We collect the information we need to open your account, run the platform for you, take payment and keep the service secure. You keep ownership of your own business and customer records, and we handle your customers' information only on your instructions. When we or our customers research businesses, we use only what those businesses published about themselves, never a data broker. We do not sell personal information, we do not rent or trade contact lists, and we do not use your customer records to advertise to your customers on our own behalf.
The full policy below governs. Where the summary and the policy differ, the policy applies.
1. Who we are
KahuLogic is operated by Kahu Logic Limited, a company incorporated in New Zealand (NZBN 9429053390776) ("KahuLogic", "we", "us", "our"). We serve customers worldwide, with New Zealand and Australia as our home markets. In this policy, "personal information" has the meaning given to it in the Privacy Act 2020 (NZ) and, where the Australian Privacy Principles apply, the meaning given to it in the Privacy Act 1988 (Cth).
We have appointed a Privacy Officer, who is responsible for how we handle personal information. You can reach the Privacy Officer at privacy@kahulogic.com.
2. Scope and our role
This policy applies to personal information we collect through this website, the KahuLogic web and mobile apps, and our related services (together, the "Services"). We handle personal information in accordance with the information privacy principles in the Privacy Act 2020 (NZ). Where we handle personal information about individuals in Australia, or otherwise carry on business in Australia, we also handle it consistently with the Australian Privacy Principles. Where the law of your own country sets a stronger standard, we apply that standard to your information.
We act in two different roles, and this policy is written around the difference:
- For our own purposes. We decide how to handle information about our customers and their users (accounts, billing, support), visitors to this website, people who contact us or subscribe to our updates, and the business contact details we research for our own sales outreach (section 6). For this information we are responsible under privacy law, and this policy is our notice to you.
- On a customer's behalf. When a business uses the Services to handle information about its own customers, contacts, staff, website visitors or callers ("Customer Data"), that business decides how the information is used and remains the agency or entity responsible for it. We process Customer Data on its instructions, under our Terms of Service and Data Processing Addendum. If you are one of our customer's customers, please read that business's own privacy policy and contact it first; section 14 explains how we help.
3. Information we collect
We collect the following categories of information:
- Account and contact information. Name, business name, role, email address, telephone number where you provide it, sign-in details and account preferences.
- Billing information. Plan, subscription status, credit balance and purchases, promotion codes applied, invoices and transaction records. Card and bank details are collected and stored by our payment provider. We do not store full payment card numbers.
- Customer content and Customer Data. Material you or your authorised users upload, enter, generate or connect through the Services, including brand material, website content, records about your customers and contacts, messages and campaigns, bookings, enquiries submitted through websites you publish with us, call audio and transcripts, and images, video or voice recordings you supply to create content.
- Connected account data. Where you authorise a connection to a third-party account, the data that account makes available to us for the purposes you have authorised (section 10).
- Business research information. Information about businesses that the businesses themselves published, which section 6 describes.
- Website and chat information. What you submit through forms on this website, including our product-updates sign-up, and what you write to the KahuLogic chat assistant on this website.
- Technical and usage information. Device and browser type, IP address, approximate location derived from IP address, pages and features accessed, how you interact with them (such as where you click and how far you scroll, which Microsoft Clarity records as section 11 describes), dates and times of access, the campaign or page that referred you, and diagnostic logs. When you are signed in, we record which features you use against a pseudonymous identifier derived from your account ID (a one-way hash), together with your workspace, role and plan tier, so we can see how the product is actually used over time rather than only in aggregate. That record never includes the content you create or the personal information of your customers.
- Communications. Enquiries, support requests and correspondence with us.
We do not seek to collect sensitive information, such as health, biometric, racial or ethnic, religious, sexual orientation, criminal record or government identifier information. Please do not submit it through the Services unless we have expressly agreed in writing to receive it. If your business is in a regulated field, such as health care, you are responsible for deciding whether the Services are suitable for the information you hold.
4. How we collect it
We collect information directly from you when you create an account, configure the Services, contact us, subscribe to our updates or submit content. We collect technical and usage information automatically when you use the Services. We collect information from third-party accounts only where you have authorised that connection, and only to the extent required to provide the Services you have asked for. We receive Customer Data from the customer who uploads or connects it. We collect business research information from public sources, as section 6 describes. Where it is reasonable and practicable to do so, we collect personal information directly from the individual concerned.
5. How we use it
We use personal information to create and administer accounts; to provide, maintain and improve the Services; to prepare the drafts and outputs you ask for; to provide support and respond to enquiries; to process payments, credits and promotions and administer subscriptions; to understand which features are used and how the product performs; to attribute sign-ups to the campaign or page that referred them; to detect, investigate and prevent fraud, abuse and security incidents; to keep records and logs of activity in your workspace; to comply with our legal obligations and enforce our terms; and to send service and administrative messages about your account.
