages, files, images, documents, connected-app records, tool requests and results, outputs, and information about people appearing in that material. We also hold related versions, extracted text, summaries, search indexes and execution records. Derived information may still identify a person.

Technical and usage information: IP address, device and browser details, timestamps, page and feature use, connection metadata, performance, model usage and operational or security logs. Model request and response logs can contain customer content; removing credentials does not remove all personal information.

Support information: enquiries, submitted reports, page URL, device and environment details, associated work identifiers and screenshots of the displayed willdo page. A submitted problem report can include the page's visible confidential content and create copies in support email, support systems and AI-assisted triage. It can also be sent to the relevant workspace owner. Do not submit an unnecessarily sensitive screen.

We collect information from you, customer organisations and their users, authorised connections and extensions, identity providers, support interactions, our website and, for our own business outreach, public business sources and sales-intelligence providers. Uploading a file can transfer it to us before you send a message. Required account or task information is needed to provide the relevant function; without it, the function may be unavailable.

Browser tools can transmit granted page content, URLs, screenshots and interaction results. Editor tools can transmit permitted files, code and command results. Current local dictation processes microphone audio on the device; submitted transcripts are processed as text. Spoken replies use a backend speech service. Local processing of one step does not mean all associated information stays on the device.

3. Why we use information

We use information as reasonably necessary to provide requested work and integrations; maintain context and saved results; manage accounts and access; communicate about the Service; investigate support issues; secure the platform; detect misuse; meet legal obligations; and address disputes.

We use appropriate account and usage information to understand adoption, improve the product and assess marketing effectiveness. We may use business contact information for lawful business communications, with an effective way to unsubscribe from marketing. Essential account and security messages are separate.

We do not sell customer content or personal information for money. Advertising platforms may receive the limited website and advertising information described below; that is separate from the processing of customer work. We do not use customer prompts, documents, connected-app records or outputs to target advertisements or build advertising audiences.

When collecting personal information indirectly for our own purposes, we take reasonable steps to give the notice required by applicable law unless an exception applies. Customers are responsible for their own lawful collection and notices, including notices to people whose information they bring into willdo. We cooperate where our processing requires additional information to be provided.

4. AI processing and training

A model request may include instructions, prior messages, summaries, relevant files or images, retrieved records, tool descriptions and proposed actions. A single task can involve several models and calls. Your selected work model is not necessarily the model used for every platform function.

We use willdo-selected models for operational functions such as authoring, summaries, integration preparation, Auto approval, support and investigations. These models can receive the content relevant to the function. The providers we appoint are identified in the provider list; using your own model key does not prevent this operational processing.

We do not use customer content to train or fine-tune models. Internal model improvement may use synthetic examples and non-content operational information only after personal information and confidential customer material have been removed so they cannot reasonably be reconstructed or linked back. Merely deleting names, hashing identifiers or converting text into vectors is not enough.

Inference, search indexing, temporary context, diagnostics and support are not model training. For willdo-appointed AI services receiving customer content, we require contractual and account settings consistent with our no-training commitment. Customer-appointed models operate under the customer's own provider agreements and settings. We do not promise that every external provider retains no information.

5. Who can receive or access information

We share information with your authorised recipients and connected services as instructed; suppliers supporting hosting, AI, communications and support; and service providers supporting our own accounting, analytics or marketing where relevant. The Service Providers, Recipients and Subprocessors list distinguishes these roles. Not every listed provider receives customer work, and a provider may have different roles for different activities.

Authorised senior personnel and approved operational AI tools may access relevant work, prompts, logs or database records to support the Service, investigate faults or misuse, and respond to security or legal issues. Access is limited by role, purpose and need. A private workspace does not mean information is inaccessible to the service operator. Workspace sharing follows actual access settings; an organisation administrator is not automatically entitled to every private conversation.

We may disclose information where required or otherwise permitted by law, including to protect legal rights or address serious security risks. A prospective business purchaser and its advisers may receive information under appropriate confidentiality safeguards, limited to what is necessary for the transaction. A successor must respect applicable obligations.

