Airbooks Privacy Policy

Last updated: 16 July 2026

1. Introduction

Airbooks respects your privacy and is committed to protecting personal information in accordance with the New Zealand Privacy Act 2020.

This Privacy Policy explains how Airbooks collects, uses, stores, discloses, protects, and retains personal information when you use Airbooks, including our website, web application, mobile application, accounting tools, bank feed tools, document processing features, support services, and related services.

This Privacy Policy should be read together with our Terms of Service.

If you use Airbooks on behalf of a business, company, trust, partnership, organisation, or other entity, references to "you" may include that entity and the users authorised to access that entity's Airbooks account.

2. Who we are

In this Privacy Policy, Airbooks, we, us, and our means the Airbooks legal entity that provides the Service to you.

Our contact details are:

• Legal name: Airbooks Ltd
• Privacy email: privacy@airbooks.nz
• Legal email: legal@airbooks.nz
• Postal address: 48 Ocean Rd, Paraparaumu Beach, Paraparaumu 5032, New Zealand

3. Key definitions

In this Privacy Policy:

Account Information means personal information about people who register for, access, administer, or use Airbooks.

Akahu means Akahu Technologies Limited, New Zealand's open finance platform, which Airbooks uses to connect to financial accounts and retrieve financial account data.

Bank Feed Data means information obtained from a connected financial account, including account details, balances, transactions, transaction descriptions, dates, amounts, merchant information, and related metadata.

Business Data means information, records, files, accounting entries, invoices, bills, receipts, contacts, customer information, supplier information, Bank Feed Data, documents, and other data entered into, uploaded to, generated in, or processed through Airbooks.

Customer Data means personal information included in Business Data, such as names, contact details, invoice details, supplier details, customer details, employee details, contractor details, payment references, or other personal information that you or your authorised users choose to enter into Airbooks.

Personal information has the meaning given to it in the New Zealand Privacy Act 2020.

Service means Airbooks and all related services, tools, features, integrations, websites, applications, APIs, support services, content, resources, and documentation.

Service Partner means a third-party provider whose services, systems, data, software, infrastructure, or integration are used by Airbooks or made available through Airbooks.

4. Scope of this Privacy Policy

This Privacy Policy applies to personal information that we collect:

a. when you visit our website; b. when you create or use an Airbooks account; c. when you use Airbooks through a browser, app, or mobile device; d. when you connect a bank account or other third-party integration; e. when you upload, import, forward, or process documents; f. when you contact us for support, sales, billing, or security help; g. when you receive marketing or service communications from us; and h. when we receive information from Service Partners, public sources, or other authorised sources.

This Privacy Policy applies to both Account Information and Customer Data, but we use those categories of information in different ways.

You remain responsible for Customer Data that you choose to input into Airbooks. That means you must make sure you have the right to collect, use, disclose, and process that information through Airbooks.

5. Information we collect about Airbooks users

We may collect Account Information about account owners, administrators, invited users, staff, contractors, advisors, and other people who access or use Airbooks.

This may include:

a. name; b. email address; c. phone number; d. job title or role; e. business name; f. business address; g. billing details; h. authentication and login information; i. account settings and preferences; j. support messages and communications with us; k. identity or verification information where required; l. usage information, such as pages viewed, features used, and actions taken; m. technical information, such as IP address, device identifiers, browser type, operating system, approximate location, session data, and security logs; n. information from public sources, such as the New Zealand Companies Register; and o. any other information you choose to provide to us.

You do not have to provide all requested information. However, if you do not provide information we reasonably need, we may not be able to provide some or all of the Service.

6. Business, accounting, and customer data

Airbooks is an accounting and business records platform. You and your authorised users may enter, upload, import, forward, generate, or store Business Data in Airbooks.

Business Data may include personal information about your customers, suppliers, staff, contractors, advisors, shareholders, directors, payees, payers, or other people connected with your business.

This may include:

a. names; b. email addresses; c. phone numbers; d. postal or billing addresses; e. invoice and bill details; f. receipt details; g. payment details and references; h. transaction descriptions; i. bank account details where included in documents or records; j. notes, attachments, and correspondence; k. tax, GST, or payroll-related information where you choose to enter it; and l. other information included in records you provide to Airbooks.

Customer Data remains your property.

We use Customer Data to provide, support, secure, maintain, and improve Airbooks, and as otherwise described in this Privacy Policy.

7. Financial account and bank feed data

If you choose to connect a bank account or other financial account, Airbooks collects and processes Bank Feed Data.

Airbooks uses Akahu to provide bank feed and open finance connectivity.