We send marketing messages about our own products only where you have subscribed, where you are our customer, or where we are otherwise permitted to by law, including by contacting a business address that has been conspicuously published where the message is relevant to the recipient's business role. Every marketing message identifies us and includes a working unsubscribe method, in line with the Unsolicited Electronic Messages Act 2007 (NZ) and the Spam Act 2003 (Cth). You can opt out at any time by using that method or by writing to privacy@kahulogic.com, and we action opt-outs within five working days. Operational messages, for example billing receipts or service notices, are not marketing and will continue to be sent.
We do not sell, rent or trade personal information. We do not use Customer Data for our own marketing, and we do not use it to market to your customers on our own behalf. We will not use personal information for a materially different purpose without telling you and, where the law requires it, obtaining your consent.
6. Business research and prospecting
The Services include research features that help a business find and write to other businesses that may want its services, and we use the same features for our own sales outreach. To do that we collect information about businesses from sources the business itself published: its own website and its Google Business Profile listing, and similar public business listings. Where the business published them, this can include the name and role of an owner or staff member and a business email address or telephone number. We read only what the business published; we do not buy personal information from data brokers or list sellers, and we do not collect personal social media profiles, home addresses or personal contact details.
We use this information to describe the business, to judge whether it may be relevant, and to prepare a first message that a person reviews before anything is sent. We make it available to the KahuLogic customer who ran the research, who is responsible for how they then contact the business (our Terms of Service require them to follow anti-spam and telemarketing law and to honour opt-outs). We keep each research record separate to the business it describes, and where we cannot be confident that information belongs to the business named, we withhold it.
If you would rather your details were not included, email privacy@kahulogic.com with the business name and the email address or telephone number concerned. We will remove your personal details from our research records and keep a minimal record (the contact detail and the date of your request) solely so that we can keep them out in future.
7. AI and automated processing
The Services use automated systems, including machine learning models provided by the providers listed on our Sub-processors page, to prepare drafts such as pages, posts, campaigns, emails, replies, images, video, voice and summaries. Those systems process the content and instructions you provide, and relevant context about your business scoped to your workspace, in order to produce the output you have asked for. Outputs are presented in your workspace and handled according to the review and automation settings you have configured.
We do not use your customer content or Customer Data to train our own or third-party AI models, and our model providers' terms do not permit them to train their models on it. Some providers may keep inputs and outputs for a limited period under their own terms to detect and prevent abuse. We may use aggregated and de-identified information that does not identify you or any individual to monitor performance and improve the Services.
We do not use personal information in a computer program to make a decision that could reasonably be expected to significantly affect an individual's rights or interests without a person being involved. The automated features prepare drafts, recommendations and assessments of businesses; a person at the customer decides whether to publish, send or act on them, or chooses to enable automation for the tasks they select.
8. Who can see your information
Our personnel. Access to customer workspaces is limited to KahuLogic personnel and contractors who need it, bound by confidentiality obligations. They may open your workspace to provide support you have asked for, to investigate a security, abuse, billing or technical issue, or where the law requires it. Access to a workspace by our personnel is recorded. Where a support session includes data from a connected Google account, we view only what is needed to resolve the request you made.
We disclose personal information outside KahuLogic only as follows:
- To service providers who support the Services, including hosting and infrastructure, AI model, payment, email, messaging and telephony, and analytics providers. They are listed on our Sub-processors page and are bound by contract to use the information only to provide their services to us.
- Within a workspace, to the people the workspace owner has invited, and where an agency manages a workspace for a business, to that agency.
- To third-party platforms and services that you have connected or asked us to act with on your behalf, to the extent necessary to carry out your instructions.
- To the KahuLogic customer who ran the research, in the case of business research information (section 6).
- To Microsoft, which receives the Microsoft Clarity information described in section 11 as an independent controller rather than as our service provider, and may use it for its own purposes, including to provide and improve Microsoft Advertising.
- To the advertising platforms we use to promote KahuLogic, currently Google, Meta and LinkedIn. Their tags on this website record your visit, as our Cookie Policy describes, so that we can measure our advertising and show KahuLogic ads on their platforms. When you sign up, start a trial, launch your website or make a purchase, we may also send each of them a hashed copy of your email address, and the advertising click identifier you arrived with if there was one, so that they can tell us whether an advertisement led to it. When you send an enquiry through a form on this website, we may send them that click identifier, the page and your browser type, but not your email address. Each platform uses this information under its own privacy policy.
