Privacy Policy

1. Who We Are

JobNest ("we", "us", "our") is a cloud-based service business management platform operated from New Zealand. We provide scheduling, invoicing, client management, and team coordination tools for service businesses.

This Privacy Policy explains how we collect, use, disclose, and protect personal information in accordance with the New Zealand Privacy Act 2020 and the thirteen Information Privacy Principles (IPPs).

Our Privacy Officer can be contacted at hello@jobnest.co.nz for any privacy-related enquiries.

2. Information We Collect

2.1 Account Information

When you register, we collect your name, email address, and password (hashed). If you continue with Google, we receive your Google account identifier, verified email address, and name. We do not store your Google password, profile picture, or Google access and refresh tokens.

When you create or activate an account, we also record when you accepted our Terms of Service and Privacy Policy, and which versions you accepted.

When you create an account, we record the campaign details from the link you came from (the UTM parameters: source, medium, campaign, content and term, and the landing page version) with your account, so we know which ads bring in customers. We also record the name of the website that sent you to us (for example google.com or chatgpt.com), if your browser shares it. We keep only the website name, never the page address or what you searched for.

2.2 Business & Client Data

As a business user, you may enter information about your clients, properties, jobs, invoices, quotes, and team members. This can include:

• Client names, email addresses, phone numbers, and physical addresses
• Property details and access codes
• Job scheduling, notes, photos, and checklists
• Invoice and quote line items, amounts, and payment status
• Team member names, contact details, emergency contacts, dates of birth, hourly rates, and employment details

We hold this information about your clients and staff as your agent under section 11 of the Privacy Act 2020: we store and process it only to provide the Service to you, not for our own purposes, and it is treated as held by you. You are responsible for having a lawful basis to collect it and for telling those people what you collect and why. If one of them asks us to access or correct their information, we will pass the request on to you.

2.3 Payment Information

Payment processing is handled by Stripe. We do not store your credit card details. Stripe's privacy policy governs the handling of payment data.

To stop our offers and guarantees being claimed more than once, we may keep a code made from the technical identifier Stripe gives us for the card or cards you pay with (not the card number), from the ID of the Xero organisation you connect, from your business phone number and from your business name. Each code is made with a secret key and cannot be turned back into the original details. See sections 3 and 6.

2.4 Usage & Technical Data

We automatically collect technical data including IP addresses, browser type, device information, and pages visited. We use Sentry for error monitoring, which may capture technical context when errors occur.

2.5 Communications

Public JobNest accounts use email for client confirmations. We retain delivery status and response data when you or your clients interact with those emails. A private operator tenant also uses SMS and WhatsApp workflows; those channels are not a feature sold to public tenants.

3. How We Use Your Information

We use personal information to:

• Provide and operate the JobNest platform
• Process payments and manage subscriptions
• Send transactional emails (confirmations, invoices, password resets)
• Send client confirmation and transactional emails on your behalf
• Synchronise data with third-party integrations you connect (e.g. Xero)
• Monitor and improve platform performance and security
• Prevent misuse of our offers and guarantees, such as the founding discount and the Time-Back Guarantee (see section 2.3)
• Respond to support requests
• Comply with legal obligations

We do not sell your personal information to third parties.

4. Third-Party Services

We use the following third-party services to operate the platform. Each processes data in accordance with their own privacy policies:

• Stripe, Payment processing
• Xero, Accounting integration (connected by you)
• Cloudinary, Photo and file storage
• Cloudflare, Separate backup storage for photos and files
• Resend / SMTP, Email delivery
• ClickSend, SMS delivery for the private operator tenant only
• WhatsApp (Meta), Messaging for the private operator tenant only
• OpenAI, AI features (United States). Only what the feature needs is sent: business settings and your messages for the AI assistant; your business and service name for message drafts (client names, dates, times and amounts are filled in after, not sent); the client's name, feedback text and the staff member who visited for feedback replies and triage; column names and sample rows (with emails, phone numbers and sensitive fields masked) plus client names and prices when you import a spreadsheet; and scheduling constraints (such as preferred days or time windows) extracted from job notes, not the note text itself, for route suggestions. OpenAI does not use data sent through its API to train its models.
• Google Places API, Address autocomplete
• Google Authentication, Optional account sign-in
• Sentry, Error monitoring and performance
• Neon, Database hosting (PostgreSQL)
• Vercel, Application hosting
• Meta Platforms, Inc., Optional advertising measurement and remarketing on eligible public pages and signup (United States). In the European Union, the EEA, the United Kingdom and Switzerland we ask for your permission first. Everywhere else, including New Zealand, we use it unless you opt out (see section 9).

