Privacy Policy

We collect what's needed to run Arborly and to tell tree businesses about it. We don't sell your information, we don't use it for advertising, and you can see, correct or delete it.

This policy follows the New Zealand Privacy Act 2020. "We" means Arborly.

• About you and your business: name, email, phone, business name and address.
• About your crew: the names, emails and phone numbers you give us, their hazard sign-ons and the hours they log.
• About your clients: whatever you enter on a job, usually a name, address, phone number and email.
• Photos, videos and documents you upload.
• Location: the job addresses you enter, and, where you allow it on your device, location at the moment a sign-on or photo is recorded.
• Payment details: handled by Stripe. We see your plan, billing email and the last four digits of your card, never the full number.
• Technical information: when you sign in, your IP address when a sign-on is recorded, browser type, and error logs so we can fix problems.

We contact tree businesses about Arborly using business details they've published: listings on Google Maps and their own websites. We keep the business name, contact name, email, phone, website, address and region, and a record of what we've sent and whether you've replied.

Our emails may include a small image that tells us when an email is opened, and we read replies to work out whether you're interested so we don't bother you again if you're not.

Every email has an unsubscribe link, and we stop straight away. You can also ask us to delete your details at support@arborly.co.nz.

When you enter a client's or crew member's details, you're collecting them and we're storing them for you. It's up to you to tell them how you use their information, and to have permission to photograph clients' property.

We only use that information to run Arborly for you. We never contact your clients, except to send the quotes and invoices you ask the app to send.

• To run Arborly for you and your crew.
• To send you account emails: sign-in links, receipts, and changes to our terms.
• To fix problems and improve the app. We look at how features are used, not what's inside your jobs.
• To tell tree businesses about Arborly, as above.
• To meet our legal obligations.

Only the services that help run Arborly, and only what each one needs:

• Supabase: database and file storage, hosted in Sydney, Australia.
• Vercel: runs our website and app, with servers in Sydney and elsewhere.
• Stripe: subscriptions and payments.
• Resend: sends and receives our emails.
• Twilio: sends the text messages you ask the app to send.
• Xero: only if you connect it, and only the quotes and invoices you send there.
• Google: business listings (Google Places), used to find tree businesses.
• Anthropic, via Vercel's AI Gateway: reads replies to our emails so we know who's interested. Not used on the data inside your jobs.

We'll share information if the law requires it. We'll never sell it.

Most of our providers store information in Australia or the United States. Before sending information overseas we check the provider protects it to standards comparable to New Zealand's Privacy Act, usually through their contracts and security certifications.

Our website and app use a small number of cookies: ones we need to keep you signed in and remember your cookie choice, and, only if you say yes, analytics. Our Cookie Policy has the list.

For as long as your account is open. If you close it, everything is deleted 30 days later, in case you change your mind.

Outreach records are kept until you unsubscribe or ask us to delete them, or for two years without a reply, whichever comes first.

We keep records of when you agreed to our terms, and billing records, for as long as the law requires (for tax, seven years).

Your data is encrypted in transit and at rest, and each business can only ever see its own. Crew logins only see the jobs they're on, and never prices.

If there's a privacy breach likely to cause serious harm, we'll tell you and the Privacy Commissioner as soon as we can.

You can ask to see or correct any personal information we hold about you, and ask us to delete it. Most of it you can view and change in the app yourself. We'll respond within 20 working days.

Owners can download all their business's data from Settings, and delete the account from there too.

Crew members can ask the business they work for, or email us directly.

Arborly isn't for anyone under 16, and we don't knowingly collect their information. If you think we have, tell us and we'll delete it.

Our privacy officer is Hamish Cross, at support@arborly.co.nz.

If you're not happy with how we've handled your information, tell us first. You can also complain to the Office of the Privacy Commissioner at privacy.org.nz.

If we change this policy, we'll update the date at the top and, for significant changes, let customers know by email or in the app.