Haviq

1. About this policy

Compass Technologies Limited ("Compass", "we", "us" or "our") provides the Haviq app and its supporting website and services. This policy sets out how we collect, use, protect, disclose and retain personal information, and how you can contact the Haviq support team about your information.

It applies to account holders and to people whose information is entered by an organiser, household coordinator or participant, including people without a Haviq account. Compass is the agency responsible for information it holds for these services, including information processed solely on its behalf by service providers.

You must be at least 18 years old to create, hold or use a Haviq account. By creating an account or signing in, you confirm that you meet this requirement. Children may be represented only in household records managed by an authorised adult.

Compass is based in New Zealand. Haviq is launching initially in New Zealand and may be offered in other countries in future. Availability may vary by country and platform. This policy applies wherever we offer Haviq.

We handle personal information in accordance with New Zealand's Privacy Act 2020 and any other privacy or data-protection laws that apply to our handling of your information. Any additional mandatory rights and protections under applicable local law remain unaffected.

Acknowledging this policy records that you have read it. It is not blanket consent to unrelated processing or a waiver of your rights. Where separate consent is required, we obtain it for the relevant activity.

2. Information we collect and why

We collect personal information to provide and secure Haviq, support private-event coordination, respond to enquiries and carry out reasonable internal analysis to maintain and improve the service, as described below.

A phone number and required account details are necessary for phone sign-in. Optional profile fields, recovery email and device permissions are voluntary; declining them may limit the related feature. Phone-code verification authenticates access to a phone number and does not replace your obligation to meet the 18-or-older account requirement.

An optional recovery email is attached privately to your existing account and must be confirmed before we rely on it for account assistance. Phone-code verification remains the normal sign-in method. The Haviq support team applies proportionate ownership checks before assisting with account access, transfer or deletion.

3. Device permissions, images and local storage

Contacts

With your permission, Haviq reads contacts on your device so you can select invitees or a household coordinator. The contact list is loaded locally for selection; selected names and numbers are used for the relevant action. We do not upload the whole address book for these flows. You can enter details manually without granting contacts access.

Images and location information

Camera and photo-library permissions support images you choose to upload. Uploaded images can contain embedded metadata or visible personal information. Only upload material you have the necessary rights and authority to share. Do not disclose identifying images of children, private addresses or receipt details beyond people authorised to receive them.

We collect event locations, addresses and pickup instructions that you enter. Haviq does not require continuous or background location tracking for these coordination features. Opening an external map or navigation service sends the relevant details to that service, which processes them under its own practices.

Device storage and notifications

Haviq stores session information, preferences, device identifiers and cached or temporary records locally. Exports may create temporary files and, when saved or shared, separate copies. Account deletion or sign-out does not automatically erase previously saved or shared copies.

You control device permissions and notification-preview settings. Push notifications can display event-related content on a lock screen. Disabling notifications does not delete records already held for account, event or service purposes.

4. How we use information

We use personal information to:

• authenticate and secure accounts, confirm recovery email addresses and provide verified account assistance;
• create and manage events, invitations, participation and adult-managed households;
• deliver the planning, communication, menu, carpool and accounting features you use;
• process Premium entitlements and relevant purchase, restoration and refund enquiries;
• send relevant invitations, reminders, service/security messages and push notifications;
• respond to support, privacy and content concerns, investigate misuse or security incidents and maintain the service;
• carry out reasonable internal analytics to understand how Haviq is used, identify faults, assess reliability and improve its features and usability;
• preserve justified shared records, resolve disputes and meet legal obligations.

We take reasonable steps to ensure information is accurate, current, complete, relevant and not misleading before using or disclosing it. Users must check information they provide and correct errors they become aware of.

We do not sell personal information, supply it to advertising networks for behavioural advertising or use it for promotional marketing. Our communications concern your account, events, security, support or Beta participation you have requested. Any future introduction of promotional marketing will be notified separately and will comply with applicable consent and unsubscribe requirements.

5. Information about other people and children

Haviq accounts are for people aged 18 or older. Children are represented only through household records managed by an authorised adult; they cannot hold independent Haviq accounts. If we reasonably determine that an account holder is under 18, we may restrict or suspend access and terminate the account under the Terms of Use. Personal information associated with that account is handled under the retention and deletion rules in section 10 and applicable law.