Depending on the accounts you connect and the permissions you approve, Bank Feed Data may include:

a. account names; b. account numbers or account identifiers; c. account type; d. balances; e. transaction history; f. transaction dates; g. transaction amounts; h. transaction descriptions; i. merchant or counterparty information; j. categorisation or enrichment information; k. account status information; and l. related metadata.

When you first connect an account, Airbooks retrieves up to 24 months of transaction history, and will then retrieve updated data on an ongoing basis until the connection ends.

Airbooks' access is read-only. We use Akahu to retrieve balances and transactions for accounting, reconciliation, reporting, and record-keeping purposes. Airbooks cannot initiate payments, move money, or make changes to your connected accounts. If we ever introduce features that would change this, we will clearly tell you in advance and obtain your separate authorisation before they apply to your connected accounts.

8. How we collect information

We may collect personal information:

a. directly from you when you create an account, use Airbooks, contact us, submit forms, upload documents, or configure settings; b. from authorised users of your Airbooks account; c. from your business, employer, accountant, bookkeeper, advisor, or administrator where they invite you or give you access; d. from documents, invoices, bills, receipts, emails, bank statements, and other records uploaded, forwarded, imported, or processed through Airbooks; e. from Akahu or other authorised bank feed providers when you connect a financial account; f. from third-party integrations you connect to Airbooks; g. from payment processors, authentication providers, email providers, hosting providers, analytics providers, and other Service Partners; h. automatically through cookies, logs, device information, and usage tracking; and i. from public sources where relevant to providing the Service.

Where we collect personal information indirectly, we will take reasonable steps to make sure people are informed where required by the Privacy Act 2020.

Where you provide personal information about another person to Airbooks, you are responsible for ensuring that you have the right to do so and that any required privacy notices or permissions have been provided.

9. Why we collect and use personal information

We may collect and use personal information to:

a. provide Airbooks and its features; b. create, verify, secure, and manage accounts; c. authenticate users and prevent unauthorised access; d. import, process, categorise, reconcile, and display accounting information; e. retrieve and process Bank Feed Data from connected accounts; f. match bank transactions to invoices, bills, receipts, and accounting entries; g. generate reports, summaries, dashboards, and accounting records; h. process uploaded or forwarded documents; i. provide support and respond to enquiries; j. send service, security, billing, and administrative messages; k. process payments and manage billing; l. detect, prevent, investigate, and respond to fraud, abuse, security incidents, errors, and misuse; m. monitor performance, availability, and reliability; n. improve Airbooks, including developing and testing new features; o. understand how users interact with Airbooks; p. send marketing communications where permitted; q. comply with legal, tax, accounting, regulatory, and audit obligations; r. enforce our Terms of Service and other agreements; and s. protect Airbooks, our users, Service Partners, and other people.

10. Automated processing and AI-assisted features

Airbooks may use automated systems, machine learning, or AI-assisted tools to help provide the Service.

Airbooks uses Anthropic's API for AI accountant chat, bank feed coding, and inbox document extraction. Information sent to Anthropic for these features may be processed in the United States.

These tools may be used to:

a. extract information from invoices, bills, receipts, emails, and other documents; b. categorise transactions; c. suggest accounting codes, GST treatment, matches, or reconciliation actions; d. detect duplicates, anomalies, or possible errors; e. generate summaries, reports, explanations, or support responses; and f. improve accuracy, reliability, security, and usability.

Automated outputs may be incomplete or incorrect. You remain responsible for reviewing and confirming important information before relying on it for accounting, tax, payment, compliance, or business decisions.

We will not knowingly allow a third-party AI provider to use your Customer Data to train public or general-purpose AI models unless we clearly tell you and, where required, obtain appropriate permission.

11. Akahu-specific data handling

When you connect a financial account using Akahu:

a. you will be directed through Akahu's authorisation flow; b. you choose which accounts to connect and what access to authorise; c. Akahu provides Airbooks with access tokens that allow Airbooks to retrieve authorised Bank Feed Data — we never see or store your bank login credentials; d. Airbooks stores access tokens securely on our servers and does not expose them to the browser or client-side application; e. Airbooks uses Bank Feed Data only for purposes connected with providing, securing, supporting, and improving the Service; and f. Airbooks will stop collecting new Bank Feed Data if you revoke access, disconnect the account, delete your Airbooks account, or the connection otherwise ends.

Airbooks may use Bank Feed Data to:

a. import transactions; b. display connected account information; c. display balances; d. categorise transactions; e. match payments to invoices, bills, receipts, or accounting entries; f. generate accounting records and reports; g. detect duplicate or missing transactions; h. troubleshoot bank feed issues; i. maintain security and audit logs; and j. comply with legal, regulatory, and Akahu accreditation requirements.

