Pruply Privacy Policy

Covers the Pruply website and the Pruply Lite founding pilot, 26 October 2026 to 18 December 2026. Effective [date]. Version 0.2 (draft).

Drafting note: The operator is shown as [Pruply Limited, company number]. Until Pruply Limited is incorporated, the operator may be The Population Group Limited (company number 8495274, NZBN 9429050907274) trading as Pruply. Update every operator reference before publishing. Delete this note before publishing.

The short version

• In the pilot, your money data stays on your device. Pruply does not receive your transactions.

• We collect your sign up details, optional survey answers and your pilot feedback, and nothing more than we need.

• We never sell your data, never use it for advertising, and never use it to train AI models.

• Data about Māori users is treated as a taonga.

• You can ask to see, correct or delete your information at any time.

1. Who we are

1.1 This policy explains how [Pruply Limited, company number] of 9 Glenpark Avenue, Westown, New Plymouth 4310 (Pruply, we, us) collects, uses, shares and protects personal information.

1.2 We follow the Privacy Act 2020 and its 13 information privacy principles.

1.3 Our Privacy Officer is Varnell Clay. You can contact them at hello@boldpopulation.com or 9 Glenpark Avenue, Westown, New Plymouth 4310.

2. Your money data stays on your device

2.1 In the pilot, the figures you type in, and any bank statement CSV file you download from your own internet banking and import, are processed and stored on your device only, in your browser storage.

2.2 Pruply does not receive, see or store your transactions or money figures. We do not ask for your bank login and there is no open banking connection in the pilot.

2.3 You can export or delete this data at any time from within the app. Clearing your browser data will also delete it. We cannot recover it for you. A backup file you save contains all your figures. Store it safely.

2.4 Please keep your device secure, because anyone who can use your browser may be able to see this data.

2.5 We plan to offer an optional open banking connection in a later version, through Akahu, an accredited New Zealand provider under the Customer and Product Data Act 2025. If we do, we will update this policy and ask for your separate consent before any bank data is accessed.

3. What we collect

3.1 Sign up details. Through our website form we collect:

(a) your name, email address, town or city, and trade;

(b) optionally, whether you identify as Māori. We ask because at least half of the pilot places are for wāhine Māori. You do not have to answer; and

(c) three optional money questions: whether you knew your profit last month, whether you have had a tax or GST surprise in the last 2 years, and how you decide what to pay yourself.

3.2 Other survey answers. Any other optional survey you choose to complete.

3.3 Weekly check ins. Whether the number was right, too high or too low, your comment, how many weeks you have used Pruply, and from week 4 two survey answers (how you would feel without Pruply, and what you would pay). In the website version these are emailed to us through FormSubmit with your first name, trade and the week. In the claude.ai version they are stored in that page's database with your trade, whether you are GST registered, and your platform account ID. Never your dollar figures.

3.4 Platform account and usage data. If you are invited into the pilot app through a third party platform account, the platform provider processes your account and usage data under its own privacy policy. We may see your platform account ID, name or email address linked to your check ins.

3.5 Payment details. If you pay a founding deposit or become a paying founding member, Stripe processes your payment. We receive your name, email, plan and payment status. We never see your full card details.

3.6 Messages. Anything you send us by email or message.

3.7 Website technical data. Our website host may process basic technical information, such as your IP address and browser type, to deliver and secure the website.

3.8 We do not ask for your IRD number, bank login, or health information. Please do not include your clients' personal details in feedback.

4. Why we collect it

4.1 We collect personal information only for purposes connected with running Pruply, namely to:

(a) run the pilot, give you access and contact you about it;

(b) understand whether Pruply's answers are right and useful, and improve the product;

(c) make sure at least half of the pilot places go to wāhine Māori, using the optional question in 3.1(b);

(d) manage founding deposits, refunds, memberships, payments and tax invoices;

(e) keep Pruply secure and meet our legal obligations; and

(f) send you news about Pruply, but only if you have opted in.

4.2 The Māori identity question, the money questions, survey answers and check ins are optional. If you do not give your sign up details, we cannot give you access to the pilot.

5. How we collect it

5.1 We collect most information directly from you. When we do, we will tell you what we are collecting and why, usually at the point of collection and through this policy.

5.2 Sometimes we collect information about you from another source, for example:

(a) from the platform provider that hosts the pilot app, such as the name or email address linked to your account and whether you have accepted an invitation;

(b) from Stripe, such as your payment status; or

(c) from someone who refers you to the pilot, such as your name and email address.

5.3 When we collect information about you from another source, we will tell you, as soon as reasonably practicable, that we have it, where it came from, why we have it, who will receive it, and your rights to access and correct it, as required by information privacy principle 3A. We may not need to tell you if an exception in the Privacy Act 2020 applies, for example if you already know, or it is information you made public yourself.

6. Who we share it with

6.1 We use these service providers:

(a) FormSubmit, which processes our website sign up form and emails the details to us;

(b) Netlify, which hosts our website;

(c) Anthropic, which runs claude.ai, the platform that hosts the pilot app as a published page. Our feedback records are stored there. Anthropic processes account and usage data under its own privacy policy;

(d) Stripe, which processes founding deposits, refunds and payments;

(e) Google, which hosts our email inbox; and

(f) Google Fonts, which delivers the typefaces on our pages and receives your IP address when a page loads.

