Your Privacy Matters
BestAI is committed to protecting your personal information in accordance with the New Zealand Privacy Act 2020. This policy explains how we collect, use, store, and protect your data.
How We Protect Your Information
Purpose of Collection
We only collect personal information that is necessary to provide our AI deployment and consulting services. This includes your name, email address, phone number, and business details submitted through our contact form or during service engagements.
Source of Information
We collect information directly from you: through our website contact form, email correspondence, phone calls, and in-person meetings. We do not collect personal information from third parties without your knowledge.
Collection Transparency
When we collect personal information, we will tell you why we need it, how we will use it, and who we may share it with. You are never obligated to provide personal information, but some services may not be available without it.
Storage & Security
Some hosting and email service providers may process information outside New Zealand. We use TLS encryption and access controls, and take reasonable steps to use providers that protect information appropriately.
Access & Correction
You have the right to request access to your personal information and to ask for corrections. Contact us at hello@bestai.co.nz and we will respond within 20 working days as required by the Privacy Act 2020.
Retention & Disposal
We retain personal information only as long as necessary for the purposes it was collected. When information is no longer needed, it is securely deleted or de-identified.
Full Privacy Policy
1. Who We Are
BestAI Ltd is an Auckland-based company providing AI deployment, website development, and digital services for New Zealand small businesses. Our registered address is 10/18 Karengo Street, Long Bay, Auckland. You can contact our Privacy Officer at hello@bestai.co.nz.
2. Information We Collect
- Contact details: name, email address, phone number, business name
- Business information: industry, business size, service requirements
- Technical data: page paths without query strings, browser and device type, approximate region, language, and a small set of interaction events used to understand the enquiry journey
- Service data: configuration details, workflow information, and system logs generated during AI deployment services
- Assistant data: chat messages, an opaque session identifier, IP address and any contact details you deliberately submit; the optional voice demo also processes microphone audio, transcripts and technical call metadata
3. How We Use Your Information
- To provide, maintain, and improve our AI deployment services
- To communicate with you about your service, including support and updates
- To send you information about our services, only with your consent
- To comply with legal obligations and protect our legitimate business interests
- To answer website-assistant questions, review enquiries and prepare a conversation summary after inactivity
4. AI Services & Your Data
- The website assistant sends the conversation needed for a reply to DeepSeek's official API. DeepSeek states that personal data it directly collects is processed and stored in the People's Republic of China.
- Before a chat request leaves BestAI, the service blocks common credential patterns and redacts direct email and phone patterns. Automated detection is not perfect, so do not enter passwords, API keys, customer records, health, financial or other sensitive information.
- After a completed reply, BestAI may store a redacted transcript, session identifier and IP address on its production server. After 30 minutes of inactivity, DeepSeek may process the redacted transcript again to prepare a summary, which the service may email to BestAI.
- The optional voice demo is a separate path. BestAI-operated speech recognition processes microphone audio, Groq processes the transcript to generate a reply, and Volcano Engine turns the reply text into speech. BestAI stores the transcript and technical session record. Groq documents that inference data is not retained by default, but may be logged for up to 30 days in United States storage for reliability or abuse review unless an account data-control setting excludes it.
- A customer AI deployment has its own written data path, provider, location, access, retention and recovery decisions. The website assistant does not prove that every deployment is isolated, hosted in one country or excluded from every model provider's service-improvement processes.
5. Third-Party Disclosure
We do not sell, trade, or rent your personal information. We use Cloudflare to host and protect the site and to check contact forms for automated abuse, Resend to deliver enquiries, Google Analytics for limited website measurement, Stripe for checkout and payment processing, DeepSeek to generate text-assistant replies and summaries, Groq to generate optional voice-demo replies and Volcano Engine to turn those replies into speech. These providers may process information outside New Zealand; DeepSeek states that personal data it directly collects is processed and stored in the People's Republic of China. We remain responsible for how we use those services and take reasonable steps to protect the information. We may also disclose information where required by New Zealand law or to protect the rights and safety of BestAI, our clients, or the public.
6. Cookies & Analytics
Analytics cookies are on by default. Google Analytics counts page visits and limited workflow-enquiry interactions so we can improve the website. The bottom Cookie bar stays visible until you choose Allow cookies or Reject analytics cookies. Your choice is saved in this browser, and Cookie settings in the footer lets you change it later. Rejecting analytics does not affect the contact form or other site features.
Unless you have rejected analytics, Google may use analytics cookies, browser and device information, and approximate region to report page visits. Google may process this information outside New Zealand. We send page addresses without query strings or fragments and send an empty referrer. Advertising storage, Google Signals and ad personalisation remain disabled. Rejecting analytics stops future collection and removes GA cookies from this browser; it does not automatically remove data Google has already received.
For a workflow enquiry, our custom events record only the page language, selected workflow offer, form version, whether a visitor started a workflow answer, and whether Resend accepted the enquiry. These events are sent only while analytics is on. We do not send names, contact details, company names, workflow answers, free text or URL query strings through analytics events.
7. Your Rights Under the Privacy Act 2020
- Access: Request a copy of the personal information we hold about you
- Correction: Ask us to correct any inaccurate information
- Complaint: Lodge a complaint with the Office of the Privacy Commissioner if you believe we have breached the Privacy Act
8. Privacy Breach Notification
In accordance with the Privacy Act 2020, if we become aware of a privacy breach that poses a risk of serious harm, we will notify the affected individuals and the Office of the Privacy Commissioner as soon as practicable.
9. Contact Us
If you have questions about this privacy policy or wish to exercise your rights, please contact us:
- Email: hello@bestai.co.nz
- Phone: +64 21 133 4406
- Address: 10/18 Karengo Street, Long Bay, Auckland, New Zealand
Questions About Your Privacy?
We take privacy seriously. If you have any concerns about how we handle your data, we're happy to discuss them.