This Privacy Policy explains how FYAI Limited collects, uses, stores, discloses, and protects personal information when you use the FYAI platform at fyai.co.nz and any related services.

FYAI is a New Zealand-based Software-as-a-Service (SaaS) platform that helps users create, integrate, and manage AI-powered web applications and automation workflows. FYAI is currently live in its production beta phase.

We handle personal information responsibly and in accordance with the Privacy Act 2020.

In this policy, "FYAI", "we", "our", and "us" means FYAI Limited. "You" means any person who accesses or uses FYAI.

Unless stated otherwise, references to law or legal requirements in this policy are references to applicable New Zealand law.

FYAI is the public-facing brand of FYAI Limited.

FYAI has appointed a Privacy Officer to oversee compliance with the Privacy Act 2020. You may contact our Privacy Officer regarding any privacy-related enquiries, concerns, or requests to access or correct your information at:

We collect personal information depending on how you use or interact with FYAI. This may include:

• Account and Profile Information: First name, last name, email address, authentication details, profile photos, account settings, and user or workspace preferences.
• Platform Content: Prompts, messages, conversation threads, AI-generated outputs, saved projects, automated workflows, templates, and configurations.
• Uploaded Content & Knowledge Base: FYAI allows you to upload profile photos, images, documents, spreadsheets, text files, and other supported file types. Uploaded content may be processed, parsed, indexed, and stored to provide FYAI functionality, including knowledgebase, prompt, conversation, workflow, and project features. Where applicable, temporary media files uploaded directly into standard prompt streams are processed transiently to provide platform responses and are not long-term retained. Knowledgebase files and other saved uploaded content are retained for your use until you delete them or your account is closed, unless a longer retention period is required or permitted by law. FYAI does not use your uploaded content for its own independent purposes, including to train AI models, create datasets, or generate content for other users.
• Usage and Technical Information: IP addresses, browser types, device information, approximate location derived from technical information, feature usage, session activity logs, and system diagnostic error logs.
• Payment Information: Paid subscriptions are processed securely by our third-party provider, Stripe. FYAI does not collect, handle, or store your credit or debit card numbers. Stripe provides us with limited transaction metadata (including your billing name, billing email, subscription status, card type, invoice or transaction identifiers, payment status, and billing history) to facilitate account provisioning, tax compliance, and billing support.
• Security Information: Login activity, failed login attempts, audit logs, security alerts, and information relating to suspected misuse or unauthorised access.

FYAI does not ordinarily collect phone numbers, employer names, job titles, billing addresses, biometric information, health or medical information, legal/client information, employment or HR information, government identification documents, or information about children as part of ordinary account creation or platform use. However, users may include personal information in prompts, conversations, uploaded content, knowledgebase files, workflows, or other platform content. You are responsible for ensuring that you are authorised to submit any personal information, confidential information, or sensitive information you provide to FYAI.

We may collect personal information:

• Directly from you: When you create an account, configure settings or workspace features, execute prompts, upload knowledge base files, save automated workflows, or contact us for support.
• Automatically: When you use or interact with the platform.
• From Third-Party Service Providers: From payment, authentication, hosting, system analytics, and security vendors.
• Indirectly: Where another user, integration, or third-party workflow tool feeds information containing your personal information to or through FYAI (such as within prompts, conversation contexts, or text documents uploaded to a workspace).

Where required by the Privacy Act 2020, including Information Privacy Principle 3A (IPP 3A), we will take reasonable steps to ensure you are made aware that we have collected your personal information indirectly, the purpose of that collection, and your rights of access and correction, unless an exception applies.

If you choose not to provide information required for account creation, authentication, security, payment, or core platform functionality, we may be unable to provide some or all of FYAI to you.

We may use personal information to:

• Provide, operate, maintain, and improve FYAI;
• Create, authenticate, and secure user accounts;
• Provide AI-generated responses, automation workflows, knowledgebase functionality, and related platform features;
• Save, index, and manage prompts, conversations, uploaded content, knowledgebase files, projects, workflows, templates, and configurations;
• Process payments, subscriptions, invoices, and account administration, where applicable;
• Provide customer support and technical troubleshooting;
• Monitor system performance, platform reliability, and security;
• Detect, prevent, and respond to fraud, system abuse, unauthorised data access, security incidents, and breaches of our Terms of Use;
• Comply with legal, tax, accounting, regulatory, and financial reporting obligations; and
• Communicate critical service, billing, security, pricing, and policy updates.