12. Revoking bank feed access

You can revoke or disconnect bank feed access at any time from within Airbooks. You can also revoke Airbooks' access directly through Akahu (my.akahu.nz) or, where supported, through your financial institution.

If you revoke access:

a. Airbooks will stop collecting new Bank Feed Data from that connection; b. Airbooks will delete or disable the relevant Akahu access token; c. active bank feed syncing will stop; d. connected accounts may be shown as disconnected, inactive, or requiring reconnection; and e. Airbooks will delete, anonymise, or stop using Akahu-sourced data that is no longer reasonably required.

Some information may be retained where reasonably required for accounting records, tax records, legal obligations, security, audit, dispute resolution, backup, or compliance purposes.

For example, raw Akahu feed data that is no longer required may be deleted or anonymised, while transactions that have been coded, reconciled, or promoted into your accounting records may be retained as part of your business records.

13. Account deletion and bank feed access

If you delete your Airbooks account, we will revoke associated Akahu access and stop further collection of Bank Feed Data.

Before deleting your account, you should export any Business Data you need to keep.

Account deletion is different from subscription cancellation.

If you cancel your paid subscription but do not delete your account, your transactional accounting data will normally remain available for access and export for 12 months after the subscription ends, as described in our Terms of Service. We will ordinarily send a warning approximately one month before automatic deletion.

14. Retention of information

We retain personal information only for as long as reasonably required for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Retention periods may depend on:

a. the type of information; b. whether your account is active; c. whether the information forms part of accounting, tax, audit, or legal records; d. whether the information is needed for security, fraud prevention, dispute resolution, or compliance; e. whether you have revoked a bank feed connection; f. whether you have cancelled your subscription; g. whether you have requested account deletion; and h. whether the information is stored in backups or logs.

As a general approach:

a. Account Information is retained while your account exists and for a reasonable period afterwards where needed for legal, security, billing, or compliance purposes; b. transactional accounting data is retained while your account is active and normally remains available for access and export for 12 months after the subscription ends, unless your account is deleted earlier or a longer period is required or permitted by law; c. Akahu access tokens are deleted or disabled when access is revoked or your account is deleted; d. Akahu-sourced data that is no longer reasonably required after revocation will be deleted, anonymised, or no longer used; e. stored AI chat messages and tool-result payloads are deleted after 12 months; f. raw AI document-extraction payloads are deleted after 90 days, while the original document and reviewed accounting fields may be retained under the applicable accounting-data period; g. support, security, and audit logs may be retained for a reasonable period to protect Airbooks and its users; and h. backup copies may remain for a limited period before being overwritten or deleted in the ordinary course of backup rotation.

New Zealand businesses may have legal obligations to keep accounting and tax records. Airbooks may retain certain business records where reasonably required to support those obligations or to comply with our own legal obligations.

15. Disclosure of personal information

We do not sell personal information.

We may disclose personal information where reasonably necessary for the purposes described in this Privacy Policy, including to:

a. authorised users of your Airbooks account; b. your business, account owner, administrator, accountant, bookkeeper, advisor, or invited users; c. Service Partners who help us provide, host, secure, support, analyse, improve, or administer Airbooks; d. Akahu and other bank feed or financial connectivity providers where needed to provide connected account features; e. payment processors where needed for billing; f. email and communications providers where needed to send service, support, billing, security, or marketing messages; g. document processing, automation, or AI-assisted service providers where needed to provide Airbooks features; h. professional advisers, insurers, auditors, and legal representatives; i. government, tax, law enforcement, regulatory, or dispute resolution bodies where required or permitted by law; j. another person or organisation where needed to protect rights, safety, security, or prevent fraud; k. a purchaser, assignee, or successor if we sell, restructure, merge, or transfer all or part of our business; and l. any other person where you authorise us to do so.

We require Service Partners to handle personal information appropriately and only for authorised purposes.

16. Service Partners and subprocessors

Airbooks uses Service Partners and subprocessors to provide the Service.

These may include providers for:

a. hosting and database infrastructure; b. authentication and account security; c. bank feed connectivity; d. payment processing; e. email delivery; f. analytics; g. monitoring, logging, and error tracking; h. customer support; i. file storage; j. document processing; k. AI-assisted extraction or automation; and l. professional services.

Current or expected Service Partners include:

17. Overseas storage and disclosure

Some of our Service Partners may store, process, or access personal information outside New Zealand.

Where we disclose personal information outside New Zealand, we will take reasonable steps to ensure that the information is protected in a way that is consistent with New Zealand privacy requirements, unless an exception applies.