5. Data Storage & Security

Your data is stored in secure, encrypted databases hosted by Neon (PostgreSQL). The application is hosted on Vercel. Both providers use industry-standard security measures.

We implement the following security measures:

• Encryption in transit (TLS/HTTPS) for all connections
• Password hashing using bcrypt
• Multi-tenant data isolation, each business's data is logically separated and inaccessible to other tenants
• Role-based access control (RBAC) with granular permissions
• Rate limiting on authentication and public endpoints
• Security headers (HSTS, CSP, X-Frame-Options)
• Audit logging of data changes

While we take reasonable steps to protect your data, no system is completely secure. We encourage you to use a strong password and keep your credentials confidential.

6. Data Retention

We retain your data for as long as your account is active. When you delete records (clients, jobs, invoices), they are soft-deleted and excluded from normal queries. You may request permanent deletion of your data at any time.

If you cancel your subscription and close your account, we will delete your data within 90 days, unless retention is required by law (e.g. tax records under the Tax Administration Act 1994). Backup copies are the exception, see below.

Offer and guarantee checks. The one-way codes described in section 2.3 are also an exception to the 90 days. We keep each code for 24 months after it is first recorded, because we have a legitimate need to stop the same offer or guarantee being claimed twice, including by a business that closes its account and signs up again. The codes contain nothing readable. While your account exists, each code is linked to it. When the account is deleted, that link is removed: the codes stay without being linked to any account, and are then deleted automatically at the end of the 24 months.

Backups. We take a scheduled backup of the database every day, and each day we copy photos and files to separate private storage with another provider (Cloudflare), to help us restore the Service after a failure. Copying of photos that were already stored is still in progress, so many photos have not been copied yet.

Scheduled database backups are deleted automatically within 35 days. So when data is permanently removed from the live database, including when we delete your data after you close your account, it drops out of our scheduled backups within that time.

Backup copies of photos and files are not yet deleted automatically, including photos and files you delete in the app. They are kept until we remove them, and a deletion request under section 7 covers them too.

Backups are a safeguard, not a guarantee. We make backups with reasonable efforts to help restore the Service after a failure, but we cannot promise that every record or photo can be recovered. We recommend keeping your own copies of records you must retain by law, such as tax and employment records, and of photos you want to keep.

7. Your Rights Under the Privacy Act 2020

Under the New Zealand Privacy Act 2020, you have the right to:

• Access, Request a copy of the personal information we hold about you (IPP 6)
• Correction, Request correction of inaccurate personal information (IPP 7)
• Deletion, Request deletion of your personal information, subject to legal retention requirements
• Complaint, Make a complaint to the Office of the Privacy Commissioner if you believe we have breached the Privacy Act

To exercise any of these rights, contact us at hello@jobnest.co.nz. We will respond within 20 working days.

8. Cross-Border Data Transfers

Some of our third-party providers process data outside of New Zealand (primarily in the United States and the European Union). In accordance with IPP 12, we only transfer data to jurisdictions or providers that have comparable privacy protections, or where you have authorised the transfer by using the relevant integration.

This includes OpenAI in the United States, which processes the limited data described in section 4 when you use an AI feature. Under OpenAI's API terms, that data is used only to provide its service to us and not to train its models; we rely on those terms as comparable safeguards for this transfer. If you prefer that this data does not leave New Zealand, do not use the AI features.

Meta Platforms, Inc. processes optional advertising measurement information in the United States when advertising cookies are used (see section 9). The safeguards and authorisation requirements described above also apply to this transfer. You can decline when we ask, or opt out at any time, through Cookie settings.