We do not sell your personal information.

FYAI may transmit prompts, uploaded content, knowledgebase files, context, and related information to external AI service providers or routing services where necessary to deliver platform functionality. These may include providers such as OpenAI, Anthropic, Google, DeepSeek, Mistral, xAI, OpenRouter, and other AI model providers or routing services. This list may change over time.

Bring Your Own Model (BYOM): If you choose to connect or use your own model or external API keys, your data is governed strictly by your direct commercial agreement with that provider. FYAI does not control the privacy, security, retention, training, or data-use practices of models or providers you choose or connect yourself.

Platform-Managed Models: FYAI may use platform-managed AI models or routing services to provide certain functionality. Where FYAI manages model selection, prompts, conversations, uploaded content, knowledgebase files, image inputs, AI-generated outputs, and related technical information may be sent to third-party AI providers or routing services where necessary to provide the relevant FYAI functionality. FYAI does not use your prompts, uploaded content, knowledgebase files, conversations, or outputs to train AI models unless this is clearly disclosed to you and permitted by law. However, third-party AI providers may process and handle this information in accordance with their own terms, policies, service tiers, and data processing arrangements.

Metadata & Logs: FYAI aims to avoid sending unnecessary metadata, user identifiers, or logs to AI providers. Metadata, user identifiers, or logs may be shared where required for functionality, support, debugging, security, performance monitoring, troubleshooting, or a triage process.

You are responsible for the content you submit to FYAI.

Sensitive Data Restrictions: FYAI is not designed to process sensitive personal information. You must not upload sensitive personal information unless it is necessary for your use and you hold authority to do so.

Third-Party Information: If you submit personal information about another individual, you are responsible for ensuring that you have the authority to do so and that your use complies with applicable privacy, confidentiality, professional, employment, or contractual obligations.

Verification of AI Outputs: FYAI uses AI generation technologies which can produce inaccurate, incomplete, or unreliable outputs. You are responsible for reviewing and validating all outputs before relying on them, especially for legal, financial, medical, safety-critical, or professional purposes. FYAI does not provide legal, financial, medical, or other professional advice.

FYAI personnel or authorised contractors may access user content only where reasonably necessary for legitimate operational, support, legal, or security purposes. This is strictly confined to:

• Providing direct customer support requested by the user;
• Investigating technical issues, system errors, or platform anomalies;
• Detecting, blocking, or responding to platform misuse, malicious code, fraud, or infrastructure security incidents;
• Complying with legal obligations, regulatory requests, court orders, or law enforcement requests where required or permitted by law; and
• Enforcing our Terms of Use.

All personnel or contractors who access user content must be authorised and subject to contractual confidentiality obligations.

FYAI may use cookies and similar tracking technologies (such as local device storage) to operate the platform, manage authentication and active user sessions, improve security, remember workspace preferences, analyse usage and software performance, diagnose technical errors, and optimise the overall user experience.

Necessary vs. Optional Technologies: Some cookies and data tokens are strictly necessary for FYAI to function and keep you securely logged in. Optional performance, analytics, or tracking scripts are deployed to understand feature usage and Platform stability. Where required by law, these optional technologies are deployed only with your explicit consent via the Platform's cookie control features.

Data Handling: Software analytics or telemetry information is aggregated or de-identified wherever possible. This operational performance data is used solely to maintain platform stability and improve software functionality.

Your Choices: You can manage or disable cookies at any time through your web browser settings, or where available, through the privacy controls built directly into FYAI. If you choose to reject necessary cookies, certain core platform features and authentication pathways may cease to function correctly.

