Privacy Policy

1. Information We Collect

1.1 Information you provide

• Email address — when you create an account (email/password or Google sign-in).
• Account password — stored as an encrypted hash by Firebase Authentication. We never see or store your plain-text password.
• SOP text content — the text you paste or upload for conversion. This is processed to generate BPMN diagrams.
• Subscription and billing details — processed securely by Stripe. We do not store your credit card number on our servers.

1.2 Information collected automatically

• Usage data — pages visited, diagrams generated, and feature usage (via Google Analytics 4).
• Device and browser information — browser type, operating system, approximate location (country/city level).
• Authentication tokens — session identifiers required to keep you logged in.

2. How We Use Your Information

• To provide the Service — authenticating your account, processing SOP conversions, and storing your saved diagrams.
• To manage subscriptions — processing payments via Stripe and enforcing plan limits.
• To improve the Service — understanding which features are used and diagnosing technical issues.
• To communicate with you — service updates, security notifications, and responding to your support requests.
• To comply with our legal obligations under New Zealand law.

3. Legal Basis for Processing

Under the Privacy Act 2020, we collect and use your personal information on the following grounds:

• Performance of a contract — providing the BPMN conversion service you signed up for.
• Compliance with legal obligations — tax records, billing, and dispute resolution.
• Legitimate interests — improving service quality, security monitoring, and product analytics.
• Your consent — for optional analytics tracking and marketing communications (where applicable).

4. Third-Party Services

We use the following third-party providers to operate the Service. Each has its own privacy policy:

5. Data Storage and Security

Your data is stored with Firebase (Google Cloud Platform), which provides enterprise-grade security. We protect your information through:

• Encryption in transit — all data is transmitted over HTTPS/TLS.
• Encryption at rest — Firebase encrypts stored data.
• Access controls — server-side API keys for AI providers are never exposed to the browser.
• Authentication — Firebase Authentication with secure token-based sessions.

While we take reasonable steps to protect your data, no system is 100% secure. If a data breach occurs that is likely to cause serious harm, we will notify affected individuals and the Privacy Commissioner as required under Part 6 of the Privacy Act 2020.

6. Data Retention

We retain your personal information only as long as necessary:

• Account data — retained while your account is active. Deleted within 30 days of account closure.
• Saved diagrams — retained while your account is active. Deleted when you delete them or close your account.
• SOP text — sent to AI providers for processing but not permanently stored in our AI logs beyond temporary caching (1 hour for performance).
• Billing records — retained for 7 years as required by New Zealand tax law (Inland Revenue Department requirements).
• Analytics data — retained by Google Analytics for up to 14 months.

7. Your Rights Under the Privacy Act 2020

Under the New Zealand Privacy Act 2020, you have the following rights:

• Right to access (s.34) — request a copy of all personal information we hold about you.
• Right to correction (s.36) — request correction of inaccurate or incomplete information.
• Right to deletion — request deletion of your personal information (subject to legal retention requirements).
• Right to complain (s.176) — complain to the Privacy Commissioner if you believe we have breached your privacy.
• Right to know — be informed about the collection of your personal information and why.

To exercise any of these rights, contact us at support@bpmnify.app. We will respond to your request within 20 working days as required by the Privacy Act.

8. International Data Transfers

Your data is processed and stored by third-party providers (Firebase/Google, Stripe) whose servers may be located outside New Zealand (primarily the United States and other Google Cloud regions). These transfers are governed by the Privacy Act 2020's cross-border disclosure rules (Part 11, Subpart 3). We rely on these providers' certified data protection standards (e.g., Google Cloud 's ISO 27001 certification and SOC 2 compliance, Stripe's PCI DSS compliance).

9. Children's Privacy

BPMNify is a business tool and is not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us and we will delete it immediately.

10. Cookies

We use cookies and similar technologies to operate the Service. See our Cookie Policy for full details.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the Service. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact: