Privacy Policy

1. Our Roles in Data Processing

Privacy laws can describe our roles differently. For trade business account information, Strelve decides why it is needed and uses it to run the account. For enquiry information, the trade business generally decides what to collect and how to use it. Strelve stores and handles that information to provide the Service, based on the business's settings and instructions.

2. Information We Collect

We collect only what Strelve needs to run your lead pipeline, send notifications, and support you.

• Name, email, role, and profile avatar.
• Business details: industry, website, contact email, contact phone, service country and city, and branding colours (logo, primary, secondary, accent).
• Estimate form questions and answer choices configured in your account. We may use generalised versions of these to create and improve reusable estimate form templates, as described in our Terms of Service. We exclude your actual prices and pricing rules, and do not use individual leads' submitted answers for this purpose.

• First and last name, email, phone, address, city.
• If someone enters their name and phone number on an estimate form but leaves before submitting it, we may save those details and the answers they have entered so the trade business can review the incomplete estimate.
• If an estimate form uses address autocomplete, the typed search text and selected place details are sent to Google Maps Platform (Places API) to return matching address information.
• Enquiry answers and job timeline.
• Priority score, pricing estimates, and activity log.
• Email reply body text and HTML are stored for up to 12 months after receipt and then automatically purged.

• Stripe customer ID and subscription ID.
• We never store full card details. Card data is handled directly by Stripe.

• Admin command text and chat identifiers are retained for up to 12 months for security, support, and audit purposes.
• New-lead alerts sent to the internal admin Telegram chat can include the lead's name, email address, phone number, estimated value, and enquiry source. These are internal alerts, not customer Telegram messages.
• The admin bot accepts commands and confirmation actions from allowlisted administrator chats. It does not process customer Telegram messages.

• Images and other allowed files you or your leads upload are checked for file type and size, processed locally where needed, and stored in Supabase Storage.
• We do not currently send file attachments to OpenAI Vision or store AI image scan results.
• Raw files are access-controlled to your client workspace.

• Vercel Analytics collects page views, Core Web Vitals, browser/device information, and country/city.
• PostHog records public website page views, campaign source tags, and defined enquiry events. Estimate form submissions use generated lead IDs and business context such as category and source. We do not send lead names, emails, phone numbers, or answers to PostHog. Operator accounts are identified by user ID and role for usage analytics. Public website session recordings are disabled.
• No personally identifiable information is transmitted to Vercel Analytics.
• Estimate form funnel events are stored in our database with a visitor ID, form event and step details, campaign and referrer information, and a generated lead ID when an enquiry is submitted. A scheduled cleanup deletes event records older than 720 days.
• Sign-up setup events are stored in our database with a random attempt ID, the plan selected, sign-up step timestamps, and completion status for required Professional business profile questions. We do not store the answers, typed form text, email address, or password in these events. Events for attempts that do not reach account creation are deleted after 180 days; events linked to an account are retained with that account's records.

• Sentry captures error reports with stack traces and breadcrumbs so we can fix bugs.
• User email and IP address are stripped before transmission. The shared scrubber also redacts email addresses, common phone numbers, recognised street addresses, and known lead details echoed in free-text connector errors.

• Captured ephemerally by Upstash Redis for rate limiting — held only for the rate-limit window, then discarded.
• Some admin audit records may include an IP address where one was recorded for the action. The audit log field is optional.

• If you connect Fergus, Simpro or ServiceM8, the access credentials used for that connection are encrypted at rest. Fergus uses a personal access token; Simpro and ServiceM8 use OAuth access and refresh tokens. Tradify handoff uses the Tradify enquiries email address configured by the trade business.
• These credentials are used only for the lead handoff or sync you have connected on your behalf.

3. How We Use the Information

• To provide, maintain, and improve the Strelve Service.
• To create and improve reusable estimate form templates from generalised form questions and answer choices. We do not use your actual prices, pricing rules, margins, or pricing calculations, or individual leads' submitted answers, for this purpose.
• To process subscription payments and send billing-related emails.
• To send service updates and (where you have not opted out) product announcements.

• We handle lead information to provide the Service, including storing and displaying it and sending it through features or integrations you request.
• We do not sell, rent, or use lead information for our own marketing, and we do not share it with your competitors.
• The trade business remains responsible for deciding how it uses lead information and for giving its customers any privacy notices required by law.

4. How We Secure Information

We apply industry-standard security controls, including Row-Level Security (RLS) policies within our database so that one client cannot read another client's data. Secrets and OAuth tokens are encrypted at rest. Card payments are handled directly by Stripe — we never see or store full card numbers. No internet-based service can guarantee 100% security, and we cannot guarantee absolute immunity from unauthorised access.

5. Third-Party Service Providers and Integrations

We share data with service providers needed to run Strelve. If a trade business connects an external service, we also send the information described below to that account. Each provider receives only the information needed for its role.

Some providers may process or store information outside New Zealand and Australia. Depending on the provider and its settings, processing may take place in the United States and countries in Europe or the Asia-Pacific region. The exact countries can vary by provider, account settings, and service. A CRM or webhook destination chosen by a trade business may also be in another country. Contact us for the current location details we can confirm for a provider or account. We take the steps required by applicable law before making an overseas transfer that requires safeguards.