6. Overseas handling

Our primary AWS-hosted infrastructure is currently in the United States. Suppliers, model providers and authorised support personnel may process or access information outside New Zealand. We do not offer a general NZ-only storage guarantee. Provider-specific locations are recorded in our provider list as they are verified.

For overseas processing solely on our behalf, we require appropriate protection and remain accountable as required by law. Where an overseas disclosure is subject to information privacy principle 12, we use an applicable lawful basis, such as enforceable contractual safeguards providing comparable protection. General acceptance of this Policy is not permission to bypass those requirements. Customer-directed overseas connections must also be lawful.

7. Cookies, local storage and advertising

Essential cookies and similar storage support sign-in, security and settings. Browser and extension storage can also retain drafts, preferences, cached models and local artifacts. Clearing server-side information does not necessarily clear your device.

We may use Google Analytics for usage measurement and Google, LinkedIn and Reddit advertising tools on the public website. These tools can receive device identifiers, IP addresses, page visits, referral and campaign information, subject to applicable choices. We do not send work content or credentials to advertising tools, or place advertising pixels in authenticated work screens. We do not enable session replay over customer work.

CookieYes provides cookie information and preference controls where deployed. Optional tracking is activated only after consent where required, and choices can be changed through the website's cookie controls. Browser settings can also block or remove cookies, although essential features may stop working. A marketing unsubscribe does not necessarily change cookie choices.

8. Retention and deletion

We keep information only as long as needed for its purpose or a lawful retention requirement. Our standard periods are:

Record	Standard treatment
Active work, outputs, agent configurations and playbooks	Kept while needed for the customer's use, subject to available retention settings, deletion requests and account closure. The 30-day log period is not a blanket limit on primary work.
Archived work and archived content subject to automatic cleanup	Normally deleted from live storage after 30 days. Archive is not immediate erasure.
Routine operational and model-call logs	Normally retained for 30 days. Specific incident or dispute evidence may be isolated and retained longer where necessary.
Backups	Rolling retention of up to 30 days. Following deletion from live systems, a backup copy may remain for up to 30 additional days, restricted to recovery and legal needs.
Content-bearing support copies	Normally deleted or redacted within 30 days after the issue closes, unless needed for a continuing incident, dispute or legal obligation.
Account, billing, consent and legal records	Retained only for the relevant administration, proof or statutory purpose, not automatically for the lifetime of every customer-content copy.

You may request deletion at [email protected]. Subject to verifying identity and authority and any lawful reason to retain information, we will delete covered information from active systems within 30 days of the request, or sooner where law requires. We will promptly explain any verification issue, restriction or retained category. Backups follow the separate cycle above and, if restored, are subject to the deletion instruction again.

Closing a profile, removing a team member, detaching a file and disconnecting an app are not necessarily requests to erase every related copy. An organisation may retain records it is lawfully entitled to keep. We coordinate requests involving customer-controlled records without removing individuals' legal rights. We cannot recall information already sent to another recipient or erase customer-controlled devices or independently operated services.

9. Security and your rights

We use reasonable technical and organisational safeguards appropriate to the information and risk, including access controls, protection of supported connection credentials and restricted operational access. No service is completely secure. We do not claim end-to-end encryption against our own operation of the Service or certifications we have not obtained. We manage and notify privacy breaches as required by law and our DPA.

You may ask whether we hold personal information about you, request access, ask for correction, or make a privacy complaint. If a requested correction is not made, you may ask for a statement of correction to be attached. We respond within applicable statutory timeframes; decisions on NZ access and correction requests are generally due within 20 working days, subject to lawful extensions. Our 30-day deletion process does not replace those deadlines. Any refusal, extension or permitted charge will be explained as required by law.

Where we process information for a customer, we may coordinate with or direct your request to that customer, while meeting our own duties. You may also complain to the New Zealand Office of the Privacy Commissioner. Additional rights under another applicable law are not excluded.

10. Changes

We will update this Policy when our practices change and show the revised date. We will give reasonable advance notice of material changes where practicable, and obtain separate consent where required. An update does not retrospectively authorise an incompatible use of information.