Privacy

Last updated: 1 October 2026

This explains what Xuro collects, why, and what we do with it. Xuro is run by a sole trader in New Zealand, and we follow the Privacy Act 2020.

Who to contact

Our privacy officer is the person who runs Xuro. Email [email protected] about anything in this page.

What we collect

• When you request early access or email us: your name, email address and anything you tell us, like your company, role and the standard you work to.
• When you have an account: your email address, name, sign-in details and your settings.
• When you use the Review Engine: the TMP files you upload, the details Xuro reads from them, and the findings it produces. Here's what happens to them:

- Only you can see them. Your uploaded files, reviews and chats are tied to your account. Other users can't see them.

- Your original PDF is deleted automatically 30 days after its review finishes. We check for files due for deletion every 6 hours.

- You can delete it sooner. Delete the original PDF from Review history at any time.

- The findings stay. Each review's findings, and the details Xuro read from your files, stay in your Review history so you can come back to them. They aren't deleted automatically. Email us if you want them removed.

- Chats are yours to delete. You can delete any Xuro Assistant chat about a review.

- Read by an overseas service. Your files are read by an AI model run by a service provider outside New Zealand, through its paid service. On that paid service, the provider doesn't use your files to train its models.

• When you use the Designer: the plans you draw and save.
• Feedback: anything you tell us about a finding or a missed issue.
• Basic technical records: things like sign-in times and error logs, so we can keep Xuro running and fix problems.

Why we collect it

To give you access, run your reviews and plans, reply to you, fix problems and improve Xuro. We don't sell your information, and we don't use it for advertising.

Plans you upload can include other people's details

TMP packages often include names, phone numbers and signatures of people like STMSs and contractors. We handle those details only to run your review for you. If you upload a package, you're responsible for making sure the people named in it know their details may be shared with a tool like Xuro.

How reviews are processed

The Review Engine uses an AI model from a provider based overseas to read your uploaded files. We send the provider only what a review needs. Our provider's terms for paid use say it does not use this content to train its models, though it may keep it for a short time to check for misuse.

Xuro itself runs on a server in New Zealand. Traffic to it passes through a network service based overseas.

How long we keep things

• Uploaded PDFs are deleted 30 days after a review finishes. You can delete them sooner from Review history.
• Review findings, plans and your account stay until you ask us to remove them or close your account.
• Early access requests are stored with our hosting provider, Cloudflare, on its global network, so they may be held outside New Zealand. Requests and emails are kept for 180 days, then deleted automatically.

Cookies

We use a cookie to keep you signed in. We don't use advertising or tracking cookies. If we add analytics later, we'll update this page first.

Keeping it safe

We take reasonable steps to protect your information, including limiting who can see it. No system is perfect. If a privacy breach is likely to cause serious harm, we'll tell you and the Privacy Commissioner as soon as we can.

Your rights

You can ask to see the information we hold about you, and ask us to correct it. Email [email protected]. We'll reply within 20 working days.

If you're not happy with how we've handled your information, tell us first. You can also complain to the Office of the Privacy Commissioner at privacy.org.nz.

Changes

If we change this page in a way that matters, we'll update the date at the top and let account holders know.