6.2 We may also share information with our professional advisers under a duty of confidence, or where the law requires it.

6.3 We do not sell personal information. We do not share it with advertisers or data brokers.

7. Overseas storage and disclosure

7.1 Our service providers are based overseas. Your information may be stored or processed in the United States and other countries where those providers operate.

7.2 Where a provider only stores or processes information for us, we remain responsible for it. Where a provider uses information for its own purposes, or we otherwise disclose information overseas, we will only do so in line with information privacy principle 12. That means the recipient must be subject to privacy laws or contract terms that give comparable safeguards to New Zealand law, or we will tell you clearly that it may not, and ask for your authorisation.

7.3 By using the pilot app on a third party platform, you are choosing to use that platform, and its own privacy policy applies to your account with it.

8. How we protect it

8.1 We take reasonable steps to protect personal information from loss, misuse and unauthorised access. These include choosing reputable providers, limiting who can access information, using strong passwords and two factor sign in, and collecting as little as we can.

8.2 Your money data is never sent to us in the pilot, which keeps the most sensitive information in your hands.

9. Privacy breaches

9.1 If a privacy breach happens that we believe has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and the people affected as soon as practicable, as required by Part 6 of the Privacy Act 2020. We will also take steps to contain the breach and reduce the harm.

10. How long we keep it

10.1 We keep information only for as long as we need it for the purposes in this policy:

(a) sign up details and survey answers: until [24 months] after the pilot ends, or sooner if you ask us to delete them;

(b) pilot feedback and check ins: until [24 months] after the pilot ends. After that we delete them or keep only a summary that does not identify you;

(c) payment and invoice records: 7 years, as tax law requires; and

(d) emails with you: [24 months] after our last contact, unless we need them longer for a legal reason.

11. Your rights to access and correct

11.1 You can ask to see the personal information we hold about you, and ask us to correct it. You can also ask us to delete it.

11.2 Email hello@boldpopulation.com. We will respond within 20 working days, as the Privacy Act 2020 requires. We do not charge for access or correction requests.

11.3 If we decide not to correct information, you can ask us to attach a statement of the correction you asked for.

11.4 We take reasonable steps to make sure the information we use is accurate, up to date and not misleading.

12. How we use and disclose it

12.1 We use and disclose personal information only for the purposes we collected it for, or as the Privacy Act 2020 otherwise allows, for example with your agreement or where the law requires it.

12.2 We do not assign you a unique identifier used by any other organisation, such as your IRD number.

13. No AI training

13.1 Pruply does not use your personal information, your feedback or your money data to train AI models, and we do not give it to anyone else for that purpose.

13.2 We do not paste identifiable tester feedback into AI tools unless the tool is set not to train on it.

13.3 Your own use of a third party platform account is governed by that provider's privacy policy and your account settings, which you control.

14. Māori data

14.1 Pruply is designed with wāhine Māori first. We treat data about Māori users as a taonga, in line with the Te Mana Raraunga principles of Māori data sovereignty.

14.2 In practice this means:

(a) Rangatiratanga. You keep authority over your information. Your money data stays on your device in the pilot, and you can see, correct or delete what we hold.

(b) Whakapapa and whanaungatanga. We keep the context of where information came from, and recognise our obligations to the people and communities it relates to.

(c) Kotahitanga and manaakitanga. Information is used to benefit the people who shared it, and with respect for their dignity.

(d) Kaitiakitanga. We act as guardians of the information, not owners of it.

14.3 We will only publish findings about wāhine Māori testers as a group, never about individuals, and only from testers who opt in to this at a weekly check in. Until that opt in exists, we will not publish any such findings.

14.4 Before publishing any group findings, we will seek input from Māori governance on how they are presented.

15. Cookies, analytics and browser storage

15.1 The pilot app uses your browser storage to keep your money data on your device. This is how the app works. It is not used to track you. Our pages load typefaces from Google Fonts, which receives your IP address when a page loads.

15.2 We do not use analytics or tracking in the pilot. If we want to add analytics later, it will be opt in, and we will update this policy first.

16. Emails and messages

16.1 We send service emails about the pilot and your access. We only send marketing emails if you have agreed, and every one will have a working unsubscribe link. We do not send marketing texts in the pilot.

16.2 If Pruply later lets you send messages to your clients, we will update this policy, and you will need your clients' consent under the Unsolicited Electronic Messages Act 2007.

17. Age

17.1 Pruply is for people 18 or over who are in business. We do not knowingly collect information from anyone younger.

18. Concerns and complaints

18.1 If you have a concern about how we have handled your information, please contact our Privacy Officer at hello@boldpopulation.com. We will acknowledge it within [5 working days] and try to resolve it fairly.

18.2 If you are not satisfied, you can complain to the Office of the Privacy Commissioner at privacy.org.nz or by phoning 0800 803 909.

19. Changes to this policy

19.1 We may update this policy, for example before adding open banking, paid plans or new features. We will email pilot members about important changes before they take effect, and show the date of the latest version at the top.

[Pruply Limited, company number], 9 Glenpark Avenue, Westown, New Plymouth 4310. Privacy Officer: Varnell Clay, hello@boldpopulation.com.