We use household and child-related information for authorised household coordination, attendance and relevant event/expense features. We do not provide a public directory of household people or permit their information to be used for unrelated marketing or profiling.

Account holders who enter another person's information must:

• have appropriate authority and any consent required by law;
• provide only relevant information needed for the event or household purpose;
• explain the relevant collection, use and sharing to the person in an appropriate way;
• have appropriate parent/guardian authority when entering a child's information;
• protect that information and correct or remove inaccurate or unnecessary entries.

When we collect personal information about you from another person, we take reasonable steps to notify you of the collection, its purposes, intended recipients, the agency collecting and holding it, and your access and correction rights, as required by New Zealand's Privacy Act 2020 and any other applicable privacy law, unless a lawful exception applies. An account holder's authority or consent does not remove Compass's own obligations.

You may ask the organiser or household coordinator to correct or remove your details, or contact the Haviq support team directly. You do not need a Haviq account to request removal of your personal information. We assess removal requests under applicable law, including any lawful need to retain shared records, and explain the outcome subject to lawful disclosure limits.

6. Sharing within Haviq and responsibility for copies

Participants, organisers and coordinators

Access depends on membership, attendance, role and the feature concerned. Your name, relevant contributions, participation, messages and information needed for a feature are shared with people authorised to use that feature. Relevant allergen warnings can identify the person concerned.

Ordinary guest lists show aggregate child counts rather than children's real names, and relevant ordinary expense displays use event-specific child aliases. Organisers' authorised accounting records and private exports can include child names. Those records remain personal information.

Organisers, coordinators and other recipients must keep personal information confidential, restrict access to people entitled to receive it, protect saved/exported copies and use it only for authorised event/accounting purposes or another lawful purpose. They must not publish, forward or reuse children's names or other private information without appropriate authority and a lawful basis. Copies must not be retained longer than needed for a lawful purpose.

Expenses, receipts and exports

Permitted members can see shared allocations, published payment obligations and aggregate payment progress. Individual payer reports and recipient-confirmation histories are restricted to the involved payment parties in ordinary participant views. An organiser's complete accounting audit export can include additional histories, expense attachments and personal or financial details.

Compass does not control a recipient's independent storage, disclosure or misuse of exported or separately copied information. To the extent permitted by law, Compass is not responsible for recipients' independent acts or omissions that are not caused or contributed to by Compass's breach of its obligations. This does not exclude Compass's own legal responsibilities or any non-excludable right or remedy.

A private event is not a guarantee that another authorised participant cannot copy or disclose its content. Report inappropriate disclosure to the Haviq support team.

Operational access

Access by Compass personnel and providers is limited to what is reasonably needed to operate, secure and support Haviq, address a complaint or concern, or comply with law. We may review relevant content for those purposes. This is not a guarantee that every message or image is screened or that all harmful content will be detected.

7. Service providers, push notifications and purchases

We use the following providers for the functions described. The providers involved depend on your platform, app version and the features you use. Purchase and push-notification processing applies where those features are offered. Providers receive relevant information for their service, not every Haviq record.

Premium is a one-time unlock for an individual event, not a subscription or a payment between participants. Purchase availability depends on your platform, country and app version and is shown in the App. For a store purchase, Apple or Google processes the payment under its applicable terms. Compass does not receive your full payment-card credentials from the store and does not hold or transfer participants' expense funds. Complimentary Premium grants are separate from paid purchases.

Participants arrange actual expense payments outside Haviq. A payment report or receipt confirmation is a participant's declaration, not independent bank verification or a guarantee of reimbursement.

External map, messaging, sharing and other services you choose have their own information-handling practices. Their role does not remove Compass's obligations for information it controls or for providers acting solely on its behalf.

8. Other disclosures

We disclose information where you authorise it or where disclosure is otherwise permitted or required by law. This includes appropriately assessed legal requests, proceedings, serious safety/security threats and investigations of unlawful conduct. We assess the legal basis and limit disclosure to what is appropriate; a request does not automatically entitle the requester to all records.

