This Privacy Policy explains how FYAI Limited collects, uses, stores, discloses, and protects personal information when you use the FYAI platform at fyai.co.nz and any related services.

FYAI is a New Zealand-based Software-as-a-Service (SaaS) platform that helps users create, integrate, and manage AI-powered web applications and automation workflows. FYAI is currently live in its production beta phase.

We handle personal information responsibly and in accordance with the Privacy Act 2020.

In this policy, "FYAI", "we", "our", and "us" means FYAI Limited. "You" means any person who accesses or uses FYAI.

Unless stated otherwise, references to law or legal requirements in this policy are references to applicable New Zealand law.

FYAI is the public-facing brand of FYAI Limited.

FYAI has appointed a Privacy Officer to oversee compliance with the Privacy Act 2020. You may contact our Privacy Officer regarding any privacy-related enquiries, concerns, or requests to access or correct your information at:

We collect personal information depending on how you use or interact with FYAI. This may include:

• Account and Profile Information: First name, last name, email address, authentication details, profile photos, account settings, and user or workspace preferences.
• Platform Content: Prompts, messages, conversation threads, AI-generated outputs, saved projects, automated workflows, templates, and configurations.
• Uploaded Content & Knowledge Base: FYAI allows you to upload profile photos, images, documents, spreadsheets, text files, and other supported file types. Uploaded content may be processed, parsed, indexed, and stored to provide FYAI functionality, including knowledgebase, prompt, conversation, workflow, and project features. Where applicable, temporary media files uploaded directly into standard prompt streams are processed transiently to provide platform responses and are not long-term retained. Knowledgebase files and other saved uploaded content are retained for your use until you delete them or your account is closed, unless a longer retention period is required or permitted by law. FYAI does not use your uploaded content for its own independent purposes, including to train AI models, create datasets, or generate content for other users.
• Usage, Device and Diagnostic Information: IP addresses, browser and device type, approximate location derived from your IP address, pages visited, features used, clicks and other interactions, performance measurements, error reports, and system and session activity logs. With your consent, we also record how you interact with the platform during some sessions ("session recordings"). A session recording captures page layout and interactions, such as where you click and scroll, so that we can diagnose problems and improve usability. We configure recordings to hide the text shown on screen, including the text of your conversations, prompts, AI outputs, and uploaded content.
• Payment Information: Paid subscriptions are processed securely by our third-party provider, Stripe. FYAI does not collect, handle, or store your credit or debit card numbers. Stripe provides us with limited transaction metadata (including your billing name, billing email, subscription status, card type, invoice or transaction identifiers, payment status, and billing history) to facilitate account provisioning, tax compliance, and billing support.
• Security Information: Login activity, failed login attempts, audit logs, security alerts, and information relating to suspected misuse or unauthorised access.

FYAI does not ordinarily collect phone numbers, employer names, job titles, billing addresses, biometric information, health or medical information, legal/client information, employment or HR information, government identification documents, or information about children as part of ordinary account creation or platform use. However, users may include personal information in prompts, conversations, uploaded content, knowledgebase files, workflows, or other platform content. You are responsible for ensuring that you are authorised to submit any personal information, confidential information, or sensitive information you provide to FYAI.

We may collect personal information:

• Directly from you: When you create an account, configure settings or workspace features, execute prompts, upload knowledge base files, save automated workflows, or contact us for support.
• Automatically: When you use or interact with the platform.
• From Third-Party Service Providers: From payment, authentication, hosting, system analytics, and security vendors.
• Indirectly: Where another user, integration, or third-party workflow tool feeds information containing your personal information to or through FYAI (such as within prompts, conversation contexts, or text documents uploaded to a workspace).

Where required by the Privacy Act 2020, including Information Privacy Principle 3A (IPP 3A), we will take reasonable steps to ensure you are made aware that we have collected your personal information indirectly, the purpose of that collection, and your rights of access and correction, unless an exception applies.

