Privacy Policy

1. Who we are and our role

Vicky is provided by Vicky Compliance Solutions Limited (New Zealand company number 9455573), referred to in this policy as "we", "us" and "our". This policy covers the Vicky mobile app, the website at vickyhelps.com, and related support. It is written to meet the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs).

We act in two roles. For the quality management system (QMS) records an organisation enters into Vicky, such as staff, inspectors, signatures, assessments and equipment, the organisation is responsible for that information and we hold and process it on its behalf to provide the service. For account, billing, enquiry and website information, we are the responsible agency.

Our Privacy Officer is Patrick O'Carroll, contact@vickyhelps.com.

2. The information we collect

• Account details. Your name, email address and role, the organisation you belong to, and any invite code you use. Your password is held by our authentication service in hashed form. We cannot see it.
• Organisation and QMS records. What you choose to enter: organisation name, sites, certification types and authority numbers; staff and inspector details (name, initials, role, authority number, driver licence class, classes inspected, qualifications, and joined, inducted and left dates); training and induction records; conflict of interest declarations; equipment and calibration records; technical information sign-offs; complaints and improvement records; IO and VI performance assessments, including ratings, notes and the vehicle registration and check sheet number used; controlled document stock records; and any custom records.
• Signatures and initials. Drawn on your screen with a finger or stylus and stored as a small vector outline (a few lines of text). Vicky does not take a photo or scan of your signature and does not record pen pressure, speed or timing. A signature is used for one purpose: to show on a record that you personally read and signed it.
• Photos and documents. Images you take or choose in the app, such as Blue Star receipts, calibration certificates, qualification certificates and NZTA letters of findings. They are stored in private cloud storage linked to your organisation.
• Subscription and billing. A billing name and email, your plan, subscription status and a Stripe customer reference. Card details are entered directly on Stripe's pages and never reach us.
• Website enquiries and waitlist. Your name, business name, email address, optional phone number and message when you use the waitlist or contact form.
• On your device. The app's login PIN and Face ID or biometric lock stay on your device, and biometric data is handled entirely by your phone's operating system, never by us. The app keeps a working copy of your records on the device so it keeps working on a poor connection, and it schedules reminder notifications on the device. The review-mode PIN is stored with your organisation's settings so it applies on every device you use.
• Technical information. Sign-in sessions, and connection details such as IP address, device type and timestamps, which are recorded in the logs of our hosting, security and payment providers. We do not use advertising, analytics or tracking tools in the app or on the website.

What we do not collect

We do not collect bank or card numbers, driver licence numbers or other government ID numbers, dates of birth, or home addresses. The app does not use your location, your contacts or an advertising identifier.

3. How we use information

• To provide and maintain Vicky: store and show your records, calculate your readiness score, send reminders, and produce PDFs and emails of your records.
• To authenticate you, keep accounts secure and prevent misuse.
• To manage your subscription and billing.
• To provide support and respond to your enquiries, and to tell you about changes that affect the service.
• To run the AI-assisted features you choose to use (see the next section).
• To find and fix faults and keep the service reliable and secure.
• To meet our legal obligations.

We do not sell or rent personal information, we do not use it for advertising or profiling, and we do not use your records to train AI models. Waitlist and enquiry details are used only to respond to you and to tell you when Vicky is ready.

4. AI-assisted features

Vicky has two features that use an AI service, provided by Anthropic. Both go through our own secure server function, which holds the access credentials, so that no AI keys are present in the app.

• Ask Vicky. The question you type, and the earlier messages in that conversation, are sent to the AI service so it can answer. Your organisation's records are not sent. Please do not type personal information about a person into a question.
• Photo scanning. When you scan a Blue Star receipt or an NZTA letter of findings, the photo you take is sent to the AI service so it can read the text and draft a record. You review and edit the draft before anything is saved.

Nothing is sent to the AI service unless you use one of these features. The first time you use either one, the app asks for your permission and explains what will be sent. You can say no and carry on using the rest of Vicky, and you can change your mind at any time in Profile, under Preferences, where the AI features switch turns it off or on.

Under Anthropic's published terms for business customers, content sent to its API is not used to train its models by default, and is deleted from its systems within 30 days unless a longer period is needed for safety or legal reasons. AI output can be wrong. It is a draft or a guide for you to check, not a final answer.

5. Who can see your information

People in your organisation. Authorised people with a login to your organisation's Vicky account, such as the IO Representative and staff you invite. Each organisation sees only its own records, and your information is not shown to other organisations using Vicky.

Vicky's administrator. Our administrator can reach the database to provide support, fix faults, keep the service secure and meet legal obligations. We do not look at your records for any other reason.