For a genuine sale, merger or transfer of the service, information may be disclosed where lawful and reasonably necessary, subject to appropriate confidentiality and safeguards. Existing privacy obligations continue to apply, and we give any notice required for material changes to information handling.

9. Overseas processing

Our providers process information outside New Zealand. Supabase's project region is Mumbai, India. Resend dispatches the configured security emails from Tokyo, Japan, but stores account data including email metadata, logs and API records in the United States. Other providers and subprocessors may process information in other countries for hosting, delivery, support, security and operational purposes.

These service locations do not mean that all associated logs, backups or support operations remain in the same country. Compass remains responsible for personal information processed solely on its behalf by service providers. Where an overseas disclosure is subject to Information Privacy Principle 12 of New Zealand's Privacy Act 2020, we meet its requirements, including comparable privacy safeguards or another permitted basis for disclosure. We also comply with any additional cross-border transfer requirements under other applicable privacy laws. Where specific informed authorisation is required, we obtain it separately.

10. Retention, archiving and deletion

Retention policy

We retain personal information only for as long as reasonably required for a purpose for which it may lawfully be used. Relevant purposes include operating accounts/events, providing authorised event history, explaining shared allocations and payment records, resolving disputes, security and legal recordkeeping. When information is no longer required for a lawful purpose, we delete it or make it non-identifying, subject to applicable legal requirements.

Archived events remain available to authorised participants as retained event records. Archiving is not deletion and does not settle outstanding amounts. We do not automatically delete event history each year or guarantee permanent storage. Continued retention depends on a lawful purpose, and you can ask the Haviq support team to review it.

Withdrawn invitations

When an invitation is revoked without having been accepted or linked to RSVP/attendance history, we remove its invitation-only name/phone details, minimise related invitation/reminder payloads, remove linked invitation notifications and cancel unfinished related delivery work. Minimal linkage and withdrawal records may remain. Accepted participation and justified shared history are retained under the principles above.

Withdrawal does not recall messages already shared, notifications already delivered or separate provider records. A delivery already underway may complete despite withdrawal.

Account deletion and shared records

Account deletion removes sign-in access and initiates deletion of private account information. Names and relevant shared event/accounting records remain where reasonably needed for understandable history, other participants' legitimate records, disputes or legal obligations. Retained names and identifiers are still personal information.

Deleting an account does not forgive amounts owed, undo confirmed payments or erase another participant's saved/exported copies. If a deleting organiser leaves unfinished settlement, the event may remain unarchived with invitations disabled so remaining authorised participants can access relevant records. No replacement organiser is automatically appointed. A newly registered account does not automatically inherit former memberships or organiser access.

Eligible unshared files are removed through a separate storage-cleanup process. Files still needed for authorised shared records may remain. Database and file cleanup can complete at different times.

Provider records and requests

Separate verification, security, delivery, backup or compliance records may remain with providers for their applicable operational or legal retention periods. Deletion from live app records does not automatically erase every provider record or copy already delivered to a device. We remain responsible for meeting our obligations for information under our control.

You can request account deletion in the app, or contact the Haviq support team using the contact form or privacy email, including when you cannot sign in. We apply proportionate identity/authority checks, consider justified retention and other people's rights, and explain any relevant limits on the request as required by law.

11. Security and Inbox messages

We protect data in transit using HTTPS/TLS and apply authentication and backend access permissions. Hosted Supabase data uses provider-managed encryption at rest. These measures do not make Inbox messages end-to-end encrypted.

Inbox messages are not end-to-end encrypted. Message content is processed and stored on Haviq's backend so it can be delivered and shown to authorised participants. Authorised Compass/provider access is possible for the operational, support, security and legal purposes described in this policy. Do not use Inbox to send passwords, authentication codes, payment-card credentials or other information requiring an end-to-end encrypted channel.

You are responsible for protecting your device, SMS codes, inbox and verification links and for promptly reporting suspected unauthorised access. Signing in elsewhere or verifying an email does not remotely erase existing device copies or guarantee instant termination of every previous session.

If a privacy breach has caused or is likely to cause serious harm, we notify the New Zealand Privacy Commissioner and affected people as soon as practicable as required by New Zealand's Privacy Act 2020, subject to lawful exceptions or permitted delays. We also meet any additional notification obligations under other applicable privacy laws. No system is guaranteed completely secure; this does not exclude our legal responsibility for its security.