This may include using providers that are subject to comparable privacy protections, contractual safeguards, security controls, or other appropriate protections.

By using Airbooks, you acknowledge that your information may be stored, processed, or accessed in countries outside New Zealand.

18. Security

We take reasonable steps to protect personal information from loss, unauthorised access, misuse, modification, disclosure, and other security risks.

Security measures may include:

a. encryption in transit; b. restricted access controls; c. authentication and session controls; d. server-side handling of sensitive tokens and secrets; e. logging and monitoring; f. secure hosting providers; g. backup and recovery processes; h. security testing and review; i. staff, contractor, and provider access controls; and j. internal policies and procedures.

No online service can be guaranteed to be completely secure.

You are responsible for keeping your login details secure, using strong passwords, limiting user access, and promptly telling us if you suspect unauthorised access.

19. Privacy breaches

If we become aware of a privacy breach, we will assess it and take steps that are reasonable in the circumstances.

Where a privacy breach has caused, or is likely to cause, serious harm, we will notify the New Zealand Privacy Commissioner and affected individuals where required by law.

We may also take steps to contain the breach, investigate what happened, reduce harm, restore security, and prevent similar incidents.

20. Accessing and correcting personal information

You have rights under the Privacy Act 2020 to request access to and correction of personal information we hold about you.

You can request access or correction by contacting us at:

Email: privacy@airbooks.nz

We may need to verify your identity before responding.

If you ask us to correct information and we do not agree with the requested correction, you may ask us to attach a statement of correction to the information where required by law.

We may charge reasonable costs for providing copies of information where permitted by law. If a charge applies, we will tell you before providing the information.

21. Updating account information

You can update certain information directly in Airbooks, such as your account details, business profile, billing details, and user settings.

You are responsible for keeping account and business information accurate and up to date.

If you are an invited user and cannot update information yourself, you may need to contact the account owner or administrator.

22. Marketing communications

We may send you marketing communications about Airbooks, new features, related services, offers, or updates where permitted.

You can opt out of marketing communications by using the unsubscribe link in the message or by contacting us.

Even if you opt out of marketing, we may still send service, billing, legal, security, or account-related messages.

23. Cookies and similar technologies

We may use cookies and similar technologies to operate Airbooks, keep you signed in, remember preferences, secure the Service, understand usage, improve performance, and analyse website traffic.

Cookies are small files stored on your browser or device.

Some cookies are necessary for Airbooks to work properly. Others may help us understand and improve the Service.

You can control cookies through your browser settings, but disabling some cookies may affect how Airbooks works.

24. Analytics and aggregated information

We may use analytics tools to understand how Airbooks is used and to improve the Service.

We may create aggregated, statistical, or de-identified information from personal information and Business Data.

Aggregated or de-identified information does not identify you personally. We may use it for analytics, benchmarking, product improvement, security, reporting, and business purposes.

We will not use aggregated or de-identified information in a way that intentionally identifies you or your customers.

25. Third-party links and integrations

Airbooks may include links to third-party websites, apps, services, plug-ins, or integrations.

Third parties may collect, use, store, or disclose personal information under their own privacy policies and terms.

We are not responsible for the privacy practices of third parties, except where they act as our Service Partners and process information on our behalf.

You should review third-party privacy policies before using those services.

26. Children

Airbooks is intended for business use and is not directed at children.

If you believe a child has provided personal information to Airbooks without appropriate authority, please contact us.

27. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, including as we add features, change Service Partners, update bank feed functionality, or respond to legal or regulatory changes.

If we make material changes, we will take reasonable steps to notify you, such as by email, in-app notice, or notice on our website.

If we make changes to this Privacy Policy that materially affect how Airbooks collects, uses, stores, shares, retains, or deletes Akahu-related data, we will also notify Akahu in accordance with Akahu's accreditation requirements.

Your continued use of Airbooks after the updated Privacy Policy takes effect means you acknowledge the updated Privacy Policy.

28. Complaints

If you have a question or complaint about privacy, please contact us first so we can try to resolve it.

Email: privacy@airbooks.nz Postal address: 48 Ocean Rd, Paraparaumu Beach, Paraparaumu 5032, New Zealand

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner in New Zealand.

29. More information

For more information about privacy in New Zealand, you can visit the Office of the Privacy Commissioner's website: www.privacy.org.nz.

30. Contact us

For privacy questions, access requests, correction requests, or complaints, contact:

Privacy Officer Airbooks Legal name: Airbooks Ltd Email: privacy@airbooks.nz Postal address: 48 Ocean Rd, Paraparaumu Beach, Paraparaumu 5032, New Zealand