PRIVACY POLICY

1. Overview

MiStro Limited ("MiStro", "we") is committed to protecting the privacy of our customers, their team members, and visitors to our websites (mistro.co.nz, siteflow.co.nz, reorderly.co.nz). This Privacy Policy explains what information we collect, how we use it, and the choices you have. We comply with the Privacy Act 2020 (New Zealand).

2. Information We Collect

• Account information: name, email address, phone number, company name and trade type when you register or book a demo.
• Usage data: how you interact with the Platform, including features used, device type, and log-in times.
• Business data: the jobs, equipment, crew, and materials information you and your team enter into Siteflow and ReOrderly.
• Payment information: billing details processed securely through our payment provider (Stripe). We do not store full card numbers.

3. How We Use Your Information

• To provide, maintain, and improve the Services.
• To process payments and manage your Subscription.
• To respond to enquiries and provide customer support.
• To send service notices, product updates, and (with consent) marketing communications you can unsubscribe from at any time.
• To detect, prevent, and address technical issues, fraud, or security concerns.
• To comply with legal obligations.

4. How We Share Information

We do not sell your personal information. We may share it only in these limited circumstances:

• With trusted service providers who support our operations (hosting, email, payments, analytics) under strict confidentiality and data-protection terms.
• Where required by law, court order, or to protect the rights, property, or safety of MiStro or others.
• In connection with a merger, acquisition, or sale of assets, subject to continued protection under this Policy.

5. Data Storage & Security

Your data is stored on secure cloud infrastructure and is automatically backed up. We apply industry-standard technical and organisational measures to protect it against unauthorised access, loss, or misuse. However, no system is completely secure, and we cannot guarantee absolute security.

6. Retention

We keep your information for as long as your account is active or as needed to provide the Services and meet legal obligations. After account closure, business data may be deleted within 30 days unless retention is required by law.

7. Your Privacy Rights

Under the Privacy Act 2020 you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your personal information, subject to legal retention requirements.
• Withdraw consent for direct marketing at any time.
• Lodge a complaint with the Privacy Commissioner if you believe we have breached your privacy.

8. Cookies

Our websites use cookies and similar technologies to operate the Platform, remember your preferences, and understand how the site is used. You can control cookies through your browser settings, though disabling them may affect some functionality.

9. Third-Party Links

The Platform may link to third-party sites (e.g. our payment provider or integration partners). We are not responsible for the privacy practices of those sites and encourage you to review their policies.

10. Children's Privacy

The Services are intended for business use and are not directed at children under 18. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the Platform or by email. The "last updated" date above reflects the most recent revision.

12. Contact

Privacy enquiries can be sent to info@mistro.co.nz. Complaints may also be directed to the Office of the Privacy Commissioner, New Zealand.