Privacy Policy

This Privacy Policy explains how OraFlows Ltd ("OraFlows", "we", "us") collects, uses, discloses and protects personal information when you use our website and our products, OraInvoice and OraSign (together, the "Services"). We handle personal information in accordance with the New Zealand Privacy Act 2020 and the Information Privacy Principles.

1. Who we are

OraFlows Ltd is a New Zealand company providing business software. We are the "agency" responsible for personal information collected through our website and Services. For data our business customers enter into the Services about their own clients and staff, our customer is the controller of that information and we act as their processor.

2. Information we collect

We collect information that is necessary to provide and improve the Services, including:

• Account & contact details — name, business name, email address, phone number, and login credentials.
• Business records you enter — invoices, quotes, customers, jobs, timesheets, payroll and staff details, and documents sent for e-signature.
• Payment information — billing details processed by our payment providers (we do not store full card numbers).
• Usage & device data — IP address, browser type, pages visited and actions taken, collected to keep the Services secure and reliable.
• Communications — messages you send to our support team.

3. How we use your information

We use personal information to:

• Provide, operate, maintain and improve the Services;
• Create and manage your account and process payments;
• Generate invoices, payroll, e-signature audit trails and other records you request;
• Provide customer support and respond to enquiries;
• Detect, prevent and address security, fraud or technical issues;
• Meet our legal, tax and regulatory obligations in New Zealand.

4. Legal basis and consent

We collect personal information directly from you where practicable, and only for lawful purposes connected with our functions and activities. By using the Services you consent to the collection and use of your information as described in this policy. Where we rely on your consent, you may withdraw it at any time by contacting us.

5. Where your data is stored

OraFlows is proudly built and hosted in New Zealand. Your business data is stored and backed up on infrastructure located within New Zealand. We do not transfer your personal information offshore except where strictly necessary to provide a specific sub-service (for example, sending transactional email), and only where the recipient is subject to comparable privacy safeguards.

6. Sharing and disclosure

We do not sell your personal information. We only share it:

• With trusted service providers who help us operate the Services (such as hosting and payment processing), under confidentiality obligations;
• Where you direct us to (for example, sending a document to a signer through OraSign);
• Where required by law, or to protect the rights, safety and property of OraFlows, our users or the public.

7. Security

We use industry-standard technical and organisational measures — including encryption in transit, access controls and audit logging — to protect personal information against loss, misuse and unauthorised access. No system is completely secure, but we work continuously to safeguard your data and will notify affected individuals and the Office of the Privacy Commissioner of any notifiable privacy breach as required by law.

8. Retention

We keep personal information only for as long as necessary to provide the Services and to meet legal obligations (for example, tax and financial records must generally be retained for seven years under New Zealand law). When information is no longer required, we securely delete or de-identify it.

9. Your rights

Under the Privacy Act 2020 you have the right to request access to, and correction of, the personal information we hold about you. To make a request, contact us using the details below. We will respond within 20 working days. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner.

10. Cookies

Our website uses a small number of cookies and similar technologies to keep you signed in, remember your preferences and understand how the site is used. You can control cookies through your browser settings; disabling them may affect some functionality.

11. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. Significant changes will be communicated to account holders directly.

12. Contact us

If you have questions about this policy or wish to exercise your privacy rights, please get in touch:

Back to home