• Stripe — payment processing and subscription billing; receives customer name, email, and billing address.
• Sentry — error monitoring; user PII (email, IP) is stripped before transmission. We maintain a Data Processing Agreement with Sentry — see their DPA.
• Vercel — application hosting and Vercel Analytics. Hosting may process technical request information needed to provide and secure the website. Vercel Analytics reports page views, performance, and broad browser and location information; it is separate from lead form answers and contact details.
• PostHog — product analytics for aggregate funnel and usage measurement. Lead submission events use generated lead IDs, not lead contact details. Operator accounts are identified by user ID and role.
• Supabase — primary database, authentication, and file storage (raw attachments).
• Upstash — ephemeral Redis used for rate limiting.
• Telegram — delivery of internal admin alerts and commands from allowlisted administrator chats. A new-lead alert can include the lead's name, email address, phone number, estimated value, and enquiry source.
• TNZ — delivery of SMS messages requested through the Service. TNZ receives the destination phone number, message text, and delivery reference needed to send and track the message.
• Customer-configured webhooks — when a trade business configures an endpoint, Strelve sends lead-created and lead-status events to that endpoint. A lead-created event can include lead and estimate-form IDs and names, the lead's name, email, phone and suburb, estimate minimum, source, campaign fields (including Google click ID where present), external ID, intake name, status, and duplicate indicator. A status-change event includes lead and form IDs and names, previous and new status, and the repaired-by value where present. The trade business chooses the endpoint and controls any copy it stores there.
• Resend — outbound email delivery for all lead and operator emails. Resend receives the recipient name, email address, and message content needed to deliver each email.
• Customer-configured Google Ads — when a trade business adds its conversion ID, the form loads the Google Ads tag after submission. The tag may record a page view and a conversion, and the conversion can include a generated lead ID as its transaction ID. The event Strelve configures does not include the lead's name, email, phone number, or form answers. Google may also receive browser, device, and page information under its own terms.
• Google Maps Platform (Places API) — receives address search text and selected place information when someone uses address autocomplete in an estimate form, and returns matching address details.
• Tradify — when a trade business has configured a Tradify enquiries address and requests a handoff, Strelve emails the lead's name, email, phone, property address and location, preferred call time, estimate and other lead details, selected questionnaire answers, and internal notes when present to that inbox.
• Fergus — if a trade business connects Fergus, Strelve sends the lead's name, email, phone, property address and location, preferred call time, estimate and other lead details, selected questionnaire answers, and internal notes when present to create an enquiry. Status updates send the lead reference, Strelve link, and status.
• Simpro — if a trade business connects Simpro, Strelve sends the lead's name, email and phone to create or find a customer, the property address and location for a site, and the lead status, estimate and other job details, selected questionnaire answers, and internal notes when present for the lead record.
• ServiceM8 — if a trade business connects ServiceM8 and requests a handoff, Strelve sends the lead's name, email, phone, site address and location, estimate, selected estimate answers, internal notes when present, and a link back to the Strelve lead. Strelve creates or reuses a ServiceM8 customer/contact and creates a job as a Quote or Work Order, depending on the estimate-form category configured for the handoff.

We do not sell your data to any party, and we do not use lead data to train public AI models.

6. Data Retention & Deletion

• Lead and client data: We do not deactivate accounts or automatically delete their records solely because of inactivity. Subscription cancellation does not automatically delete client records, leads, soft-deleted leads, uploaded lead files, CRM tokens, API keys, SMS delivery logs, webhook delivery records, or webhooks. There is no automatic deletion date after cancellation. We retain this data so the account remains available. Account owners can request deletion using the contact details under Your Rights.
• Demo lead data: Deleted within 30 minutes of submission. Demo submissions are stored temporarily while the demo is in use.
• Incomplete estimates: Contact details and saved answers are deleted 30 days after they are first saved. Later answer updates do not restart that period. If a trade business has more than 100 active incomplete estimates, we delete the oldest entries and keep the 100 newest across all its forms.
• Admin Telegram messages: Command text and chat identifiers are retained for up to 12 months for security, support, and audit purposes.
• Email reply bodies: Purged 12 months after receipt.
• Admin audit records: Kept as part of the long-term security and audit trail. Some records may include an IP address where one was recorded.
• SMS and webhook delivery records: SMS logs include the destination phone number and message text. Webhook records include the event payload described above. Neither has a separate age-based cleanup while the linked lead or client remains. Hard-deleting the linked lead or client removes these records. Failed webhook records older than 30 days are also removed.
• Analytics data: Governed by Vercel and PostHog retention settings. Lead submission analytics use generated lead IDs, not lead contact details.
• Soft-deleted leads: Kept while the account is available so accidental deletions can be recovered. Subscription cancellation does not automatically remove the account data.

7. Access, Correction, and Deletion Requests

Depending on the privacy law that applies, you can ask for access to personal information we hold about you and ask us to correct information that is inaccurate or out of date. You can also ask us to delete information. We will review the request and may need to keep information where the law requires it, or where it is still needed for a permitted account, security, or audit purpose.

To make a request, email support@strelve.co.nz. We may ask you to confirm your identity before providing personal information. For access requests, we aim to respond within 20 working days in New Zealand. For requests handled under the Australian Privacy Act, we aim to respond within 30 calendar days.

If you are a homeowner or lead, you can contact the trade business that collected your information or contact us. The trade business generally decides how it uses lead information. If we receive your request, we will help direct it to the right business and assist with its response.

8. Privacy Complaints

To make a privacy complaint, email support@strelve.co.nz with the subject “Privacy complaint”. Tell us what happened, when it happened, and what outcome you are seeking. We may ask you to confirm your identity. We aim to acknowledge your complaint and send you a written response within 30 calendar days. If we need longer, we will explain why and tell you when to expect an update.

If you are in New Zealand and cannot resolve the issue with us, you can contact the Office of the Privacy Commissioner. If you are in Australia and believe the Australian Privacy Act applies, you can contact the Office of the Australian Information Commissioner if you are not satisfied with our response or have not received one within 30 days.

9. Changes to this Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page or via email.

10. Contact Us

For any privacy-related queries, email support@strelve.co.nz or contact us.