Snapsure trust and legal
Privacy, Data and Responsible AI
This policy explains how Snapsure handles personal information during early access, how AI may be used in available workflows, and the choices and rights people have under New Zealand privacy law.
Snapsure is still being developed. This policy describes current handling practices and applies only to features actually enabled for you. We will update it before introducing a materially different use of personal information.
This policy explains how Changeable Limited handles personal information through Snapsure. It should be read with the terms confirmed during early-access onboarding and the rights provided by the Privacy Act 2020.
1
Who operates Snapsure
Snapsure is operated by Changeable Limited, a New Zealand company.
Inglewood, Taranaki, New Zealand
Steve Wilson
Our Privacy Officer supports compliance with the Privacy Act and handles privacy questions, requests and complaints.
2
Scope of this policy
This policy applies to personal information handled through the Snapsure website, early-access applications, approved user accounts, support and onboarding communications, and any product workflow or integration enabled for your account.
Product pages may describe planned capabilities. A planned feature is not covered as an active collection practice until it is enabled and actually handles information.
This policy does not cover third-party websites or services that Snapsure links to. Those services have their own privacy practices and we encourage you to read their policies.
3
Information Snapsure collects
3.1 Account information
When you request early access or create an account, we may collect your name, email address, organisation, role, portfolio or team information, sign-in credentials or authentication identifiers, and onboarding responses.
3.2 Property and tenancy information
When the relevant feature is enabled, we may collect property addresses, property characteristics, room information, inspection details, and contact information you choose to associate with a property.
3.3 Inspection and compliance data
Depending on your release and permissions, this may include photographs, video, voice recordings, transcripts, typed observations, condition records, maintenance notes and evidence relevant to Healthy Homes documentation. Snapsure supports evidence capture and organisation. It does not itself certify compliance.
3.4 Listing data
If listing features are enabled, we may process listing details, draft descriptions, original photographs, enhanced images and virtually staged variants.
3.5 Signatures
If signature or acknowledgement features are enabled, we collect the information shown at the point of signing, which may include a signature image, name, role and timestamp. We will identify any additional technical information collected before that feature is used.
3.6 Subscription and billing
If paid access is offered, we collect the information needed to administer billing and retain transaction and invoice records. Payment card details are handled by the payment provider identified at purchase and are not intended to be stored in full by Snapsure.
3.7 Device and activity information
We may collect browser, device, IP address, session, security, feature-use, error and performance information needed to operate and protect the service. Location information is collected only if an enabled feature requests it and you grant permission.
3.8 Support and feedback
When you contact us, we collect your name and contact details, the content of your enquiry, and any attachments or screenshots you provide.
3.9 Cookies and analytics
We use cookies and similar technologies as described in section 17 of this policy.
4
Why information is collected
We collect and use personal information for the following purposes:
We use personal information to assess early-access applications, create and secure accounts, provide enabled workflows, organise user-supplied evidence, generate drafts or suggestions, support authorised sharing, respond to enquiries, administer any agreed billing, investigate misuse, maintain service reliability and meet legal obligations.
We may also use limited service information to understand and improve Snapsure. Optional marketing communications are sent only where permitted and can be stopped at any time.
5
Information uploaded about other people
When you use Snapsure, you may upload personal information about other people, including tenants and occupants, property owners, contractors and tradespeople, co-inspectors and agency staff, and other contacts associated with a property.
You must have a lawful purpose and authority for collecting and uploading this information. Tell affected people how and why their information is being handled unless a lawful exception applies, and assist us if we need information from you to respond to a privacy request.
Privacy Principle 3A applies when an organisation collects personal information indirectly. More than one organisation may have notification responsibilities. Snapsure may provide a tenant privacy notice template, but using a template does not by itself establish compliance.
Avoid recording people, private possessions or sensitive information unless it is relevant, necessary and lawful. Do not use Snapsure for covert surveillance.
6
Photographs, video, audio and signatures
Depending on the features enabled for you, Snapsure may process photographs, video, voice recordings, transcripts and signatures as part of a property workflow.
6.1 Photographs
Photos you upload may be associated with a property, room, inspection or listing. Access is limited to authorised users and service providers that need the information to deliver the service. If location tagging is available, location is collected only with device permission. Image sizing, deletion and export options depend on the release confirmed for your account.
6.2 Video
Where video capture is enabled, Snapsure may process recordings or extracted frames to help create a property record. The interface or onboarding information will explain whether the original recording is retained and what deletion controls are available.
6.3 Voice recordings
Where voice capture is enabled, recordings may be transcribed and structured into draft observations. We will retain the original audio only for the period needed for the stated purpose, subject to the retention information in section 13. Transcripts may remain part of the relevant property record.
6.4 Signatures
Where signature or acknowledgement capture is enabled, you must tell the signer what is being recorded and have lawful authority to collect it. The service will show the associated data at the point of collection. A captured signature does not by itself guarantee the legal validity of a report.
