Privacy

Last updated: 1 October 2026

This explains what Xuro collects, why, and what we do with it. Xuro is run by a sole trader in New Zealand, and we follow the Privacy Act 2020.

Who to contact

Our privacy officer is the person who runs Xuro. Email [email protected] about anything in this page.

What we collect

• When you request early access or email us: your name, email address and anything you tell us, like your company, role and the standard you work to.
• When you have an account: your email address, name, sign-in details and your settings.
• When you use Review: the TMP files you upload, the details Xuro reads from them, and the findings it produces.
• When you use the Designer: the plans you draw and save.
• Feedback: anything you tell us about a finding or a missed issue.
• Basic technical records: things like sign-in times and error logs, so we can keep Xuro running and fix problems.

Why we collect it

To give you access, run your reviews and plans, reply to you, fix problems and improve Xuro. We don't sell your information, and we don't use it for advertising.

Plans you upload can include other people's details

TMP packages often include names, phone numbers and signatures of people like STMSs and contractors. We handle those details only to run your review for you. If you upload a package, you're responsible for making sure the people named in it know their details may be shared with a tool like Xuro.

How reviews are processed

Review uses an AI model from a provider based overseas to read your uploaded files. We send the provider only what a review needs. Our provider's terms for paid use say it does not use this content to train its models, though it may keep it for a short time to check for misuse.

Xuro itself runs on a server in New Zealand. Traffic to it passes through a network service based overseas.

How long we keep things

• Uploaded PDFs are deleted 30 days after a review finishes. You can delete them sooner from Review history.
• Review results, plans and your account stay until you delete them or ask us to close your account.
• Early access requests are stored with our hosting provider, Cloudflare, on its global network, so they may be held outside New Zealand. Requests and emails are kept for 180 days, then deleted automatically.

Cookies

We use a cookie to keep you signed in. We don't use advertising or tracking cookies. If we add analytics later, we'll update this page first.

Keeping it safe

We take reasonable steps to protect your information, including limiting who can see it. No system is perfect. If a privacy breach is likely to cause serious harm, we'll tell you and the Privacy Commissioner as soon as we can.

Your rights

You can ask to see the information we hold about you, and ask us to correct it. Email [email protected]. We'll reply within 20 working days.

If you're not happy with how we've handled your information, tell us first. You can also complain to the Office of the Privacy Commissioner at privacy.org.nz.

Changes

If we change this page in a way that matters, we'll update the date at the top and let account holders know.