Privacy Policy

This Privacy Policy explains how Flipmind Limited (“Flipmind”, “we”, “us”), the provider of the EntryWatch visitor-management platform, collects, uses, discloses and protects personal information. We handle personal information in accordance with the Privacy Act 2020 and the Information Privacy Principles (IPPs).

1. Who this policy covers

EntryWatch is used by organisations (“Customers”) to manage arrivals at their sites. Personal information reaches us in two roles:

• As the Customer’s agent. Most visitor data — names, sign-in times, hosts, photos, inductions — is collected by a Customer through EntryWatch and held by us on that Customer’s behalf. The Customer decides how that information is used and is the point of contact for it. This policy governs our own handling; the Customer’s own privacy statement governs theirs.
• As a principal. When you deal with us directly — creating an account, contacting support, using our website — we collect information for our own purposes, as described below.

2. Information we collect

• Account & organisation data: name, work email, role, organisation name and settings of the people who administer EntryWatch.
• Visitor & host data (on a Customer’s behalf): visitor name, company, email/phone, host, visit times, vehicle details, badge data, and — where a Customer enables it — photos, signed agreements and induction responses.
• Technical data: device, browser, IP address, and usage logs needed to run, secure and improve the service.
• Support & communications: messages you send us and our replies.

We collect information directly from you where practicable (IPP 2), and only what we need for the purposes below (IPP 1).

3. How we use information

• To provide, operate, secure and support the EntryWatch service.
• To authenticate users and administer accounts.
• To send service, security and account communications.
• To improve reliability, performance and features.
• To meet legal obligations and enforce our terms.

4. Disclosure

We do not sell personal information. We disclose it only:

• to the Customer whose visitors or staff the information relates to;
• to the service providers listed below, under confidentiality obligations and only as needed for the purpose given;
• where required by law, or to protect rights, safety or property.

Providers that run the service:

• Cloudflare — hosting, database, file storage and network security for the website and app.
• Postmark — delivery of the emails the service sends.
• Stripe — subscription billing and payments.
• Google Maps Platform — address suggestions when someone searches for an address in the app.
• Anthropic — drafting in our internal sales tools, using information about businesses that have contacted us or that we contact.
• Integrations a Customer chooses to connect (for example Microsoft sign-in, Slack or WhatsApp notifications) receive what that integration needs, such as a notification’s text and recipient.

Analytics and advertising providers — subject to your choice (see Cookies):

• Google Analytics and Google Ads — how our website is used, and whether our advertising leads to sign-ups.
• Microsoft Clarity — page interaction and session recordings, on our marketing website only.
• PostHog — product analytics. Session recordings on our marketing website only; in the signed-in app, usage events linked to an internal account number, never your name or email, and never recorded.
• Apollo.io — identifying the businesses that visit our marketing website.

None of these analytics or advertising tools run on the pages visitors use — sign-in kiosks, check-in, pre-registration, visitor portals, invitations, event registration, host confirmations, badges and on-site screens — or on pages opened from a password-reset or sign-up link.

5. Storage and overseas hosting

EntryWatch runs on cloud infrastructure (including Cloudflare) and personal information may be stored or processed on servers located outside New Zealand. Where information is disclosed to an overseas provider, we take reasonable steps so it is protected by comparable safeguards, as required by IPP 12.

6. Retention

We keep personal information only for as long as needed for the purposes above or as required by law (IPP 9). Visitor data held on a Customer’s behalf is retained according to that Customer’s retention settings and instructions, after which it is deleted or de-identified.

7. Security

We use reasonable technical and organisational safeguards — encryption in transit, access controls and tenant isolation — to protect personal information against loss, misuse and unauthorised access (IPP 5). No system is perfectly secure, but we work to reduce risk and will notify affected parties and the Privacy Commissioner of any notifiable privacy breach as the Privacy Act 2020 requires.

8. Access and correction

You have the right to ask for access to, and correction of, personal information we hold about you (IPPs 6 and 7). If the information was collected by a Customer through EntryWatch, please contact that Customer directly, as they control it; we will assist them where needed. For information we hold as a principal, contact us using the details below.

9. Cookies

Our website and app use strictly necessary cookies to keep you signed in, to keep the service secure, to carry a password-reset or sign-up link through to its form, and to remember your cookie choice.

Our website also uses analytics and advertising cookies from the providers listed under Disclosure, to understand how the site is used and to measure our advertising. If you are in the European Union, the EEA, the United Kingdom or Switzerland, we ask the first time you visit and none of them load until you accept. Elsewhere they are on by default, and you can turn them off below — once off, none of them load and the cookies they set are removed. Your choice also applies when you use the signed-in app. They never run on kiosks, visitor sign-in pages or links sent to visitors.

Change your cookie choice

10. Children

EntryWatch is a workplace tool and is not directed at children. We do not knowingly collect information from children except where a Customer records a visitor who is a minor for their own site-safety purposes.

11. Changes

We may update this policy from time to time. The “Last updated” date shows when it last changed; material changes will be notified through the service.

12. Contact us

Questions, access or correction requests, or complaints about privacy:

Flipmind Limited
Email: privacy@entry.watch
Post: [Insert postal address]

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner (New Zealand) at privacy.org.nz.