Privacy Policy

Last updated: June 2026 · Governed by the New Zealand Privacy Act 2020

1. Who we are

Nashira ("we", "us") is a New Zealand business operations platform that connects accounting and operational tools used by small and medium businesses and provides automation on top of them. For privacy matters, contact privacy@nashira.nz.

2. Information we collect

Account information: your name, email address, business name, and login credentials.
Connected-system data: with your explicit authorisation, financial and operational data from systems you connect (for example Xero): invoices, contacts, bank transactions, and account balances.
Usage information: how you use Nashira (feature usage, session counts), technical logs, and device/browser information.
Billing information: handled by Stripe, our payment processor. We never store full card numbers.

3. How we use it

To provide the service: dashboards, alerts, and automations you enable.
To operate AI features. Before any data is processed by our AI provider, names, email addresses and tax identifiers are replaced with internal pseudonyms. Personal information is not sent to AI systems in clear text.
To communicate with you about your account and the service.
To meet our legal obligations.

We do not sell personal information. We do not use your business data to train AI models.

4. Where your data lives

Nashira is designed for data residency in Oceania. AI processing occurs in Microsoft Azure's Australia East region. During our private beta, some infrastructure may be hosted with providers outside Oceania; this is disclosed to beta participants and will be consolidated to Australian regions for general availability, consistent with IPP 11 of the Privacy Act 2020.

5. Who we share it with (processors)

Microsoft Azure (AI processing, Australia East) — under a data processing agreement
Stripe (payments) · Resend (transactional email) · Cloudflare (DNS/CDN) · hosting providers for the application and database

Each processor only receives what it needs to perform its function.

6. Your rights

Under the Privacy Act 2020 you may request access to, and correction of, personal information we hold about you. Email privacy@nashira.nz and we will respond within 20 working days. You may also complain to the Office of the Privacy Commissioner (privacy.org.nz).

7. Retention and deletion

Connected-system data is retained for the life of your subscription and deleted 30 days after cancellation; you may request an export before deletion. Chat and support transcripts are retained for limited periods and then purged. Audit records required for legal purposes are kept longer in minimised form.

8. Security

Connection credentials are encrypted at rest (AES-256), traffic is encrypted in transit (TLS), access is role-based and audited, and our staff do not access the contents of your financial data except with your consent during support escalations.

9. Breach notification

If a privacy breach occurs that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected users as required by the Privacy Act 2020.

10. Changes

We will post updates to this policy here and, for material changes, notify account holders by email.