Privacy Policy

Last updated [DD] [Mon] 2026

This Privacy Policy explains how [Provider Legal Name](“Shundo”, “we”, “us”) collects, uses, stores, and shares personal information when you use the Shundo chatbot service or submit an enquiry through the Shundo website.

We comply with the New Zealand Privacy Act 2020 and the Information Privacy Principles set out in that Act.

1. About this Policy

This policy applies to:

• visitors to the Shundo website (shundo.nz);
• people who submit the contact / get-started form on the Shundo website;
• Shundo customers who have subscribed to the Service; and
• end-user Visitors who interact with a deployed Shundo chatbot on a customer’s website.

By using the Service or submitting information to us, you acknowledge the collection and handling described in this policy.

2. What we collect

From the contact / get-started form on the Shundo website:

• business name, contact name, email address, phone number, website URL;
• selected Plan and any booking-platform preferences;
• optional fields you provide (welcome message, suggestions, brand colour, additional information, light/dark mode preference).

From your nominated website (Customer onboarding): publicly accessible page content scraped to generate the Knowledge Base.

From Visitors interacting with a deployed chatbot:

• the chat messages they send and the responses generated;
• a session identifier stored in the Visitor’s browser local storage;
• the IP address of the request (used for rate-limiting and abuse prevention);
• the originating website domain.

From payment processing: when you subscribe to a paid Plan, Stripe (our payment processor) collects and holds your card and billing details. We receive limited metadata (such as customer ID, last four digits of the card, and billing email). We never see or store your full card details.

We do not knowingly collect personal information from children under 16 (see section 9).

3. Why we collect it

We collect this information to:

• provide and operate the Service (build and host your chatbot, answer Visitor questions, deliver responses);
• communicate with you about your enquiry, onboarding, billing, support, and Service updates;
• protect the Service from abuse, including rate-limiting and usage caps;
• improve the Service through aggregated, de-identified analysis of how it is used;
• comply with our legal and tax obligations.

This is consistent with Information Privacy Principle 3 of the Privacy Act 2020 — collecting information directly from you for clearly stated purposes.

4. Where it is stored

The information you provide is stored on infrastructure operated by:

• Hostinger (our hosting provider), on a virtual private server hosting the Shundo website, the operator workflows (n8n), and the customer record database. Hostinger operates from the European Union.
• Stripe(payment processor) — payment-related data only.
• Cal.com(booking integration) — only for customers who enable booking integration; only the data needed to schedule appointments.
• Anthropic(large language model provider) — chat messages and Knowledge Base context are sent to Anthropic to generate chatbot responses. Anthropic processes this data in the United States.

We use commercially reasonable security controls to protect this information, but no internet-based service is completely secure.

5. How long we retain it

• Contact-form submissions: retained while we evaluate the enquiry and, if you become a customer, throughout your subscription. If you do not become a customer, we delete the submission after 12 months unless you ask us to delete it earlier.
• Customer Knowledge Base and submission data: retained throughout your subscription and for 30 days after cancellation, after which it is deleted (subject to anything we are required to keep by law, such as tax records).
• Chat conversation logs: retained for up to 90 days for abuse-prevention and quality monitoring, then deleted or fully de-identified.
• Billing records: retained for 7 years to meet our New Zealand tax record-keeping obligations.

6. Sharing and sub-processors

We share information only with the third parties needed to operate the Service:

• Hostinger— infrastructure host.
• Stripe— payment processing.
• Cal.com— booking (only for customers who enable it).
• Anthropic— LLM responses.

We do not sell your information. We do not share it for marketing purposes by anyone other than ourselves.

We may disclose information if required by law (such as a valid court order) or to protect the rights, safety, or property of the Provider, our customers, or the public.

7. Your rights

You have the right under the Privacy Act 2020 to:

• ask us what personal information we hold about you (Principle 6 — access);
• ask us to correct information that is wrong or out of date (Principle 7 — correction);
• ask us to delete your information, subject to any legal obligation we have to retain it.

To make any of these requests, email info@shundo.nzwith the subject line “Privacy request”. We will respond within 20 working days as required by the Privacy Act.

8. Cookies and local storage

The Shundo website itself does not currently use advertising cookies or third-party analytics tracking.

The deployed Shundo chatbot widget stores a small session identifier in the Visitor’s browser local storage so that conversation context persists across page navigations. This identifier is scoped to the Customer’s website domain and is not used for advertising or cross-site tracking.

9. Children

The Service is intended for use by businesses and adults. We do not knowingly collect personal information from children under 16. If you believe a child has provided information through the Service, please contact us at info@shundo.nz and we will delete it.

10. International transfers

Some of the third parties listed in section 4 (notably Anthropic) process your information outside New Zealand. Where we transfer information outside New Zealand, we rely on Information Privacy Principle 12 of the Privacy Act 2020 — we transfer information only to recipients that are subject to comparable privacy safeguards or under contractual protections that achieve the same outcome.

11. Contact and complaints

For any privacy question, request, or complaint, email info@shundo.nz.

If you are not satisfied with our response, you have the right to complain to the Office of the New Zealand Privacy Commissioner: www.privacy.org.nz.