7
How Snapsure uses AI
Where enabled, Snapsure uses AI to reduce manual entry and help structure property information. Available uses are confirmed for each release and may include the following:
7.1 Photo classification and condition assessment
AI may identify visible items, organise observations and suggest condition wording from photographs. It may miss, misidentify or misdescribe an item and cannot determine cause, responsibility, safety or legal liability.
7.2 Voice-to-structured-record
AI may transcribe spoken observations and organise them into draft room or item records. You must check the transcript and the structured record against what was actually observed.
7.3 Photo comparison
Where comparison is enabled, AI may highlight possible differences between current and earlier evidence. A highlighted or missed difference is not a finding about damage, cause, responsibility or deterioration.
7.4 Listing description generation
Where listing support is enabled, AI may draft property or room descriptions. You are responsible for checking that any published statement is accurate, supportable and not misleading.
7.5 Image enhancement and virtual staging
Planned image tools may improve presentation or create virtually staged variants. Edited and staged images must be clearly distinguished from original evidence and disclosed when used publicly.
7.6 Healthy Homes support
Where enabled, AI may help organise evidence or check entered information against configured rules. It does not inspect the property, determine compliance, provide legal advice or replace qualified assessment or certification.
7.7 Important limitations
All AI outputs are drafts or suggestions. You must review and approve them before they become part of a report, listing or decision. AI does not replace professional judgement. Original evidence must not be confused with enhanced or generated content.
8
AI training and provider retention
Snapsure does not use identifiable customer content to train a general-purpose model of its own. We select business-facing AI services and configure them, where supported, so customer content is not used to train shared models.
AI providers may retain limited prompts, outputs or technical information for security, abuse prevention or service operation under their contracted terms. The applicable handling depends on the provider and feature enabled at the time. We will not describe a zero-retention arrangement unless it is active and verified.
We may use aggregated or de-identified service information to improve Snapsure, provided it is handled in a way designed not to identify a person or property.
We review the provider settings used for each release and update this policy if the handling materially changes.
9
Service providers and subprocessors
Snapsure uses service providers to host, secure and operate the service. Providers receive only information reasonably needed for their role. The providers used may change as early access develops.
9.1 Hosting and infrastructure
May provide database, authentication, storage and supporting infrastructure for enabled product features.
May provide web hosting and content delivery and process normal web-request information such as IP address and browser details.
9.2 AI processing
May process photographs, transcripts, written context and generated outputs for AI-assisted features. Only the information needed for the requested task is sent.
If enhancement or virtual staging is enabled, the provider used for that release may process images you choose to submit. We will identify the provider before the feature is used.
9.3 Payments
If paid access is enabled, the provider identified at purchase will process payment and billing information under its own privacy terms.
9.4 Email
Processes recipient addresses and message content needed for onboarding, account, support or enabled sharing communications.
9.5 Analytics and monitoring
We do not rely on an unidentified analytics provider under this policy. If analytics beyond essential service measurement is enabled, we will identify the provider, information collected, cookie use and available choices first.
9.6 Error monitoring
We may use error and security monitoring that processes technical logs needed to diagnose faults and protect the service. Any external provider with access to personal information will be assessed and documented.
10
Overseas processing
Some service providers may process information outside New Zealand, including in the United States and other countries where cloud infrastructure is operated.
Privacy Principle 12 regulates disclosure outside New Zealand. We assess the basis for overseas disclosure, use appropriate contractual or other safeguards where required, limit information to the service purpose and review provider privacy and security commitments.
We will provide any additional authorisation or notice required before using an overseas arrangement that depends on informed authorisation.
11
Data sharing
We may share your information in the following circumstances:
If team access is enabled, authorised users may access account information according to the roles and permissions confirmed during onboarding.
When you direct Snapsure to share an enabled report or record, the selected content is made available to the recipient you specify.
If you connect an available integration, relevant information is disclosed as needed for your chosen settings. Rex CRM integration is planned and is not treated as active until confirmed.
as described in section 9, our service providers receive information necessary to deliver their functions.
we may share information with our legal, accounting or insurance advisers where necessary.
we may disclose information if required by law, regulation, legal process or enforceable government request, or if we believe disclosure is necessary to prevent harm or protect rights.
if Snapsure or its assets are acquired, merged or restructured, your information may be transferred to the successor entity, subject to the same privacy commitments described in this policy. We will notify you of any such transfer.
We do not sell personal information to third parties. We do not share information with advertisers.
12
Security
We take reasonable steps to protect personal information from unauthorised access, use, modification, disclosure and loss. Our security measures include:
Measures may include access controls, protected authentication, encrypted transmission, restricted administrative access, security logging, backups where appropriate, provider reviews and an incident-response process. Controls are reviewed as the early-access service changes.
