Your data, handled plainly.

Zelvo is an independent side project built and operated by an individual NZ-based software engineer — not a company. The "operator" referred to throughout this policy is that single person, who handles development, support, and any personal information the app collects.

This policy applies to everyone who uses Zelvo — whether you signed up as a property owner, were invited as a co-owner, or are just browsing the marketing site at zelvo.co.nz. It is written to meet obligations under the New Zealand Privacy Act 2020 and the information privacy principles (IPPs) set by the Office of the Privacy Commissioner.

We collect only what we need to operate the service:

A note on tenant information: you may enter a tenant's name, email, and phone when recording a tenancy. This is your record-keeping and is only ever visible to you and co-owners you've invited to the property. If you enter tenant details, please make sure your tenant is aware — under the Privacy Act 2020 you are the agency collecting that information.

We don't ask for IRD numbers or bank account numbers. If you ever paste them into a transaction description or note, please avoid doing so.

• To run your account and keep it secure.
• To calculate and display your rental income, deductible expenses, and estimated tax position.
• To generate tax reports and guide you through myIR filing.
• To let co-owners you invite view and collaborate on a shared property.
• To reply to support requests and improve the product based on usage patterns.
• To meet our legal obligations — for example, retaining financial records where required.

We share data with a small number of reputable service providers who help us run the service. We choose providers that offer security and privacy protections comparable to those required by New Zealand law, and we limit them to processing data only on our instructions.

• Cloud hosting & sign-in — stores your account, property, and rental records, and handles the sign-in process when you log in.
• Email delivery — sends sign-in links and transactional email (such as invitations and notifications) to your inbox.
• Google Analytics — helps us understand how the app is used so we can improve it. Google collects information such as IP address, device, and pages viewed under its own privacy terms. See the Cookies section below for how to opt out.
• Error monitoring — used to detect and diagnose bugs. Configured to avoid collecting the contents of your transactions, receipts, or tenant records.

If you want to know the specific provider behind any of these categories — for example to exercise an access or deletion request directly against them — email us and we'll let you know.

We do not share your data with advertisers, data brokers, or unrelated third parties.

Like every service that holds personal information, we may be compelled to disclose it where the law requires — for example in response to a valid warrant, court order, or a statutory notice issued by a government agency with lawful information-gathering powers. We will only disclose what is actually required, and where we're permitted to, we will let the affected user know.

Our hosting providers may store or process data on servers outside New Zealand — typically in Australia, the United States, or the European Union. Wherever it sits, we require providers to offer protection comparable to that of the NZ Privacy Act 2020.

When you delete your account from settings, we act on it straight away — there is no 30-day grace period or hidden archive. Specifically:

• Properties only you owned — the property record and everything attached to it (transactions, receipts, rooms, tenancies, chattels, mileage, recurring templates, category mappings) are permanently deleted in a single database transaction.
• Properties shared with co-owners — you are removed from the property, but the property's records remain available to the other owners. Those records are theirs as much as yours, so deleting your account doesn't delete their copy.
• Your login — your authentication record is removed from our auth provider so you can no longer sign in.
• A small audit record — we retain the fact that an account existed and was deleted: the associated email, the reason you gave (if any), and the deletion timestamp. This is used for abuse review and to improve the product. It is accessible only to our administrators.
• Server logs — rolling window of up to 90 days then rotated out.
• Database backups — up to 30 days rolling. Your data naturally ages out of backups on rotation.

Separately, note that IRD requires you — the landlord — to keep your own tax records for seven years. If you may need your Zelvo records for that, export them before deleting your account. We cannot recover them afterwards.

Under the Privacy Act 2020 you have the right to:

• Access a copy of the personal information we hold about you.
• Ask us to correct any information that is wrong or out of date.
• Ask us to delete your account and associated data, subject to the retention rules above.
• Withdraw consent for optional processing (such as product-update email) at any time.

To exercise any of these, email hello@zelvo.co.nz. We respond within 20 working days, as required by the Act.

We use a small number of strictly-necessary cookies and browser storage entries to keep you signed in, remember your active property / fiscal-year selection, and protect against cross-site request forgery. These are required for the app to work and cannot be turned off without breaking sign-in.

We also use Google Analytics to understand how the app is used — which pages are visited, which features are popular, and where people get stuck. Google Analytics sets its own cookies and collects information (such as IP address, device, browser, and pages viewed) according to Google's own policies, which we do not control. You can read Google's privacy practices at policies.google.com/privacy and opt out across all sites using Google's browser add-on at tools.google.com/dlpage/gaoptout. We do not use cookies for advertising or cross-site tracking.

New Zealand law does not currently require a cookie consent banner for analytics cookies, so we don't show one. If we begin operating in a region that requires one (for example the EU or the UK) we will display a consent prompt to visitors from those regions before non-essential cookies are set.

We take the safety of your records seriously. Your connection to Zelvo is encrypted, sign-in details are never stored in a readable form, and the database is set up so each account can only see its own properties and the ones it's been invited to. Our team keeps access to the minimum needed to run the service and we keep the software up to date.

No system is ever perfectly secure. If something goes wrong and a breach is likely to cause serious harm, we will notify the people affected and the Office of the Privacy Commissioner, as required by the Privacy Act 2020.

We may update this policy from time to time. The "last updated" date at the top will always reflect the current version. For material changes — for example, adding a new category of data or a new processor — we will notify active users by email or in-app notice.

Questions, access requests, or concerns? Reach us at hello@zelvo.co.nz or via the contact form.

If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.