9. Cookies & Analytics

If you arrive from a link with campaign details, we keep those details in your browser's local storage until you create an account or for up to 30 days, whichever comes first. This is not a cookie. If you arrive from another website, we keep only that website's name in the same way.

We use essential cookies for authentication and session management. Error monitoring through Sentry may collect technical information when errors occur.

On our public website and signup page (never inside the signed-in JobNest app) we also use optional cookies and similar technologies:

• Analytics. Google Analytics uses first-party cookies to measure visits to our public pages and completed signups, so we can understand how people find JobNest and improve the website. We do not send form entries to Analytics. Google explains how it processes information from sites using its services.
• Advertising. The Meta Pixel measures JobNest ads and lets us show JobNest ads to people who have visited our website. It runs on eligible public pages and our signup page only.
• Session recording. Microsoft Clarity records how visitors use our public pages and signup page (clicks, scrolling, mouse movement, pages viewed, and browser and device information) so we can see where people get stuck. Form fields are masked, so what you type is not recorded. Clarity uses first-party cookies including _clck and _clsk to recognise a browser and join page views into one session recording, and Microsoft may set cookies of its own. It does not run inside the signed-in JobNest app. It follows your Analytics choice: where we ask first it loads only if you allow analytics, in New Zealand it loads unless you opt out, and declining analytics in Cookie settings stops it and removes its cookies where your browser permits. Microsoft explains how it handles data in its privacy statement.

When you use the signed-in JobNest app, we also set a first-party functional cookie called jobnest_member_v1 in your browser; it contains no personal information (just the value 1) and is used only to keep the optional analytics, advertising and session recording tools described above switched off for that browser on our public pages, including after you sign out, and it expires after 400 days or when you delete it.

Where we ask first. If you are in the European Union, the European Economic Area, the United Kingdom or Switzerland (including Jersey, Guernsey, the Isle of Man and Gibraltar), we ask for your permission before these optional cookies are used. Everywhere else, including New Zealand, we show a short cookie notice and use them unless you opt out. We work out which applies from the approximate country of your connection, which our hosting provider supplies to us; if we cannot tell, we ask first. If your browser sends a Global Privacy Control signal, we treat it as opting out until you choose otherwise in Cookie settings.

Meta receives the page URL and referrer, browser and device information, attribution identifiers such as an ad click identifier, and the fact that an account was created with the selected plan. It may use cookies including _fbp and _fbc to recognise a browser and attribute visits to ads. We do not copy signup form fields, including names, email addresses, phone numbers or passwords, user IDs or business records into Pixel event parameters. The registration event parameters JobNest builds contain only the selected plan and registration status. We do not enable advanced matching.

Campaign parameters are part of the full page URL sent to Meta. We validate their format, but this does not guarantee that they contain no personal information. We do not put personal information in our advertising links.

You can change your choices at any time using Cookie settings in the footer or the button below. Opting out stops further events and removes our analytics and advertising first-party cookies where your browser permits; it does not recall information already sent. We remember your choice in your browser, using a first-party preference cookie and browser storage where available. If we cannot save an advertising refusal persistently, advertising stays off on the current page and we show a notice; another tab or session may still use an earlier permission until the refusal can be saved. You can also manage your Meta ad preferences.

10. Children's Privacy

JobNest is designed for business use and is not intended for individuals under the age of 16. We do not knowingly collect personal information from children.

11. Data Breach Notification

If we become aware that personal information we store or process has been lost, or accessed or disclosed without permission, we will tell the businesses affected as soon as we can, so they can meet their own obligations. If it is a notifiable privacy breach under Part 6 of the Privacy Act 2020 (one that it is reasonable to believe has caused, or is likely to cause, serious harm to an affected individual), we will also notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, where the Act requires us to.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice within the platform. The "Last updated" date at the top indicates the most recent revision.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

• Email: hello@jobnest.co.nz
• Website: jobnest.co.nz

You may also contact the Office of the Privacy Commissioner if you have concerns about how we handle your personal information.