If you choose not to provide information required for account creation, authentication, security, payment, or core platform functionality, we may be unable to provide some or all of FYAI to you.

We may use personal information to:

• Provide, operate, maintain, and improve FYAI;
• Create, authenticate, and secure user accounts;
• Provide AI-generated responses, automation workflows, knowledgebase functionality, and related platform features;
• Save, index, and manage prompts, conversations, uploaded content, knowledgebase files, projects, workflows, templates, and configurations;
• Process payments, subscriptions, invoices, and account administration, where applicable;
• Provide customer support and technical troubleshooting;
• Monitor system performance, platform reliability, and security;
• Detect, prevent, and respond to fraud, system abuse, unauthorised data access, security incidents, and breaches of our Terms of Use;
• Screen content that AI agents receive for prompt-injection attacks (see section 7);
• Comply with legal, tax, accounting, regulatory, and financial reporting obligations; and
• Communicate critical service, billing, security, pricing, and policy updates.

We do not sell your personal information.

FYAI may transmit prompts, uploaded content, knowledgebase files, context, and related information to external AI service providers or routing services where necessary to deliver platform functionality. These may include providers such as OpenAI, Anthropic, Google, DeepSeek, Mistral, xAI, OpenRouter, and other AI model providers or routing services. This list may change over time.

Bring Your Own Model (BYOM): If you choose to connect or use your own model or external API keys, your data is governed strictly by your direct commercial agreement with that provider. FYAI does not control the privacy, security, retention, training, or data-use practices of models or providers you choose or connect yourself.

Platform-Managed Models: FYAI may use platform-managed AI models or routing services to provide certain functionality. Where FYAI manages model selection, prompts, conversations, uploaded content, knowledgebase files, image inputs, AI-generated outputs, and related technical information may be sent to third-party AI providers or routing services where necessary to provide the relevant FYAI functionality. FYAI does not use your prompts, uploaded content, knowledgebase files, conversations, or outputs to train AI models unless this is clearly disclosed to you and permitted by law. However, third-party AI providers may process and handle this information in accordance with their own terms, policies, service tiers, and data processing arrangements.

Metadata & Logs: FYAI aims to avoid sending unnecessary metadata, user identifiers, or logs to AI providers. Metadata, user identifiers, or logs may be shared where required for functionality, support, debugging, security, performance monitoring, troubleshooting, or a triage process.

Security Screening of AI Inputs: To protect you and other customers from prompt-injection attacks, which try to hijack an AI agent through the content it reads, we send certain content to Microsoft Azure AI Content Safety (its Prompt Shields feature) for analysis. This is the most recent message sent to an agent and the text of results an agent receives from tools, web pages, emails, and documents. Microsoft analyses this content in its Australia East region, which is outside New Zealand, and returns a result to us.

We do not send system prompts, earlier messages in a conversation, images, or the agent's own replies. The request carries no account, organisation, user, or session identifier, but the content itself may include personal information, including information about other people. Microsoft's published documentation for Azure AI Content Safety states that submitted content is not stored for human review by Microsoft staff and is not used to train its models. That documentation describes the service generally and does not name Prompt Shields individually.

Our screening records do not contain the screened content. They hold the outcome (for example, that content was flagged), the length of the content, and a short fingerprint of it (a truncated hash), together with the identifiers our logs normally carry.

Your Choices on Screening: Screening is on by default. The owner or an administrator of your organisation can switch it off for the whole organisation under Settings > Organization > Content Screening, and each user can switch it off for their own chats under Account Settings > Data & Privacy. If screening is switched off, the content is not sent, and agents are not protected against prompt injection by this check. Scheduled and webhook runs follow the organisation setting only. See our knowledge base article on content screening for details.

You are responsible for the content you submit to FYAI.

Sensitive Data Restrictions: FYAI is not designed to process sensitive personal information. You must not upload sensitive personal information unless it is necessary for your use and you hold authority to do so.

