Privacy, Data and Responsible AI

1

Who operates Snapsure

Snapsure is operated by Changeable Limited, a New Zealand company.

Under the Privacy Act 2020, every organisation that holds personal information must have at least one Privacy Officer. Our Privacy Officer is responsible for encouraging compliance with the information privacy principles and for dealing with requests and complaints.

2

Scope of this policy

This policy applies to all personal information collected, used, stored and disclosed through:

The Snapsure website at snapsure.co.nz; the Snapsure web application and any future mobile applications; all Snapsure user accounts; property inspection, Healthy Homes compliance and listing workflows; support and sales communications; integrations with third-party services; and data exports and reports generated by the platform.

This policy does not cover third-party websites or services that Snapsure links to. Those services have their own privacy practices and we encourage you to read their policies.

3

Information Snapsure collects

3.1 Account information

When you create a Snapsure account, we collect your name, email address, password (stored as a cryptographic hash, never in plain text), organisation name (if applicable), and your role (landlord, property manager, agent, or other).

3.2 Property and tenancy information

When you add a property, we collect the property address (including suburb, city and postcode), property type and configuration (bedrooms, bathrooms), room names and layouts, tenant names and contact details, landlord and agent contact details, and contractor or inspector details where you choose to add them.

3.3 Inspection and compliance data

During inspections and Healthy Homes assessments, we collect photographs of rooms and items, video recordings (from video walkthrough capture), voice recordings and the transcripts produced from them, typed notes and observations, condition ratings and descriptions (including those generated or suggested by AI), maintenance issues identified, Healthy Homes Standards measurements and evidence (heating capacity, insulation thickness, ventilation details, moisture and drainage observations, draught stopping status), smoke alarm information, and comparison data between inspections.

3.4 Listing data

When you use Snapsure's listing features, we collect listing descriptions (including AI-generated marketing copy), listing photographs and enhanced or virtually staged images, listing type, asking price or rental amount, and available dates.

3.5 Signatures

When you or a tenant sign an inspection report, we capture the signature as a digital image (canvas-drawn SVG or PNG), the signer's name and role, the date and time of signing, and the IP address from which the signature was submitted.

3.6 Subscription and billing

If you subscribe to a paid plan, we collect your chosen plan and billing period, payment method details (processed and stored by Stripe — Snapsure does not store full card numbers), transaction history, and tax invoice records.

3.7 Device and activity information

We automatically collect your device type, operating system and browser, IP address, pages visited and features used within Snapsure, timestamps of activity, GPS coordinates (only when you grant location permission during photo capture — used to geo-tag inspection evidence), and error and performance logs.

3.8 Support and feedback

When you contact us, we collect your name and contact details, the content of your enquiry, and any attachments or screenshots you provide.

3.9 Cookies and analytics

We use cookies and similar technologies as described in section 17 of this policy.

4

Why information is collected

We collect and use personal information for the following purposes:

Creating and maintaining your account; producing inspection reports, Healthy Homes compliance records and property condition documentation; processing photographs, video, voice recordings and text to generate structured records; preparing listing content including AI-generated descriptions and enhanced images; supporting Healthy Homes Standards documentation workflows across heating, insulation, ventilation, moisture and drainage, and draught stopping; sharing authorised records with tenants, landlords, property managers and other parties you designate; providing data exports (CSV, PDF) and integrations with property management systems; billing and subscription administration; security, fraud prevention and protecting the integrity of our service; providing product support; improving Snapsure's features and performance; and sending optional marketing communications (only with your consent).

5

Information uploaded about other people

When you use Snapsure, you may upload personal information about other people, including tenants and occupants, property owners, contractors and tradespeople, co-inspectors and agency staff, and other contacts associated with a property.

You are responsible for ensuring you have the authority to collect and upload this information. You should tell the affected person that their information is being recorded and stored in Snapsure, explain the purpose (property inspection, compliance documentation or listing preparation), and let them know they can contact privacy@snapsure.co.nz to request access to or correction of their information.

Privacy Principle 3A, which came into force on 1 May 2026, requires reasonable notification when personal information is collected indirectly (that is, not directly from the individual concerned), unless an exception applies. We recommend that landlords and property managers inform tenants that Snapsure is being used to record property conditions.

We may provide a tenant privacy notice template to help you meet this obligation. You should avoid recording people unnecessarily in photographs and video, and you should not add sensitive personal information to Snapsure unless it is relevant and lawful to do so.

6

Photographs, video, audio and signatures

Snapsure is a capture-first platform. Photos, video and voice recordings are central to how the service works.

6.1 Photographs

Photos are captured during property inspections and listing preparation. Each photo is associated with a specific property, room and inspection. Photos are stored securely in Supabase Storage with access controlled by row-level security policies — only the account owner (and authorised team members on Portfolio, Agency and Enterprise plans) can view photos for their properties. Photos are compressed to a maximum width of 2048 pixels to balance evidence quality with storage efficiency. GPS coordinates are attached to photos only if you have granted location permission on your device. You can delete individual photos from within the app.