We may disclose personal information to trusted third-party service providers where reasonably necessary for the purposes described in this policy, including:

• Cloud hosting and infrastructure providers;
• AI model vendors and AI API routing services;
• Payment processors (Stripe), where applicable;
• Authentication providers;
• Email delivery platforms;
• Analytics, performance monitoring, and cybersecurity tools;
• Customer support, integration, and workflow tools, where applicable;
• Professional advisors (accountants, auditors, legal counsel); and
• Regulators, courts, law enforcement agencies, or government authorities where required or permitted under applicable law.

Personal information may be stored, processed, or accessed outside New Zealand because FYAI uses global cloud hosting infrastructure and international technology vendors.

Where FYAI discloses personal information to an overseas recipient, we take reasonable steps to ensure, or satisfy ourselves on reasonable grounds, that the recipient is required to protect the information using safeguards comparable to those provided by the New Zealand Privacy Act 2020, unless an exception applies.

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Different retention periods may apply to different types of information. For example:

• account information may be retained while your account remains active;
• prompts, conversations, outputs, workflows, projects, templates, and configurations may be retained while your account remains active or as otherwise required to provide FYAI;
• profile photos are retained while your account remains active or until removed or replaced;
• uploaded files and knowledgebase content may be retained while your account remains active, unless you manually delete them earlier, or a longer period is required or permitted by law;
• billing, tax, and accounting records may be retained for legal and accounting purposes;
• security logs may be retained for audit, fraud prevention, and security purposes;
• support correspondence may be retained for customer service, legal, and operational purposes;
• backup copies may retain deleted information for 30 days before being overwritten or deleted.

You may request the deletion of your personal information or formal account closure at any time by contacting our Privacy Officer at [email protected]. Standard account closures can be processed instantly through your Workspace Settings, and you may manually delete individual conversations, prompts, uploaded files, or knowledgebase content directly through the Platform dashboard at any time.

We will assess all manual deletion requests in accordance with the Privacy Act 2020. In some cases, we may need to retain specific transaction or system metadata for legal, tax, accounting, security, fraud prevention, dispute resolution, or legitimate operational purposes.

FYAI takes reasonable technical and organisational steps to protect personal information against loss, unauthorised access, alteration, or misuse. Our architecture uses HTTPS/TLS encryption for data-in-transit, data-at-rest encryption protocols, secure authentication, password hashing, role-based access permissions, active system monitoring, and automated backup and recovery processes. We enforce strict confidentiality obligations across all personnel and authorised engineering contractors who interact with our systems. No method of electronic storage or internet transmission is 100% secure. You are responsible for safeguarding your account credentials and managing your active workspace sessions.

FYAI maintains internal response protocols to identify, contain, assess, and respond to privacy breaches. If we become aware of a privacy breach that has caused, or is reasonably likely to cause, serious harm to an individual, we will notify the affected individuals and the Office of the Privacy Commissioner as soon as practicable where required by the Privacy Act 2020.

Subject to the Privacy Act 2020, you may access the personal information FYAI holds about you, and request a correction if you believe that information is inaccurate, incomplete, or misleading.

Please direct all access, correction, or privacy complaint enquiries to our Privacy Officer at [email protected]. We will respond to access and correction requests within the timeframe required by the Privacy Act 2020.

We may need to verify your identity before responding to a request. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner at www.privacy.org.nz.

FYAI is intended for users aged 18 years or older. It is not designed for, nor directed toward, schools, primary or secondary students, family households, or children or young people. We do not knowingly collect personal information from children or young people. If we become aware that a person under 18 has created an account or provided personal information through FYAI, we may disable the account and take reasonable steps to delete the information or deal with it appropriately.

FYAI may send you service-related communications including billing receipts, security updates, policy amendments, and essential system notifications. These communications are necessary for the operation, administration, or security of FYAI.

We may also send you marketing or product update communications where legally permitted. You can opt out of marketing emails at any time by using the "Unsubscribe" mechanisms embedded in those emails or by contacting us. Even if you unsubscribe from marketing emails, we may still send you important service-related messages.

We may update this Privacy Policy from time to time to reflect changes to FYAI, our data practices, legal requirements, or operational needs. The current version will be published at fyai.co.nz with an accurate "Last updated" date.

If an amendment introduces a material change to your privacy rights, we will take reasonable steps to notify you (such as by email, platform notice, or website notice) before the changes go into effect.