12. Access, correction and complaints

You can ask whether we hold personal information about you and request access or correction under New Zealand's Privacy Act 2020 and any other applicable privacy law. This includes information supplied about you by someone else. We may verify identity or a representative's authority using proportionate checks.

We respond within the time required by applicable law. For requests under New Zealand's Privacy Act 2020, we make and communicate our decision as soon as reasonably practicable and no later than 20 working days after receiving the request, unless a lawful transfer or extension applies. We explain any extension or refusal as required by law. Access can be limited on lawful grounds, including another person's privacy. If a requested correction is not made, you may ask for a statement of the correction sought to be attached as provided by law.

You can also request a review of unnecessary retention, inappropriate collection/sharing or deletion. Rights are subject to applicable law; a request does not automatically require all shared records to be erased. Any additional mandatory rights that apply in your circumstances remain available.

Contact the Haviq support team through the contact form or support@haviqapp.com. Please identify your message as a privacy request so we can route it appropriately. You may complain to us or directly to the New Zealand Office of the Privacy Commissioner, or to another privacy regulator where applicable law gives you that right. You do not need a Haviq account to request removal of your personal information or raise a privacy concern.

13. Analytics, local identifiers and communications

We carry out reasonable internal analytics using relevant service records to understand feature use, identify errors, assess performance and improve Haviq. We limit the personal information used to what is reasonably necessary for those purposes and use aggregated or de-identified information where practicable. Records linked to an account or device remain personal information and are protected under this policy. Internal analytics does not authorise unrelated use of private message content or children's information.

We use session/device identifiers and technical, authentication and delivery records to operate, secure and support Haviq. Our internal analysis does not depend on an advertising network. We do not use PostHog, Firebase Analytics or Crashlytics. Push delivery uses Firebase Cloud Messaging and, for supported iOS app versions, APNs. Website, form and hosting providers may also use technical storage and request logs to provide and secure their services.

We do not track opens or clicks in our Resend security emails. Account, security and event communications are service messages, not promotional marketing.

We notify you of material changes to these practices and obtain any consent required by applicable law before introducing processing that requires it.

14. User responsibility, liability and indemnity

Users must provide lawful, accurate information; have the necessary rights, authority and permissions to submit others' information or images; protect account credentials; and safeguard records received through Haviq. They must not misuse personal information, publish private household/child details without authority, or use exports for an unlawful or unrelated purpose.

Our Terms of Use govern service responsibilities, liability and indemnity. To the extent permitted by law, their limited indemnity applies to third-party claims to the extent caused by a user's unlawful conduct, infringement of another person's rights, or deliberate or reckless breach of the Terms. It excludes loss to the extent caused by Compass's negligence, unlawful conduct or breach and includes the Terms' notice, mitigation and settlement protections. This policy does not create a broader indemnity.

Nothing in this policy excludes Compass's own privacy obligations or any rights or remedies that cannot lawfully be excluded, including protections under New Zealand's Consumer Guarantees Act 1993 and Fair Trading Act 1986 where applicable, and mandatory protections under other applicable local laws. Liability for independent recipient conduct is addressed in section 6 subject to those protections.

15. Policy changes

We publish the version and effective date of this policy. From Haviq's launch, superseded versions that have taken effect for users remain available in the website's legal archive. Material changes are notified through an appropriate in-app/website notice or other suitable communication. The app asks you to review and acknowledge a newly published policy version; separate consent is obtained where the law requires it.

An acknowledgement is not a waiver of rights or blanket consent. Support, sign-out and account-deletion requests remain available without forcing acceptance of new contractual terms.

16. Haviq support and privacy officer

The Haviq support team handles privacy enquiries on behalf of Compass. Address privacy requests to the Privacy Officer, Compass Technologies Limited.

Preferred contact: Website contact form
Privacy email: support@haviqapp.com

Compass Technologies Limited
PO Box 502
Waikato Mail Centre
Hamilton 3240
New Zealand

Provide enough information to identify your concern safely. Do not include passwords, SMS codes or live verification links.