PenguinPilot — Privacy Policy

The Network Software Ltd, trading as PenguinPilot Version 2.0 Effective Date: 15 September 2026 Contact: hello@penguinpilot.ai

The Network Software Ltd, trading as PenguinPilot ("PenguinPilot", "we", "us", "our") handles personal information transparently, lawfully and securely.

1. About this policy

This policy explains what personal information we collect, how we use it, who we share it with, and what rights you have. It is based on the New Zealand Privacy Act 2020. Other laws may also apply depending on where you are, including the Australian Privacy Act 1988. If you are outside New Zealand and want to know how those apply to you, contact us. It does not cover third-party websites or services with their own policies, or how our customers handle information outside our systems.

2. Our role, and our customers' role

We provide software. What information goes into it, and what is done with that information, is decided by our customers.

Where we are responsible. We collect and use information about our own customers — to open and run their accounts, take payment, provide support, keep our records, secure the platform and meet our legal obligations.

Where our customers are responsible. Our customers — including resellers, agencies and businesses using our tools — collect and hold information about their own clients, leads, prospects and website visitors. They decide what to collect, why, and what to do with it. They are responsible for having a lawful basis to collect and use it, and for complying with privacy, marketing and anti-spam law in their market. We hold that information so their account works, and we act on their instructions in relation to it.

Our terms require every customer to confirm they have the necessary rights and permissions before using our tools. We do not verify that, and we do not decide who they contact or what they say.

Resellers and their clients. If you are a client of a reseller, your website and account data sit on our infrastructure, even though your relationship is with them. Your reseller can access and edit your site in order to serve you, and publishes their own privacy policy to you. If you cannot get a privacy request actioned by your reseller, contact us.

3. What we collect

About our customers

Name, email, phone, business name, address and job title
Account and login identifiers, including from Google sign-in
Billing and payment records, subscription status and credit balances
Support history, communications, feedback and approvals
Reseller details: branding, pricing, connected-account reference and verification status
Domain registrant details, where a domain is bought through us
Access tokens for social media accounts a customer connects

We do not store full card details — Stripe handles those. We do not hold credentials for anyone's email or messaging accounts.

Automatically, when our services are used

IP address, browser, device, operating system, pages visited and session data
Diagnostics, performance data and cookie data

Customer content

Information our customers put into, or generate through, the platform. This includes their website content and images, their client and contact records, enquiry-form submissions from their website visitors, and content retrieved from publicly accessible web pages at a customer's request. This content may contain personal information. It belongs to the customer's business, not to us.

4. How we use it

To provide, host and support our services
To open, run and secure accounts, and verify identity where required
To take payment, meter usage and manage subscriptions
To provide support and communicate about accounts and services
To improve our products, tools and cost estimates
To market our own services, where the law allows and with an unsubscribe option
To keep suppression records, so anyone who asks not to be contacted stays that way across our platform
To detect fraud and abuse, investigate complaints, and keep security and audit logs
To meet legal, tax and accounting obligations, and to resolve disputes

We may also use aggregated or de-identified data for analytics and product development, where it does not identify anyone.

We do not sell personal information.

5. Cookies

We use cookies and similar technologies to keep you signed in, secure sessions, measure traffic and performance, and support marketing attribution. Where the law requires it, we provide consent or opt-out controls.

6. Who we share it with

We share personal information with the providers who help us deliver our services:

Supabase / Lovable Cloud — database, authentication and file storage
Cloudflare — hosting, routing and custom domains
Stripe, including Connect — payments and reseller payouts
Resend — transactional and notification email
Google (Places, OAuth, reCAPTCHA) — business lookup, sign-in and bot protection
Firecrawl — retrieving publicly accessible web pages
Lovable AI Gateway (Gemini-class models) — generating and editing content and images
Pexels — stock imagery
Name.com — domain registration and renewal
Entri — guided DNS setup
Zernio — social account connection and publishing
Advertising and marketing platforms (e.g. Facebook, Instagram, TikTok, LinkedIn) — running campaigns for clients

We may also disclose information where the law requires it, to respond to a complaint or a regulator, to enforce our terms, or in connection with a sale of our business.

Domain registrant details are sent to our registrar and may appear in public WHOIS and registry systems. We do not control that and cannot recall it.

7. Artificial intelligence

We use third-party AI providers to generate and edit content, images and drafts. Customer content and prompts are sent to those providers for that purpose.

AI output can be wrong. It may be inaccurate, outdated or invented. Our customers are responsible for reviewing anything generated before they publish or send it.

We do not use AI to make automated decisions with legal or similarly significant effects on people. We do not provide customer content to AI providers to train their general models.

8. Security

We take reasonable, industry-standard steps to protect personal information — encryption in transit, access controls that scope records to their owner, private storage, authentication protections, monitoring and logging, and staff confidentiality obligations.

Published website content is publicly readable by design while a site is live. No system is completely secure, but we respond to incidents, including notifying affected people and the Privacy Commissioner where a breach is notifiable.

9. How long we keep it

We keep personal information only as long as we reasonably need it.

Account and site data after cancellation: 30 days, then permanent deletion
Suppression records: indefinitely, so we can keep honouring them
Billing, tax and usage records: 7 years
Everything else: as long as needed for the purpose, or as the law requires

Domain registration data stays in registrar and registry systems beyond our control.

10. Sending information overseas

We are based in New Zealand. The providers listed above operate in the United States and elsewhere, so your information will be stored and processed outside New Zealand.

When we transfer information overseas we take reasonable steps to ensure comparable safeguards apply, in line with Information Privacy Principle 12.

11. Your rights

You can ask for a copy of the information we hold about you, ask us to correct it, and ask us to delete it. Contact hello@penguinpilot.ai. We may need to verify your identity first.

If your business has been contacted by someone using our platform, or a website has been generated from your public website, and you want it stopped: email hello@penguinpilot.ai. We will add your details to our suppression list so no customer of ours can contact them again, and remove any website generated from your site. You do not need to give a reason, and there is no charge.

Where a request concerns information controlled by one of our customers or resellers, we may direct you to them or coordinate with them.

12. Children

Our services are not directed to children and we do not knowingly collect their information.

13. Changes

We may update this policy. If we make material changes we will update the version and effective date above, post the new version, and give notice where appropriate.

14. Contact us

The Network Software Ltd, trading as PenguinPilot. Privacy enquiries: hello@penguinpilot.ai

15. Complaints

Please contact us first so we can try to resolve your concern. If that doesn't work, you can complain to the New Zealand Office of the Privacy Commissioner (privacy.org.nz), or another relevant regulator such as the Office of the Australian Information Commissioner. Complaints about unsolicited commercial messages can be made to the Department of Internal Affairs in New Zealand, or the Australian Communications and Media Authority in Australia.