- To our professional advisers, insurers and auditors where reasonably required.
- Where required or authorised by law, including in response to a lawful request from a court, regulator or law enforcement agency, or where disclosure is necessary to prevent or lessen a serious threat to life, health or safety. Where the law allows, we will tell the affected customer before disclosing its Customer Data.
- To a purchaser or successor in connection with a sale, merger or reorganisation of our business, subject to that party being bound to treat the information consistently with this policy.
- With your consent or at your direction.
9. Overseas storage and disclosure
Our primary hosting is in Australia (Sydney). Some of our service providers store or process information in the United States, and some operate globally, as our Sub-processors page sets out for each one. Our personnel and contractors may access information from New Zealand, Australia and other countries in which they work.
Where we disclose personal information to a person outside New Zealand, we take reasonable steps to ensure that the information is subject to comparable safeguards to those in the Privacy Act 2020, including by contract. Where the Australian Privacy Principles apply, we take reasonable steps to ensure that overseas recipients do not breach those principles. The information Microsoft receives through Microsoft Clarity (section 11) is different: it is stored in Microsoft Azure, which may be outside New Zealand and Australia, and Microsoft holds it as an independent controller under the Microsoft Privacy Statement rather than on our instructions.
10. Connected third-party platforms
The Services can connect to accounts you hold with third parties, including search, advertising, social, messaging, email, payment, accounting and calendar platforms. Those accounts remain yours and are governed by the terms and privacy policies of the relevant provider. We are not responsible for the collection or handling of personal information by those providers, and their inclusion in the Services is not an endorsement of, or affiliation with, that provider. You may disconnect an account at any time in your workspace settings.
Three platform families carry commitments we make to the platform itself as well as to you, and they are set out in full below because the platforms' own review processes require it.
Google user data. If you connect a Google product (Google Business Profile, Google Analytics, Google Tag Manager, Google Search Console, Google Ads or, where we offer it, Gmail), we receive only the scopes you grant during the Google authorisation flow, and we use that data strictly to provide the features you have asked us to provide. If you connect Gmail, we create the drafts you ask for in your own mailbox, and we read only the details needed to show where each of those messages stands (for example whether it was sent, and whether a reply, bounce or unsubscribe request arrived in that conversation); you send every message yourself. If you connect Google Ads and choose to, we link your Google Ads account to KahuLogic's Google Ads manager account so we can report conversions and show performance; you can remove that link at any time in Google Ads. Specifically:
- We will not transfer Google user data to any third party except as necessary to provide or improve the user-facing features that you have requested, and only with your consent.
- We will not use Google user data to serve ads, including remarketing, personalised, or interest-based advertising.
- We will not allow humans to read Google user data unless we have your explicit consent (for example, when you ask us for support with a feature that uses it), it is required for security purposes (such as investigating abuse), or we are compelled to do so by law.
- We will not use Google user data to develop, improve, or train generalised or non-personalised AI or machine-learning models.
You can revoke our access at any time from your Google Account permissions page (myaccount.google.com/permissions) or by contacting us. After disconnection we delete the related access tokens and stop processing the Google data they unlocked. KahuLogic's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Meta platform data. We connect to Facebook Pages, Instagram Business accounts and Meta ad accounts that you own or manage, and only after you authorise the connection. We use that data to display your accounts and their performance inside the Services, and to make the posts and campaigns you approve. Specifically:
- We will not sell data received from Meta's platform, or share it with anyone other than the sub-processors listed on our Sub-processors page.
- We will not use it for advertising unrelated to your own accounts and campaigns.
- We will not build profiles of individuals from it.
- We will not use it to develop, improve, or train generalised AI or machine-learning models.
You can disconnect a Meta account in your workspace settings, or remove KahuLogic from your Facebook account through Facebook's settings; either revokes our access immediately. You can request deletion of all data we hold from your Meta accounts at any time by following the instructions on our Meta data deletion page. We delete that data within thirty days and confirm when it is done. We handle data received from Meta's platform in accordance with the Meta Platform Terms and Developer Policies.
LinkedIn Company Pages. If you connect LinkedIn, you sign in to LinkedIn as an administrator of your business's Company Page. We list the Company Pages your LinkedIn account administers so that you can choose the one we work with. We publish a post as your Page, with its text and any link, images or video, only after it has been approved in your workspace, by you or by someone you have given access, to go out straight away or at a time you schedule. We also read back the posts your Page has published on LinkedIn, to show them in your workspace's calendar and when you ask about them in chat. Specifically:
- We ask LinkedIn for three permissions: w_organization_social, to publish the posts you approve as your Page; r_organization_social, to read back what your Page has published; and rw_organization_admin, to list the Pages you administer, read their names and read the totals for your Page's posts. We do not use them to change your Page's details or who administers it.