You also play a role in keeping your account secure. We recommend using a strong, unique password, keeping your login credentials confidential, logging out of shared devices, and notifying us promptly at security@snapsure.co.nz if you suspect unauthorised access to your account.
No system is completely secure, and we cannot guarantee absolute security. We will respond to suspected incidents in line with our legal obligations.
13
Retention and deletion
We retain personal information only for as long as it is reasonably needed for the purpose for which it was collected, to provide the service, resolve disputes, maintain security or meet legal obligations. During early access, specific retention settings are confirmed before a feature relies on them.
Account and product information is generally retained while the account is active and the information is needed to provide the enabled service.
Any export window, read-only period or deletion schedule will be confirmed before paid access begins or when early access ends.
Inactive accounts may be reviewed for deletion. Where reasonably practicable, we will notify the account contact before deleting product records for inactivity.
When deletion is confirmed, relevant records are removed from active systems subject to backup cycles, legal requirements and information needed to document the request.
If archiving is enabled, the applicable retention and restoration period will be shown or confirmed before records are archived.
Audio is retained only as long as needed for transcription, quality review or the record purpose explained when the feature is enabled. A transcript may remain part of the property record.
Signature information is retained with the associated record for as long as that record is lawfully retained.
Transaction and tax records are retained for the period required by applicable accounting and tax law.
Technical logs are retained for a limited period based on security, troubleshooting and legal needs.
Deleted information may remain in protected backups until the relevant backup is overwritten through the normal cycle. Backup data is not restored for ordinary product use.
Support correspondence is retained only as long as needed to resolve the matter, maintain appropriate records and improve support.
Application information is retained while we assess participation, communicate relevant updates and maintain appropriate selection records. You may ask us to remove it.
14
Access and correction rights
Under Privacy Principles 6 and 7 of the Privacy Act 2020, you may ask for access to personal information Snapsure holds about you, request correction, and ask us to attach a statement of correction if we do not make the requested change.
To make a request, email privacy@snapsure.co.nz with enough detail for us to identify you and the relevant information. We may verify your identity. We will make and communicate our decision within the timeframe required by law, generally 20 working days, unless a lawful extension applies.
If your information was uploaded by a Snapsure customer (for example, a landlord or property manager added your name as a tenant), you may request access to or correction of that information by contacting us at privacy@snapsure.co.nz. We will work with the relevant customer to address your request.
15
Account deletion and data export
You can request deletion of your account at any time by emailing privacy@snapsure.co.nz or through the account settings in the app.
Available export formats and controls depend on your release and will be confirmed during onboarding. Contact us before deletion if you need help obtaining an available copy of your information.
After we verify a deletion request, we will remove information from active systems within a reasonable period unless it must be retained for legal, security or dispute purposes. Residual copies may remain in protected backups until overwritten through the normal cycle.
Ending paid access and deleting an account are different actions. Any consequences for access, export or retention will be confirmed before a paid plan begins.
16
Privacy breaches
If we become aware of a privacy breach that has caused or may cause serious harm, we will notify affected individuals and the Office of the Privacy Commissioner as required by the Privacy Act 2020.
We will assess and contain suspected breaches, preserve relevant evidence, notify affected people and the Privacy Commissioner as soon as practicable where required, and take reasonable steps to reduce the risk of recurrence.
17
Cookies and analytics
17.1 Essential cookies
The Snapsure website or application may use cookies that are necessary for security, sign-in, session continuity and saved preferences. Disabling an essential cookie may prevent the relevant feature from working.
17.2 Analytics
If we introduce non-essential analytics, we will identify the provider, explain what is collected and provide any consent or opt-out control required before those tools are enabled.
17.3 Marketing tracking
Snapsure does not currently use marketing tracking cookies or pixels. If this changes, we will update this policy and provide an opt-out mechanism.
17.4 Managing cookies
You can manage cookies through your browser settings. Disabling essential cookies may prevent Snapsure from functioning correctly.
18
Marketing communications
We distinguish between three types of communications:
These include account verification, password reset, security alerts, subscription confirmations, billing notifications, and important service announcements. You cannot opt out of these because they are necessary for the safe operation of your account.
If you signed up for early access, we may send you updates about Snapsure’s development, invitations to test new features, and launch announcements. You can unsubscribe from these at any time.
We send optional marketing only where you have opted in or where otherwise permitted by law. Marketing choice is separate from account creation. You can unsubscribe using the link provided or by contacting us.
19
Complaints and contact
Questions or complaints about this policy can be directed to our Privacy Officer.
Steve Wilson
If you have a concern about how we handle personal information, contact our Privacy Officer. We will acknowledge it promptly, investigate it fairly and respond within any timeframe required by law.
If you are not satisfied with our response, you can make a complaint to the Office of the Privacy Commissioner:
0800 803 909