6.2 Video

Video walkthrough recordings are used to capture room conditions efficiently. Snapsure extracts key frames from video recordings for use in inspection records. The original video file may be retained or discarded after frame extraction, depending on your storage settings. Video frames are treated identically to photographs for storage, access and deletion purposes.

6.3 Voice recordings

Voice recordings are transcribed into text using AI processing. The transcript is parsed into structured condition items (for example, identifying individual items like walls, carpet, curtains and assigning condition ratings based on your spoken observations). Voice recordings are retained only for the purpose of producing the transcript. Once transcription is complete, the original audio may be deleted. Transcripts remain associated with the relevant inspection items.

6.4 Signatures

Signatures are captured on-screen using a canvas drawing interface. They are stored as digital images (base64-encoded SVG or PNG) alongside the signer's name, role, timestamp and IP address. Signatures form part of the completed inspection report and are retained for as long as the report exists. You must have permission from the signer to capture and store their signature.

7

How Snapsure uses AI

Snapsure uses artificial intelligence to reduce manual data entry and speed up property documentation. AI is used in the following ways:

7.1 Photo classification and condition assessment

When you capture a photo during an inspection, AI analyses the image to identify visible fixtures, fittings and surfaces (for example, walls, carpet, curtains, taps, benchtops, windows); assess the condition of each item as good, fair, poor or damaged; detect specific issues such as stains, cracks, mould, wear patterns, missing or broken components and safety concerns; and flag items that may require maintenance.

The AI system uses factual, objective language appropriate for a legal document. It describes what it can see, does not speculate about causes of damage, and does not make recommendations about responsibility or liability. When the AI's confidence in a classification is below 70%, the item is flagged for your review.

7.2 Voice-to-structured-record

When you speak your observations about a room, the AI transcribes your recording and parses the natural language into structured data — matching your words to specific items, extracting condition ratings from your descriptions, and creating individual inspection item records. For example, if you say "walls are in good condition, small scuff mark near the door handle, carpet has some wear in the traffic area," the AI creates separate entries for walls (good condition) and carpet (fair condition with a description of wear).

7.3 Photo comparison

For routine and exit inspections, the AI compares current photos against previous inspection photos for the same room. It identifies and describes changes, assigns a severity rating (none, minor, moderate or significant), and presents the changes for your review. You can accept or dismiss each flagged change.

7.4 Listing description generation

When you use Snapsure's listing features, the AI generates marketing-oriented descriptions for each room and an overall property description suitable for listing portals. The tone is distinct from inspection mode — it focuses on presenting the property positively rather than assessing condition.

7.5 Image enhancement and virtual staging

Snapsure offers AI-powered image enhancement (improving lighting, clarity and presentation of property photos) and virtual staging (digitally furnishing empty rooms). Enhanced and staged images are clearly distinguished from original photographs. Virtual staging is always presented alongside the original image so you can choose which version to use.

7.6 Healthy Homes support

For Healthy Homes assessments, the AI assists with real-time validation of measurements against the Healthy Homes Standards (for example, confirming whether insulation thickness meets minimum requirements for the property's climate zone). This is a documentation and calculation tool — it does not replace professional inspection or certification where required.

7.7 Important limitations

All AI outputs are drafts and suggestions. You review and approve every output before it becomes part of a report or listing. AI can make mistakes — it may misidentify items, assess conditions incorrectly, miss issues that are not clearly visible in photos, or generate descriptions that need correction. AI does not replace professional judgement. AI does not determine legal compliance. Healthy Homes outputs do not replace qualified assessment or certification where required by law. Original inspection evidence (unaltered photographs, unedited transcripts) is always retained separately from enhanced marketing images. Virtually staged images must never be presented as unaltered property evidence.

8

AI training and provider retention

Customer content is not used to train Snapsure's own AI models. Customer content is not used to train third-party shared models. We use OpenAI's API with zero-data-retention settings where available, meaning your content is not retained by OpenAI for model training purposes.

Prompts and outputs may be temporarily logged by our AI providers for abuse monitoring and safety purposes, in accordance with their data processing agreements. These temporary logs are typically deleted within 30 days.

Anonymised and aggregated data (which cannot identify any individual or property) may be used to improve Snapsure's features and performance — for example, understanding which room types generate the most inspection items, or which condition categories are most common.

This wording must be verified against the production AI-provider settings before publication.

9

Service providers and subprocessors

Snapsure uses the following categories of service providers to deliver the platform. Each provider receives only the information necessary to perform its function.

9.1 Hosting and infrastructure

9.2 AI processing

9.3 Payments

9.4 Email

9.5 Analytics and monitoring

Analytics provider to be confirmed before publication. This section will be updated to identify the provider, information collected, cookie use, processing location and opt-out method.

