Application Privacy Notice

Who we are

This notice explains how PaidTerms Finance Limited ("PaidTerms", "we") handles personal information when you apply for business finance through our online application at app.paidterms.co.nz/apply. It applies to this application only; our general privacy policy covers other PaidTerms services.

PaidTerms Finance Limited is responsible for handling the personal information collected through this application. Contact support@paidterms.co.nz with privacy questions. We handle personal information in line with the Privacy Act 2020.

What we collect, and why

• About you: your full name, work email address (which we confirm with a one-time code), mobile number, your role, and whether you say you are a director. We use these to identify you, contact you about this application and understand your connection to the business.
• About the business: the company you choose from the NZ Companies Office register. We look up its NZBN, legal name, status and registered address directly from the register.
• About the purchase or invoice: the supplier's website, the amount you want to spend and, if you have one, the invoice number. You don't need an invoice yet. We use these to assess the finance you are asking for and may contact the supplier to confirm the purchase or invoice.
• Which instalment plan you are interested in, if you tell us: 3, 6 or 9 months. This is a preference only, so that we know what to discuss with you; it is not an application for that plan, and it does not commit either of us to it.
• Your confirmations: which statements you accepted, their version, the time, and the name you typed. We also record the IP address and browser information sent when you accept them, to evidence it was you.
• Technical information: we use your IP address for security checks — bot protection (Cloudflare Turnstile) and limits on repeated attempts. Those limits use counters keyed by a one-way scrambled form of your IP address or of this browser's access key, never the address itself; each counter deletes itself when its time window ends, after at most one hour. Our hosting provider (Vercel) may also record your IP address in its request logs, which it keeps for a limited time. The application pages use Microsoft Clarity, a session-analytics tool, so that we can see where applicants get stuck and improve the application. Clarity records how the pages are used — pages visited, clicks, taps, scrolling and your device and browser information — and sets cookies in your browser to recognise a visit. The content of the application pages, including everything you type, is masked in those recordings, and Clarity does not run on Akahu's site, so it does not see your bank connection. We do not use Clarity for advertising.
• Bank information: to complete your application you connect your bank through Akahu, an open-banking provider. Akahu collects the bank information you agree to share on its site and makes it available to PaidTerms to assess your application; PaidTerms reviews it in Akahu's own dashboard and does not copy it into its own systems. PaidTerms asks for 365 days (about 12 months) of bank history. You'll see exactly what is shared on Akahu's site before you agree, and your banking login is never shared with PaidTerms. We record only whether and when you completed the bank connection.

Checks we make

• We check the business on the NZ Companies Office / NZBN register. This confirms the business exists and its registered details; it does not confirm that you work for it or may act for it.
• Your authority to apply is based on your own confirmation. We may ask for more information before making any offer.
• We may contact the supplier identified in your application (for example through its website) to confirm the purchase or invoice.
• We do not use a credit reporting agency for this application.

If you don't provide information

You don't have to give us any information, but we need the details asked for to consider your application. If something required is missing we can't assess the application. If you don't connect your bank, your application stays incomplete and won't be reviewed; we may contact you about providing financial information another way.

Who we share it with

• Service providers who run the application for us, under their own security and privacy terms: Supabase (database), Vercel (hosting), Resend (sending emails, including your verification code), Upstash (rate-limit counters, keyed by scrambled identifiers and deleted within an hour), Cloudflare Turnstile (bot protection, which receives your IP address and browser signals), and the NZ Companies Office register (business look-ups).
• Microsoft (Microsoft Clarity, session analytics), which receives the usage information described above under Microsoft's own privacy terms and may process it outside New Zealand.
• Akahu (the bank connection), which handles your bank information under its own privacy policy (akahu.nz).
• Google (Google Sheets), for PaidTerms' internal tracking list of applications that reach review. Each row holds: the application reference; when it became ready for review and was last updated; your name, email, mobile, role and director answer; the company's name, NZBN and register status; the supplier's website, the invoice number and the amount; the instalment plan you said you were interested in; whether bank information was shared; and the review status, which we update as the review progresses. It never holds bank information, documents, security codes, your IP address or browser information, or internal review notes.
• Internally, once your application is complete, an email summary of it is sent to the PaidTerms team. It contains your details and the invoice summary, but never documents, bank information or security codes.
• We don't sell your information. We share it with others only if you agree or the law requires or allows it.

Where it is stored (overseas handling)

• Our application database is in Mumbai, India (Supabase, AWS region ap-south-1), and our application servers run in Mumbai (Vercel). Requests reach those servers through Vercel's global network, and our providers' support, logging and backup arrangements may involve other countries, including the United States. Our rate-limit counters are held by Upstash, which may store them outside New Zealand.
• Resend (email) stores its records of the emails it sends for us, including their content, in the United States, and keeps them for 30 days.
• Cloudflare (bot protection) mainly stores the information it receives in the United States and the European Economic Area and may access it from other countries.
• Google (the tracking list) may store and process it in any country where Google or its sub-processors operate.
• We use these providers on the basis that they protect personal information with safeguards comparable to those in the Privacy Act 2020.

How long we keep it

• Applications you start but don't confirm by email: deleted after 7 days.
• Applications you confirm but never complete (including those waiting for the bank connection): deleted 30 days after your last change.
• Submitted applications that are declined, withdrawn or closed without finance: deleted 12 months after that decision.
• Applications that reach an offer of finance, or that we must keep for a legal or regulatory reason (for example a complaint or dispute), are not deleted automatically: they are held until we have confirmed the record-keeping period that applies to them, and are then deleted.
• Security codes and sign-in records: deleted 30 days after they expire or are used.
• When we delete an application, we also remove its copies outside our database — the internal email summary and its row in the tracking list — as a separate step after the deletion, and close any bank-sharing request still open at Akahu. Resend keeps its own record of each email for 30 days, and Akahu keeps its records under its own retention policy.
• We keep a log of actions taken on applications (for example when an application was submitted or reviewed). After an application is deleted, that log keeps only the reference and those actions, not your details.

Keeping it secure

• Access to your application in this browser uses a secure, private cookie; we never put access codes in links or in your browser's storage.
• Codes and access keys are stored only in scrambled form. Your email is confirmed before your application can continue, and repeated wrong attempts are blocked.
• Only authorised PaidTerms staff can view applications, and every staff action is recorded.

Your rights

You can ask to see the personal information we hold about you and ask us to correct it, by emailing support@paidterms.co.nz. You can also ask us to delete your application; we will do so unless we need to keep it by law. If you're not happy with how we handle your request, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

Changes to this notice

If we change this notice, the new version will apply to applications started after the change. The version you accepted is recorded with your application.