This Privacy Policy explains how Chasvi Co Limited, the operator of Stoneware, collects, uses, stores and discloses personal information when people use the Stoneware website, application, APIs, support channels and related services.
Stoneware is primarily a business-to-business service. Depending on the information involved, Chasvi Co Limited may act as the organisation responsible for personal information it collects for its own account-management, security, billing, support and business purposes, while a Stoneware customer may remain responsible for personal information that the customer enters into Stoneware about its employees, customers, suppliers, contractors or other people.
1. Information we collect
We may collect account and profile information, business contact details, authentication and security information, billing and subscription information, support communications, device and usage logs, API and integration metadata, and information submitted through Stoneware workflows.
Customer-entered data may include information about employees, customer contacts, supplier contacts, contractors, project participants and other business relationships. ARI prompts, questions and responses may also contain business or personal information where an authorised user chooses to include it.
2. Where information comes from
We may collect information directly from you, from the organisation that provides your Stoneware account, from authorised integrations and connected systems, from service providers acting on our behalf, and in limited cases from lawful public or third-party sources. Where New Zealand law requires notice for information collected indirectly, we take reasonable steps to provide that notice unless an exception applies.
3. Why we use personal information
We use personal information to provide and secure Stoneware; authenticate users; administer companies, subscriptions and permissions; deliver customer support; process billing; operate APIs and integrations; maintain audit and security records; diagnose faults; prevent misuse; communicate service information; improve product reliability and usability; comply with legal obligations; and, where enabled, provide ARI features within the user's authorised Stoneware context.
4. ARI and assisted intelligence
ARI is designed to operate within the current company and user permission context. Information supplied to ARI may be processed to generate answers, briefings, alerts, search results or recommended next actions. ARI does not replace the authoritative Stoneware records or controlled workflow actions. Users should avoid entering personal information that is not needed for the task.
5. When we disclose information
We may disclose personal information to authorised users within the relevant Stoneware customer organisation; infrastructure, security, communications, support, billing and integration providers that help us deliver the service; third-party services that a customer chooses to connect; professional advisers and insurers; and regulators, courts or law-enforcement bodies where disclosure is required or permitted by law.
We do not sell personal information to advertisers.
6. Overseas processing and disclosure
Stoneware may use service providers or infrastructure located outside New Zealand. Before disclosing personal information overseas, we take reasonable steps appropriate to the circumstances to ensure that the recipient is subject to comparable privacy safeguards, is otherwise covered by New Zealand privacy law, or that another lawful basis for the disclosure applies. Customer-configured integrations may also cause information to be transferred to locations selected by the customer.
7. Security
We use reasonable technical and organisational safeguards appropriate to the nature of the service and information involved. These include access controls, authentication and permission enforcement, tenant and company scoping, operational logging and security practices designed to reduce unauthorised access, alteration, loss or disclosure. No internet service can guarantee absolute security.
8. Retention
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide the service, to meet contractual or legal obligations, to resolve disputes, or to protect legitimate security and audit interests. Retention of customer-controlled data may also depend on the customer's subscription and instructions.
9. Access and correction
If Chasvi Co Limited holds personal information about you, you may ask for access to it or request correction, subject to applicable law. If the information is controlled by your employer or another Stoneware customer, we may direct your request to that organisation or assist it with the request where appropriate.
10. Privacy breaches
If a privacy breach involving personal information is likely to cause serious harm, we will assess and respond to it in accordance with applicable law, including notification to affected people and the New Zealand Office of the Privacy Commissioner where required.
11. Cookies and similar technologies
The public Stoneware website and application may use essential browser storage, cookies or similar technologies for security, sessions, preferences and service operation. See our Cookie Notice for more information.
12. Marketing communications
Where we send commercial electronic messages, we aim to do so only where permitted, identify the sender and provide a functional way to unsubscribe from marketing communications. Service, security and transactional notices may still be sent where necessary to operate an account.
13. Children and consumer use
Stoneware is designed for business and workplace use rather than as a consumer service for children. Organisations that provide accounts to younger workers are responsible for ensuring their use is lawful and appropriately supervised.
14. Changes to this Policy
We may update this Policy as Stoneware, our providers or legal requirements change. We will publish the updated version with a revised effective date and, where appropriate, provide additional notice.
15. Contact and complaints
Privacy enquiries can be directed to the Privacy Officer at Chasvi Co Limited, 158 Lake Rd, Belmont, Auckland 0622, New Zealand, by email at info@ccolabs.com, through the Stoneware contact page, or through the support channel associated with your account. You may also contact the New Zealand Office of the Privacy Commissioner if you believe your privacy rights have not been resolved.
This Policy is intended to operate consistently with the Privacy Act 2020 and its information privacy principles, including the rules for collection notices, indirect collection, security, retention, access/correction, disclosure and overseas disclosure.