9.6 Error monitoring

Error-monitoring provider to be confirmed before publication. This section will be updated to identify the provider, information collected and processing location.

10

Overseas processing

Some of the service providers listed above process information outside New Zealand, primarily in the United States and other countries where cloud infrastructure is hosted.

Privacy Principle 12 of the Privacy Act 2020 regulates the disclosure of personal information outside New Zealand. We take the following steps to protect your information when it is processed overseas: we use providers that offer contractual commitments to protect personal information to a standard comparable to New Zealand's Privacy Act; we configure API settings to minimise data retention by overseas providers (for example, zero-data-retention settings for AI processing); we limit the information shared with each provider to what is necessary for its specific function; and we review provider security practices and data processing terms.

By using Snapsure, you acknowledge that some information may be processed outside New Zealand in the manner described above.

11

Data sharing

We may share your information in the following circumstances:

We do not sell personal information to third parties. We do not share information with advertisers.

12

Security

We take reasonable steps to protect personal information from unauthorised access, use, modification, disclosure and loss. Our security measures include:

Secure authentication via Supabase Auth with encrypted password storage; row-level security (RLS) policies in our database ensuring users can only access their own data; encryption of data in transit using TLS/HTTPS; restricted staff access to production systems and data; security logging and monitoring; regular backups of application data; review of service provider security controls; and an incident response process for suspected security breaches.

You also play a role in keeping your account secure. We recommend using a strong, unique password, keeping your login credentials confidential, logging out of shared devices, and notifying us promptly at security@snapsure.co.nz if you suspect unauthorised access to your account.

No system is completely secure, and we cannot guarantee absolute security. We are committed to responding promptly and transparently if a security incident occurs.

13

Retention and deletion

Privacy Principle 9 of the Privacy Act 2020 limits retaining personal information longer than required for its lawful purpose. We apply the following retention periods:

14

Access and correction rights

Under Privacy Principles 6 and 7 of the Privacy Act 2020, you have the right to ask what personal information Snapsure holds about you, request a copy of that information, ask for correction of any information that is inaccurate or incomplete, and add a statement of correction if we decline to make a requested correction.

To make an access or correction request, email privacy@snapsure.co.nz with sufficient detail for us to identify you and the information you are requesting. We may ask you to verify your identity before responding. We will respond within 20 working days.

If your information was uploaded by a Snapsure customer (for example, a landlord or property manager added your name as a tenant), you may request access to or correction of that information by contacting us at privacy@snapsure.co.nz. We will work with the relevant customer to address your request.

15

Account deletion and data export

You can request deletion of your account at any time by emailing privacy@snapsure.co.nz or through the account settings in the app.

Before deletion, you can export your data using Snapsure's CSV export feature (available on Professional plans and above) and by downloading your inspection reports as PDF files.

Account deletion is processed within 30 days of a confirmed request. Once deletion is complete, your account data, property records, inspection data, photos, reports, listings, Healthy Homes assessments and team information are permanently removed from our live systems. Backups may retain deleted data for up to 30 additional days. Billing records required by law (tax invoices, transaction history) are retained for seven years regardless of account deletion.

If you cancel a paid subscription but do not request account deletion, your data remains accessible in read-only mode until the end of the paid-through period, after which the account reverts to the Free plan with a single-property limit. Properties exceeding the Free plan limit are archived for 90 days, then permanently deleted if not restored.

16

Privacy breaches

Snapsure has a privacy breach response process. If we become aware of a privacy breach that has caused or may cause serious harm, we will notify the affected individuals and the Office of the Privacy Commissioner as required by Part 6A of the Privacy Act 2020.

The Privacy Commissioner recommends notification ideally within 72 hours of becoming aware of a notifiable breach. We aim to meet this timeframe. Our breach response process includes identifying and containing the breach, assessing the risk of harm, notifying affected individuals and the Commissioner where required, and taking steps to prevent recurrence.

17

Cookies and analytics

17.1 Essential cookies

We use cookies that are strictly necessary for the operation of Snapsure, including authentication cookies that keep you logged in, and session cookies that maintain your preferences during a visit. These cookies cannot be disabled without breaking the service.

17.2 Analytics

Analytics provider and cookie details will be confirmed before publication. This section will then explain what data is collected, whether cookies are used, their duration and how to opt out.

17.3 Marketing tracking

Snapsure does not currently use marketing tracking cookies or pixels. If this changes, we will update this policy and provide an opt-out mechanism.

17.4 Managing cookies

You can manage cookies through your browser settings. Disabling essential cookies may prevent Snapsure from functioning correctly.

18

Marketing communications

We distinguish between three types of communications:

19

Complaints and contact

If you have a concern about how we handle personal information, please contact our Privacy Officer. We will acknowledge your complaint within five working days and aim to resolve it within 20 working days.

If you are not satisfied with our response, you can make a complaint to the Office of the Privacy Commissioner: