1. Introduction

This Privacy Policy explains how Web Ventures Ltd ("we", "us", "our") collects, uses, stores, and protects your personal information when you use the Multifari platform and related services (the "Service"). We are committed to protecting your privacy in accordance with the New Zealand Privacy Act 2020 and the Information Privacy Principles.

2. Information We Collect

2.1 Information You Provide

• Account information: Name, email address, and password when you create an account.
• Profile information: Organisation name, role, and other details you choose to provide.
• Content: Articles, images, videos, and other materials you upload or create using the Service.
• Payment information: Billing details processed through Stripe (we do not store full card numbers).
• Communications: Messages you send to us via email or contact forms.
• Social media credentials: OAuth tokens for third-party platform integrations (YouTube, TikTok, Instagram, Facebook, LinkedIn, X/Twitter), stored in encrypted form.

2.2 Information Collected Automatically

• Usage data: Pages visited, features used, actions taken within the Service.
• Device information: Browser type, operating system, screen resolution, and device identifiers.
• Log data: IP addresses, access times, and referring URLs.
• Cookies and similar technologies: Session cookies for authentication, preference cookies for user settings, and analytics cookies (see Section 7).
• Analytics data: We use Google Analytics 4 (GA4) to understand how our Service is used. This may include anonymised browsing patterns, session duration, and page views.

2.3 Information from Third Parties

• Social login: If you sign in using Google, Facebook, Apple, LinkedIn, or GitHub, we receive your name, email address, and profile picture from those services.
• Platform metrics: We collect engagement metrics (views, likes, comments, shares) from social platforms where your content is distributed, to provide analytics within the Service.
• GeoIP data: We use MaxMind's GeoIP database to determine approximate geographic location from IP addresses for analytics and content localisation.

3. How We Use Your Information

We use your information to:

• Provide the Service: Operate and maintain the platform, process your requests, and deliver features you use.
• AI content generation: Process your inputs through AI services (Anthropic Claude, OpenAI) to generate articles, videos, and other content. Your prompts and content are sent to these providers' APIs for processing. We do not use your content to train AI models.
• Social distribution: Post content to third-party platforms on your behalf using the credentials you provide.
• Analytics: Aggregate and analyse usage data to improve the Service and provide you with performance insights.
• Communication: Send you service-related notifications, updates, and responses to your enquiries. Marketing emails are sent only with your consent and include an unsubscribe option.
• Security: Detect and prevent fraud, abuse, and security threats.
• Legal compliance: Comply with applicable laws, regulations, and legal processes.

4. How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

• AI service providers: Content and prompts are sent to Anthropic (Claude) and OpenAI for AI-powered content generation. These providers process data under their own privacy policies and data processing agreements.
• Social media platforms: Content is distributed to platforms (YouTube, TikTok, Instagram, Facebook, LinkedIn, X/Twitter) using your authorised credentials. We share only the content and metadata necessary for posting.
• Cloud infrastructure: Data is stored and processed using Amazon Web Services (AWS) infrastructure located in the Asia-Pacific (Sydney) region.
• Payment processing: Payment information is processed by Stripe, which operates under its own privacy policy.
• Email services: Transactional and marketing emails are sent through Resend and Mailgun.
• Analytics: Anonymised usage data is processed by Google Analytics 4.
• Legal requirements: We may disclose information if required by law, court order, or government request.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring party.

5. Data Storage and Security

Your data is stored on servers operated by Amazon Web Services (AWS) in the Asia-Pacific (Sydney, ap-southeast-2) region. We implement industry-standard security measures including:

• Encryption of data in transit (TLS/SSL) and sensitive data at rest.
• Encrypted storage of social media OAuth credentials and API keys.
• Regular security audits and vulnerability assessments.
• Access controls limiting who can view or modify your data.
• Rate limiting and abuse prevention via Rack::Attack.

While we take reasonable steps to protect your information, no method of transmission or storage is completely secure. We cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: Retained until you request deletion or your account is terminated.
• Content: Retained until you delete it or for up to 90 days after account termination.
• Analytics data: Retained for up to 24 months, after which it is automatically purged.
• Log data: Retained for up to 12 months for security and debugging purposes.
• Payment records: Retained as required by New Zealand tax law (currently 7 years).

7. Cookies

We use the following types of cookies:

• Essential cookies: Required for authentication and basic Service functionality. Cannot be disabled.
• Analytics cookies: Google Analytics 4 cookies to understand usage patterns. You can opt out using Google's opt-out browser add-on.

We do not use advertising or tracking cookies for personalised advertising.

8. Your Rights

Under the New Zealand Privacy Act 2020, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your personal information (subject to legal retention requirements).
• Data portability: Request an export of your content and data in a standard format.
• Withdraw consent: Withdraw consent for marketing communications at any time.

To exercise these rights, contact us at [email protected]. We will respond within 20 working days as required by the Privacy Act 2020.

9. International Data Transfers

Your data may be transferred to and processed in countries outside New Zealand, including:

• Australia: AWS Sydney region (primary data storage).
• United States: AI service providers (Anthropic, OpenAI), payment processing (Stripe), email services (Resend), and social media platform APIs.

We ensure that any international transfers comply with the New Zealand Privacy Act 2020 and that receiving parties provide adequate data protection.

10. Children's Privacy

The Service is not intended for use by children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

11. Google API Services

Our use of information received from Google APIs (including YouTube Data API, Google Analytics, and Google Search Console) adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only use Google API data to provide and improve features you have explicitly authorised.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through the Service at least 14 days before they take effect. The "Effective Date" at the top of this policy indicates when it was last updated.

13. Contact

For privacy-related enquiries or to exercise your rights:

Web Ventures Ltd
Privacy Officer
Email: [email protected]

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Privacy Commissioner.