Privacy Policy

Owner CFO Ltd ("Owner CFO", "we", "us") is a company registered in New Zealand [Company Number: pending registration], operating a financial management service for sole traders and small businesses in New Zealand and Australia.

We act as a data processor for your business's financial data. You are the data controller. This means you decide what data enters the system and retain full ownership.

Privacy Officer contact: privacy@ownercfo.com

We use your personal information to:

• Provide, maintain, and improve the Service
• Process payments and send billing communications
• Send essential service communications (security alerts, terms updates, downtime notices)
• Respond to support requests
• Detect and prevent fraud, abuse, or security incidents
• Comply with legal obligations (NZ tax record requirements, court orders)

With your explicit consent, we may also:

• Send product updates, feature announcements, and educational content
• Use anonymised, aggregated data for product analytics

We do not use your financial data to train AI models, sell data to data brokers, or share data with advertisers.

For customers in the EU or UK (GDPR applies), our legal bases are:

• Contract performance — processing necessary to deliver the Service you signed up for.
• Legitimate interests — security monitoring, fraud prevention, product improvement (balanced against your privacy rights).
• Consent — marketing emails, optional analytics. Withdrawable at any time.
• Legal obligation — complying with tax authority requests, court orders.

For NZ customers, our basis is the NZ Privacy Act 2020. For AU customers, it is the AU Privacy Act 1988 (Australian Privacy Principles).

We use the following named subprocessors to deliver the Service. We maintain Data Processing Agreements with each.

We will notify you by email of any material changes to our subprocessor list at least 14 days in advance.

Your Customer Data is stored in Supabase's ap-northeast-1 (Tokyo) region. This is the primary storage location for all database records and uploaded files (receipts).

Certain data may be temporarily processed in other regions when using AI features (via OpenRouter, which routes to US-based model providers). This processing is transient — the model inputs and outputs are not persistently stored by the AI provider.

Supabase holds ISO 27001 and SOC 2 Type II certifications for its infrastructure. Details at supabase.com/security.

We retain your Customer Data for as long as your account is active. After account deletion:

• 30-day grace period — data remains accessible and deletion can be cancelled.
• After 30 days — personal data and Customer Data are hard-deleted from production databases.
• Backups — encrypted backups are rotated within 90 days of deletion.
• Legal obligations — if you have used Owner CFO for tax purposes, NZ law requires you to retain tax records for 7 years. We may retain anonymised aggregated data for longer for legal compliance purposes; we will tell you if this applies to your account.

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — correct inaccurate or incomplete data.
• Deletion — request deletion of your data ("right to be forgotten"). Use Settings → Account → Delete my account, or email us.
• Portability — export your data in machine-readable JSON format at any time from Settings → Account → Export my data.
• Objection — object to processing based on legitimate interests.
• Restriction — request restriction of processing in certain circumstances.

To exercise any right, email privacy@ownercfo.com. We will respond within 20 working days (NZ Privacy Act 2020 requirement).

If you are unsatisfied with our response, you may complain to:

• New Zealand: Office of the Privacy Commissioner — privacy.org.nz
• Australia: Office of the Australian Information Commissioner — oaic.gov.au
• EU/UK: Your relevant Data Protection Authority.

We use strictly necessary cookies for authentication (session management) and CSRF protection. We do not currently use advertising cookies or cross-site tracking.

For full details, see our Cookie Policy. You can manage cookie preferences via the banner on your first visit.

The Service is not directed at individuals under 18. We do not knowingly collect personal data from children. If we become aware that a child has created an account, we will delete it promptly.

Privacy Officer: privacy@ownercfo.com

General support: support@centriweb.com

Postal: Owner CFO Ltd, [Address pending registration], New Zealand

We take privacy seriously and aim to respond to all enquiries within 5 working days.