Legal

Privacy Policy

Last updated: 29 May 2026

This Privacy Policy explains how EXACT IOT LIMITED ("we", "us", "our"), NZBN 9429046766427, a company registered in New Zealand and trading as BillRelay, collects, uses, stores, and protects personal information. It applies to our website at billrelay.co.nz and to the BillRelay service.

We are committed to handling personal information in accordance with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs).

1. Who this policy covers

• Website visitors and waitlist signups — people who browse billrelay.co.nz or join our launch waitlist.
• Customers and their users — businesses and accounting firms who use the BillRelay service, and the individuals they authorise to use it.

2. Information we collect

When you join the waitlist, we collect the email address you provide, and basic technical information about your request (such as your browser's user-agent string and the time of submission).

When you use the BillRelay service (once available to you as a customer), we collect:

• Account information — your name, email address, business name, and authentication details.
• Document and financial data — the invoices, receipts, and related files you upload or forward, and the data we extract from them (vendor details, amounts, GST treatment, line items, account codes).
• Integration data — information accessed through accounting integrations you connect (such as Xero contacts, chart of accounts, and tax rates), under the access you authorise.
• Billing information — handled by our payment processor (Stripe). We do not store full card numbers ourselves.
• Usage and technical data — log data, device and browser information, and how you interact with the service, used to operate and improve it.

3. How we use your information

We use personal information to:

• operate, maintain, and improve the BillRelay service;
• extract and structure invoice and receipt data and push it to your connected accounting platform;
• authenticate you and secure your account;
• process payments and manage subscriptions;
• contact you about the service, your account, and (for waitlist signups) our launch;
• meet legal and tax record-keeping obligations.

We collect personal information directly from you wherever practicable, and only what we reasonably need for these purposes, consistent with the IPPs.

4. We do not train AI models on your data

We do not use your documents to train AI models. If we ever offer this, it will be strictly opt-in and off by default. Data accessed through connected accounting platforms is never used for AI training.

5. Where your information is stored

The BillRelay service is hosted in Microsoft Azure, Australia East region. This means personal information may be stored and processed outside New Zealand, in Australia. We take reasonable steps to ensure any overseas storage provides comparable safeguards to those required under the New Zealand Privacy Act 2020. Waitlist email addresses collected via our website may be stored with our website infrastructure provider.

6. Who we share it with

We do not sell your personal information. We share it only with:

• Service providers (sub-processors) who help us run BillRelay — including Microsoft Azure (hosting and document processing), Stripe (payments), and our website and email infrastructure providers — under agreements that require them to protect it and use it only for providing services to us;
• Accounting platforms (such as Xero) that you connect and direct us to send data to;
• Authorities or third parties where required by law, or to protect our rights, users, or the public.

7. Security

We protect personal information with measures including encryption of data in transit and at rest, encrypted storage of credentials and tokens, access controls, and tenant isolation. No system is perfectly secure, but we work to protect your information and to limit access to those who need it.

8. Retention

• Waitlist emails are kept until launch and your onboarding, or until you ask us to remove you, whichever comes first.
• Invoice and tax records processed through the service are retained for at least 7 years to meet New Zealand Inland Revenue (IRD) record-keeping requirements, after which they may be deleted.
• Account information is retained while your account is active and for a reasonable period afterwards, subject to legal obligations.

9. Your rights

Under the Privacy Act 2020 you may:

• access the personal information we hold about you;
• request correction of information that is inaccurate;
• request deletion or withdrawal (for example, removal from the waitlist), subject to our legal retention obligations;
• export your data in a portable format.

To exercise any of these, contact The Privacy Officer at support@billrelay.co.nz. We will respond within the timeframes required by the Act.

10. Cookies and analytics

Our marketing website uses only essential functionality and, where enabled, privacy-friendly, cookieless analytics that do not track you across other sites. If we introduce cookies that are not strictly necessary, we will update this policy and seek consent where required.

11. Data breaches

If a privacy breach occurs that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required by the Privacy Act 2020.

12. Children

BillRelay is a business tool and is not directed at children. We do not knowingly collect personal information from children.

13. Changes to this policy

We may update this policy from time to time. The "last updated" date above shows when it last changed. Material changes will be communicated where appropriate.

14. Contact us

The Privacy Officer
EXACT IOT LIMITED (NZBN 9429046766427), trading as BillRelay
Email: support@billrelay.co.nz

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner (www.privacy.org.nz).

Back to home