Our service providers. We use the providers below to run Vicky. They process information only to provide their service to us, under their own terms and privacy commitments.

Our authentication service also sends account emails, such as sign-up confirmation and password reset, through an email delivery provider acting on our behalf.

Others. We may disclose information where the law requires it, to protect people from serious harm, or to a buyer if the business is sold, in which case this policy continues to apply to it. We do not give your records to NZTA Waka Kotahi. If NZTA asks to see your records, you can print or email them from Vicky, or show them in the app's read-only review mode.

6. Storing and sending information overseas

Your records are stored in Sydney, Australia. Some providers above process information in the United States, Europe or elsewhere. Before we use an overseas provider we take reasonable steps to ensure it protects information in a way that is comparable to the Privacy Act, including through its contractual terms and security certifications. New Zealand organisations remain responsible for information held for them by an overseas cloud service, and so do we.

7. How we protect your information

• Information is encrypted when stored (AES-256) and when sent between the app and our servers (TLS).
• Access is by personal login, and the database is set up so that each organisation can see only its own records.
• The app can be locked with a PIN or Face ID, and a read-only review mode lets someone look through your records without being able to change them.
• Our database provider holds SOC 2 Type 2 and ISO 27001 certifications and carries out regular independent security testing.
• We keep administrator access to the minimum needed.

No system is risk-free, and we would rather say so than overclaim. If a privacy breach is likely to cause serious harm, we will notify affected people and the Privacy Commissioner as the Privacy Act requires, and we will tell any organisation whose records are affected as soon as we reasonably can.

8. How long we keep information, and deleting it

We keep your records while your subscription is active. If your subscription ends, we keep your organisation's records for 90 days so that you can export them or come back, and then we delete them. Deleted information may remain in encrypted backups for a short further period of up to 35 days before it is overwritten. We keep basic billing records for 7 years because tax law requires it.

You can delete your account yourself in the app at any time: go to Profile, scroll to Delete account, and follow the steps. You will be asked to re-enter your password and to type DELETE to confirm, and the app tells you exactly what will be removed before anything happens. If you are the only owner of your organisation, deleting your account deletes the organisation and all of its records, signatures and photos, and its other team members lose access. If you are a manager, or one of several owners, only your own login and access are removed and the organisation stays in place. Deletion happens straight away and cannot be undone. You can also ask us to do it for you by emailing contact@vickyhelps.com from the email address on the account, and we will complete the request within 30 days and tell you when it is done.

If your organisation has an active subscription, deleting the organisation does not by itself stop Stripe billing. We cancel the subscription for every organisation that is deleted, but the app shows a link to the billing portal so you can cancel it yourself first and be certain you are not charged again. We keep a short deletion log (the date, the organisation name, and the Stripe references we need to cancel billing and answer any billing query) for up to 12 months. Deleted information may remain in encrypted backups for up to 35 days before it is overwritten, and we keep basic billing records for 7 years because tax law requires it. Your organisation may have its own legal duty to keep some inspection records, so export anything you need before you delete.

9. Your rights

Under the Privacy Act you can ask us for a copy of the personal information we hold about you, and ask us to correct it. Most records can be edited directly in the app, and you can ask your IO Representative or us to update your signature at any time. Past sign-offs may need to stay on the records they were made on, as they would on paper, but you can ask for your signature to be updated going forward.

To make a request, email contact@vickyhelps.com. We may need to confirm who you are first. We will respond within 20 working days, or tell you why we need more time. If you are a staff member or inspector whose details were entered by your organisation, you can also ask your IO Representative, because they are responsible for that information.

10. Device permissions

• Camera. To photograph receipts, certificates and letters. Used only when you choose to take a photo.
• Photos. To choose an existing image, and to save a record image to your device if you ask.
• Notifications. To remind you before equipment or records lapse. Reminders are scheduled on your device, and no notification token is sent to us.
• Face ID or biometrics. To unlock the app. Handled by your device. We never receive biometric data.

All of these are optional and can be changed in your device settings.

11. Our website

The website does not use advertising or analytics cookies. The sign-up and confirmation pages use your browser's storage so you stay signed in while you set up your account. The site loads fonts from Google Fonts and a script library from jsDelivr, and those providers receive your IP address when a page loads. Payment pages are provided by Stripe.

12. Children

Vicky is a business tool for inspecting organisations and inspectors, and is not directed at children. We do not knowingly collect information from anyone under 18.

13. Changes to this policy

We may update this policy from time to time. If we make a material change we will tell you in the app or by email before it takes effect. The date at the top shows when it was last updated.

14. Contact and complaints

Vicky Compliance Solutions Limited, Privacy Officer: Patrick O'Carroll. Email contact@vickyhelps.com or call 021 890 137.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz or on 0800 803 909.