- For each post on the Page, we read LinkedIn's totals (impressions, reactions, comments, shares and clicks) to show you how it performed. We do not read the comments themselves, who reacted or commented, follower data or anyone's LinkedIn profile, and we never post on a member's personal profile.
- The tokens LinkedIn issues for your connection are stored encrypted in Google Cloud Secret Manager in Sydney, Australia. We use them only to make the requests described here, and they are never shown in the app or sent to an AI model.
- We store the LinkedIn ID and name of the Page you choose. For each post we publish, we keep what was approved (its text, link, images or video, and when it was to go out), the Page, who approved it and LinkedIn's ID for the post.
- We do not save the list of Pages you administer or the posts we read back. They are held only in memory, and we reuse the list for no more than a day and the posts for no more than five minutes. Post totals are also held only in memory, reused for no more than a day so we do not ask LinkedIn again on every visit, and never saved. When the assistant reads them to answer you in chat, it uses them for that answer and does not keep them in your chat history; what the assistant writes in its reply is kept like any other message.
You can disconnect LinkedIn at any time in your workspace settings. When you do, we ask LinkedIn to revoke our access, delete the stored tokens straight away, forget which Page you chose, and stop publishing to and reading from your Page. You can also remove KahuLogic in your LinkedIn settings, under Data privacy and then Permitted services, which stops our access. Posts already published stay on LinkedIn until you remove them there. Our record of the posts we published for you stays in your workspace and is kept and deleted as section 13 describes, or sooner if you ask us under section 14. We handle data received from LinkedIn in accordance with the LinkedIn API Terms of Use.
LinkedIn advertising accounts. Connecting LinkedIn advertising is separate from connecting a Company Page, with its own LinkedIn sign-in. If you connect it, you sign in to LinkedIn with an account that can use your business's LinkedIn ad account. We list the ad accounts your LinkedIn account can reach so that you can choose the one we work with. We show that account's campaigns and results in your workspace and when you ask about them in chat, prepare campaigns and changes for you, and bring the responses to the Lead Gen Forms on your ads into your workspace's CRM. We create, switch on, pause or end a campaign, or change its budget, only after it has been approved in your workspace, by you or by someone you have given access. A campaign we create starts paused, and switching it on is a separate approval. Specifically:
- We ask LinkedIn for seven permissions: r_ads and rw_ads, to list your ad accounts and to create and change campaigns; r_ads_reporting, to read results such as spend, impressions, clicks and leads; r_marketing_leadgen_automation, to read the responses to your Lead Gen Forms; rw_conversions, to read your ad account's Insight Tag and to read and create conversion rules; and r_organization_admin and w_organization_social, so that the ad in a campaign you approve can be posted as your Company Page. That post runs only as an ad and is not shown in your Page's feed.
- When you choose an ad account, we set up conversion measurement without asking for a separate approval. We add a conversion rule named "Kahu - Website enquiries" to the account if it does not already have one, and if your website is one we build and host for you, we add the account's LinkedIn Insight Tag to it. The tag loads only for visitors who accept marketing cookies. When one of those visitors sends an enquiry through a form on your website, we report it to LinkedIn against that rule, with a hashed copy of the email address they gave and, if they arrived from a LinkedIn ad, LinkedIn's click identifier. We report nothing for visitors who decline marketing cookies or do not answer.
- We do not read members' LinkedIn profiles. The only details we receive about a person are the answers they submit in your Lead Gen Forms.
- The tokens LinkedIn issues for this connection are stored encrypted in Google Cloud Secret Manager in Sydney, Australia, apart from the tokens for a Company Page. We use them only to make the requests described here, and they are never shown in the app or sent to an AI model.
- We store the LinkedIn ID and name of the ad account you choose. Each Lead Gen Form response is filed as an enquiry in your CRM with the answers given and the form's name, and we email a notice of it, with the person's name, contact details and message, to the people your workspace sends new enquiries to. We do not file LinkedIn's test leads. If a form asks a consent question, the answer is kept with the enquiry, but it is not recorded as consent to marketing. For each campaign change, we keep what was approved and who approved it.
- Campaigns and results are read from LinkedIn when you or the assistant ask for them, and the ads pages reuse a read for no more than 45 seconds. When the assistant reads them to answer you in chat, it uses them for that answer and does not keep them in your chat history; what the assistant writes in its reply is kept like any other message. Your LinkedIn ad spend is included in the advertising totals of your workspace's daily summary.
