Privacy Policy
Last updated: 3 July 2026
SiteSnap AI Limited is committed to protecting your personal information in accordance with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs). Where the service is used by Australian users, we also comply with the Australian Privacy Act 1988 (Cth).
1. Who We Are
SiteSnap AI Limited is a New Zealand company that operates the SiteSnap mobile app and supervisor web portal. Contact our Privacy Officer at support@getsitesnapai.com with the subject "Privacy Enquiry".
2. Information We Collect
- Account info: name, email, phone number, hashed password
- Site & project data: site names, addresses, diary entries, notes, photos, crew counts
- Incident, inspection, and delivery records
- Location data: GPS coordinates used at request time to auto-fill weather — not stored
- Device info: device type, OS version, push notification token
- Usage data: anonymised analytics events to improve the product
3. How We Use Your Information
- Providing and operating the SiteSnap service
- Sending verification codes, password resets, and notifications
- Analysing photos and notes to generate AI diary content (via OpenAI)
- Improving the product through aggregate, anonymised analytics
- Meeting record-keeping obligations under the NZ Health and Safety at Work Act 2015 (HSWA) and, for Australian users, applicable WHS legislation
4. Third-Party Services
- OpenAI (USA) — AI diary generation; photos and notes may be transmitted
- Resend / SendGrid (USA) — Email delivery
- Twilio (USA) — SMS delivery
- Sentry (USA) — Crash reporting
- Amazon Web Services S3 — Photo and file storage
All overseas transfers comply with NZ Privacy Act 2020 IPP 12. For Australian users, they also comply with the Australian Privacy Act 1988.
5. Data Retention
We retain data as long as your account is active or as required by law. Site diary records are subject to a minimum 7-year retention period under the NZ Health and Safety at Work Act 2015 (HSWA) and, for records relating to Australian sites, applicable state/territory WHS legislation. Deleted account data is permanently purged within 30 days, subject to these retention obligations.
6. Your Rights (NZ Privacy Act 2020)
- Access (IPP 6) — request a copy of your personal information
- Correction (IPP 7) — ask us to correct inaccurate information
- Deletion — request account and data deletion (subject to legal retention obligations)
- Portability — request a machine-readable data export
Australian users also have equivalent rights under the Australian Privacy Act 1988.
Email support@getsitesnapai.com with subject "Privacy Request". NZ users: we respond within 20 working days. AU users: within 30 days.
7. Security
Passwords are hashed with scrypt. API communications use HTTPS with HSTS. Auth tokens are stored in httpOnly cookies not accessible by browser scripts. We will notify users and relevant authorities of any notifiable privacy breach under the NZ Privacy Act 2020 (Part 7) and, where applicable, the Australian Privacy Act 1988.
8. Children's Privacy
SiteSnap is intended for construction professionals aged 18 and over. We do not knowingly collect information from minors.
9. Changes
We will notify you of material changes via the app or email at least 14 days before they take effect.
10. Contact & Complaints
Privacy Officer — support@getsitesnapai.com
New Zealand: Complaints may be referred to the Privacy Commissioner at privacy.org.nz
Australia: AU users may also contact the OAIC at oaic.gov.au