Third-Party Information: If you submit personal information about another individual, you are responsible for ensuring that you have the authority to do so and that your use complies with applicable privacy, confidentiality, professional, employment, or contractual obligations.

Verification of AI Outputs: FYAI uses AI generation technologies which can produce inaccurate, incomplete, or unreliable outputs. You are responsible for reviewing and validating all outputs before relying on them, especially for legal, financial, medical, safety-critical, or professional purposes. FYAI does not provide legal, financial, medical, or other professional advice.

FYAI personnel or authorised contractors may access user content only where reasonably necessary for legitimate operational, support, legal, or security purposes. This is strictly confined to:

• Providing direct customer support requested by the user;
• Investigating technical issues, system errors, or platform anomalies;
• Detecting, blocking, or responding to platform misuse, malicious code, fraud, or infrastructure security incidents;
• Complying with legal obligations, regulatory requests, court orders, or law enforcement requests where required or permitted by law; and
• Enforcing our Terms of Use.

All personnel or contractors who access user content must be authorised and subject to contractual confidentiality obligations.

FYAI may use cookies and similar tracking technologies (such as local device storage) to operate the platform, manage authentication and active user sessions, improve security, remember workspace preferences, analyse usage and software performance, diagnose technical errors, and optimise the overall user experience.

Necessary vs. Optional Technologies: Some cookies and data tokens are strictly necessary for FYAI to function and keep you securely logged in. They are always active. Performance monitoring, product analytics, and session recording in your browser are optional. We turn them on only after you allow them through the cookie banner or your cookie settings.

Who Receives Optional Analytics Data:

• PostHog (United States) receives product analytics and session recordings. This data is linked to an internal account identifier rather than your name or email address. PostHog session recordings are deleted after 30 days.
• Datadog (Australia) receives browser performance monitoring, error reports, and session recordings. This browser monitoring data is not linked to your account identifier.

Operational Data We Collect Whatever You Choose: Our servers record whether the service is working. This includes system and security logs and performance traces, which we send to Datadog (Australia). It also includes short event records that a chat session or workflow run finished or failed, how long it took, which tool failed with a short technical error message, and when a usage limit was reached. We send these to PostHog (United States), linked to an internal account identifier. We need this data to run, secure, and fix FYAI, so the cookie banner does not control it. Error messages are technical, but they may occasionally refer to what a tool was working on.

Data Handling: We do not use analytics data for advertising, and we do not sell it.

Your Choices and How to Opt Out:

• At the banner: the first time you visit, choose Reject All to keep optional analytics and session recording off, or Customize to turn analytics on or off separately from other optional features.
• Change your mind at any time: select Cookie settings in the footer of our public pages, go to Account Settings > Data & Privacy when you are signed in, or use the button below. Turning analytics off stops optional collection in that browser straight away.
• Your choice is stored in your browser. You will need to make it again in each browser or device you use, and clearing your site data brings the banner back.
• Browser settings: you can also manage or block cookies and site data through your web browser. If you block necessary cookies, sign-in and certain core platform features may stop working.
• What opting out does not change: necessary cookies, and the operational data described above.
• Data already collected: to ask what analytics data is linked to your account, or to ask us to correct or delete it, contact our Privacy Officer (see sections 12 and 15).

We may disclose personal information to trusted third-party service providers where reasonably necessary for the purposes described in this policy, including:

• Cloud hosting and infrastructure providers;
• AI model vendors and AI API routing services;
• Payment processors (Stripe), where applicable;
• Authentication providers;
• Email delivery platforms;
• Analytics, performance monitoring, and cybersecurity tools;
• Customer support, integration, and workflow tools, where applicable;
• Professional advisors (accountants, auditors, legal counsel); and
• Regulators, courts, law enforcement agencies, or government authorities where required or permitted under applicable law.

Personal information may be stored, processed, or accessed outside New Zealand because FYAI uses global cloud hosting infrastructure and international technology vendors. For example, our product analytics provider, PostHog, stores information in the United States, our monitoring provider, Datadog, stores information in Australia, and the service we use to screen content for prompt-injection attacks, Microsoft Azure AI Content Safety, processes it in Australia (see section 7).

Where FYAI discloses personal information to an overseas recipient, we take reasonable steps to ensure, or satisfy ourselves on reasonable grounds, that the recipient is required to protect the information using safeguards comparable to those provided by the New Zealand Privacy Act 2020, unless an exception applies.

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Different retention periods may apply to different types of information. For example:

• account information may be retained while your account remains active;
• prompts, conversations, outputs, workflows, projects, templates, and configurations may be retained while your account remains active or as otherwise required to provide FYAI;
• profile photos are retained while your account remains active or until removed or replaced;
• uploaded files and knowledgebase content may be retained while your account remains active, unless you manually delete them earlier, or a longer period is required or permitted by law;
• billing, tax, and accounting records may be retained for legal and accounting purposes;
• security logs, including records of content-screening outcomes, may be retained for audit, fraud prevention, and security purposes;
• session recordings held by PostHog are deleted after 30 days;
• support correspondence may be retained for customer service, legal, and operational purposes;
• backup copies may retain deleted information for 30 days before being overwritten or deleted.

You may request the deletion of your personal information or formal account closure at any time by contacting our Privacy Officer at [email protected]. Standard account closures can be processed instantly through your Workspace Settings, and you may manually delete individual conversations, prompts, uploaded files, or knowledgebase content directly through the Platform dashboard at any time.

We will assess all manual deletion requests in accordance with the Privacy Act 2020. In some cases, we may need to retain specific transaction or system metadata for legal, tax, accounting, security, fraud prevention, dispute resolution, or legitimate operational purposes.

FYAI takes reasonable technical and organisational steps to protect personal information against loss, unauthorised access, alteration, or misuse. Our architecture uses HTTPS/TLS encryption for data-in-transit, data-at-rest encryption protocols, secure authentication, password hashing, role-based access permissions, active system monitoring, and automated backups. We enforce strict confidentiality obligations across all personnel and authorised engineering contractors who interact with our systems. No method of electronic storage or internet transmission is 100% secure. You are responsible for safeguarding your account credentials and managing your active workspace sessions.

FYAI maintains internal response protocols to identify, contain, assess, and respond to privacy breaches. If we become aware of a privacy breach that has caused, or is reasonably likely to cause, serious harm to an individual, we will notify the affected individuals and the Office of the Privacy Commissioner as soon as practicable where required by the Privacy Act 2020.

Subject to the Privacy Act 2020, you may access the personal information FYAI holds about you, and request a correction if you believe that information is inaccurate, incomplete, or misleading. This includes analytics data linked to your account identifier (see section 10).

Please direct all access, correction, or privacy complaint enquiries to our Privacy Officer at [email protected]. We will respond to access and correction requests within the timeframe required by the Privacy Act 2020.

We may need to verify your identity before responding to a request. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner at www.privacy.org.nz.

FYAI is intended for users aged 18 years or older. It is not designed for, nor directed toward, schools, primary or secondary students, family households, or children or young people. We do not knowingly collect personal information from children or young people. If we become aware that a person under 18 has created an account or provided personal information through FYAI, we may disable the account and take reasonable steps to delete the information or deal with it appropriately.

FYAI may send you service-related communications including billing receipts, security updates, policy amendments, and essential system notifications. These communications are necessary for the operation, administration, or security of FYAI.

We may also send you marketing or product update communications where legally permitted. You can opt out of marketing emails at any time by using the "Unsubscribe" mechanisms embedded in those emails or by contacting us. Even if you unsubscribe from marketing emails, we may still send you important service-related messages.

We may update this Privacy Policy from time to time to reflect changes to FYAI, our data practices, legal requirements, or operational needs. The current version will be published at fyai.co.nz with an accurate "Last updated" date.

If an amendment introduces a material change to your privacy rights, we will take reasonable steps to notify you (such as by email, platform notice, or website notice) before the changes go into effect.