You can disconnect LinkedIn advertising at any time in your workspace settings. When you do, we ask LinkedIn to revoke our access, delete the stored tokens straight away, forget which ad account you chose, stop bringing in leads and reporting enquiries to LinkedIn, and remove the Insight Tag we added to your website. You can also remove Kahu Logic Ads in your LinkedIn settings, under Data privacy and then Permitted services, which stops our access. Campaigns and the conversion rule stay in your ad account until you change or remove them there. Leads already filed stay in your CRM, and they and our record of approved changes are kept and deleted as section 13 describes, or sooner if you ask us under section 14. We handle data received from LinkedIn in accordance with the LinkedIn API Terms of Use.
12. Security and breaches
We take reasonable technical and organisational steps to protect personal information against loss and against unauthorised access, use, modification or disclosure. Those steps include encryption of data in transit and at rest, role-based access controls, logging of administrative activity and periodic review of our security practices. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your sign-in details confidential and for the actions of users you authorise on your account.
If a privacy breach occurs that it is reasonable to believe has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, as the Privacy Act 2020 requires, and will meet any corresponding obligation under the Notifiable Data Breaches scheme in Australia where it applies. Where a breach affects Customer Data, we will tell the affected customer without undue delay so that it can meet its own obligations.
13. Retention
We keep personal information only for as long as we need it for the purposes described in this policy, or for as long as the law requires. In particular:
- Account and workspace data, including Customer Data: while your account is open. After your subscription ends, you can export it for thirty days; we then delete or de-identify it within a further sixty days, except where the law requires us to keep it.
- Billing, tax and transaction records: at least seven years, as tax law requires.
- Support correspondence: up to three years.
- Security logs, technical logs and product-usage analytics: up to twelve months, held against a pseudonymous identifier rather than your name where they relate to product use.
- Backups: up to ninety days, after which they are overwritten in the normal rotation.
- Business research records: while they remain relevant to the customer's research, and removed on request as section 6 describes.
- Opt-out and suppression records: for as long as we need them to keep honouring your request.
When information is no longer required, we delete it or de-identify it. Microsoft Clarity data is kept for the periods given in section 11, not these, and cannot be deleted for one person on its own.
14. Your rights and complaints
You have the right to ask for access to the personal information we hold about you, and to ask us to correct it if it is wrong. You can also ask us to delete it, to stop sending you marketing, or to stop including you in business research. Send your request to privacy@kahulogic.com. We will ask for enough information to verify your identity, and will respond within twenty working days, as the Privacy Act 2020 requires, or within the timeframes set by the Australian Privacy Principles where they apply. There is no charge for making a request. We may decline a request where the law permits us to, and if we do we will tell you why. The one exception to deletion is Microsoft Clarity data, which section 11 explains we cannot delete for one person on its own.
You can withdraw analytics consent on this website at any time through the Cookie preferences link, or by enabling Do Not Track in your browser, which stops the optional tags described in our Cookie Policy on this website and in the web app. Global Privacy Control stops Microsoft Clarity on this website, and every optional tag in the web app; this website's other optional tags do not yet read it, so use the Cookie preferences link to decline those. Neither affects your ability to use the Services.
Where we hold information as Customer Data on behalf of one of our customers, we will refer your request to that customer and help them to respond.
If you are in the European Economic Area, the UK or Switzerland, we rely on the following legal bases: performing our contract with you, our legitimate interests in running, securing, improving and promoting the Services (including business-to-business outreach), your consent where we ask for it (such as for optional cookies), and complying with the law. You also have the rights to object to processing based on legitimate interests, to restrict processing, and to receive your information in a portable format, and you may complain to your local data protection authority.
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner in New Zealand (privacy.org.nz), or to the Office of the Australian Information Commissioner (oaic.gov.au) where the Australian Privacy Principles apply.
15. Children
The Services are intended for business use by adults aged 18 or over. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact us and we will delete it, apart from any Microsoft Clarity data, which section 11 explains cannot be deleted for one person on its own.
16. Changes to this policy
We may update this policy as the Services or the law change. The date at the top of this page shows when the current version took effect. Where a change materially affects how we handle personal information, we will give notice through the Services or by email before it takes effect.
Sample workspace and illustrative figures
Sample workspace: names and figures shown in product screenshots and mockups on this website are illustrative.
17. Contact
Privacy enquiries, access, correction and deletion requests, opt-out requests and complaints should be sent to our Privacy Officer at privacy@kahulogic.com. We will acknowledge your message and tell you who is handling it. Our postal address is our registered office as shown on the New Zealand Companies Register for Kahu Logic Limited (NZBN 9429053390776).