Privacy Policy
CADLOFT LIMITED · Last updated: 19 September 2026
This policy explains what personal information CADLOFT LIMITED collects, why, and what happens to it. It is written to comply with the New Zealand Privacy Act 2020 and its Information Privacy Principles.
cadloft provides business software. A business (we call it the tenant) uses the platform to run its back office, and its staff and customers appear in the records it keeps. Contact us through the contact form at https://cadloft.co.nz/contact or at info@cadloft.co.nz.
Who is responsible for your information
The tenant business is the agency responsible for the personal information it puts into the platform about its staff, customers and suppliers. It decides what is collected and why. CADLOFT LIMITED processes that information on the tenant's behalf and on its instructions, and this policy describes how we do that.
If you are a member of staff or a customer of a business that uses the platform, that business is your first point of contact for questions about your information. You can also contact us directly and we will work with them to answer you.
Where you deal with us directly, for example by emailing us or visiting this website, CADLOFT LIMITED is the agency responsible for that information.
What we collect
Account details. Name, email address, the organisation you belong to, your role in it, and a password hash. Where notifications are enabled in the staff app, a device token as well, so that a notification can be delivered to that phone.
Time and attendance records. Clock-in and clock-out times, breaks, leave requests and approvals, and the hours calculated from them for payroll.
Location, only while clocked in. The staff app records the coordinates of each clock-in and clock-out so the entry can be matched to a job site. If the tenant switches on location sharing, the app also records your location at roughly ten-minute intervals while you are clocked in, and stops when you clock out. The app does not collect location at any other time.
Business records the tenant enters. Customers and their contacts, quotes, projects, invoices, purchase orders, supplier invoices and statements, inventory, and documents the tenant uploads or that arrive in a mailbox the tenant connects. These records may contain personal information about the tenant's customers, contacts and suppliers.
Usage information for this website. Vercel Web Analytics records page views without cookies and without identifying visitors. We use no advertising trackers.
Why we collect it
To provide the service the tenant has asked for: keeping its time, project, sales, purchasing and document records; calculating hours; sending the messages it configures; and letting the software agents it authorises act within the limits it sets. We also use it to secure the service, to investigate faults, and to meet legal obligations.
Where it is stored
Information is stored on cloud infrastructure operated by Railway and Vercel, currently outside New Zealand. Under the Privacy Act 2020 we may disclose information to an overseas provider only where it will be subject to comparable safeguards; our agreements with these providers require that.
Who else handles it
We use the following sub-processors. Each handles only what is needed for its purpose.
- Railway — application hosting and the database.
- Vercel — hosting of the web applications and this site, and cookie-less web analytics.
- Resend — transactional email: invitations, the quotes and invoices a tenant sends, notifications.
- Expo — delivery of push notifications to the staff app, where notifications are enabled.
- OpenAI — text extraction from supplier invoices and statements, only when a tenant uses the document parsing feature. Documents are sent for extraction and are not used to train models.
- Google — only when a tenant connects a Gmail mailbox, and only within the scopes the tenant approves at the time.
- Apple and Google app stores — distribution of the staff app.
We do not sell personal information, and we do not share it with anyone for advertising.
How long we keep it
Location pings collected during shifts are purged on a schedule the tenant sets; the default is 90 days.
Other records are kept while the tenant's account is active. When a tenant closes its account we delete its records, except that financial records (invoices, purchase orders, payables and the time records that feed payroll) are kept for seven years where New Zealand tax and employment law requires, and then deleted.
Your rights
You have the right under the Privacy Act to ask for access to the personal information we hold about you and to ask for it to be corrected. Ask through the contact form at https://cadloft.co.nz/contact or by email to info@cadloft.co.nz; we will respond within 20 working days. Because the tenant is usually the responsible agency, we may confirm the request with them or refer it to them.
You may ask for your personal information to be deleted by the same route. We will remove it unless the tenant is required by law to retain it, in which case we will tell you.
Deleting your account
How to ask for your account and your data to be deleted sets out who to ask, what we remove, and which records New Zealand law requires us to keep. That page is public and needs no sign-in.
If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
Children
The platform is business software, provided to businesses for their staff. It is not directed at children, and we do not knowingly collect personal information from them.
Security
Access to tenant data is scoped to the tenant: one business cannot see another's records, and requests for records outside a business's own return nothing. Software agents act with credentials issued by the tenant that cannot approve anything leaving the business, and every change is recorded with who or what made it. Data is encrypted in transit.
Changes
We will notify tenants by email when this policy changes materially, and the date at the top will move.
Contact
CADLOFT LIMITED · the contact form at https://cadloft.co.nz/contact · info@cadloft.co.nz