Privacy statement

Bucket Flows Limited (“Bucket Flows”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal information we collect.

This Privacy Statement explains what information we collect when you use Bucket Flows, why we collect it, how we use and protect it, and the rights you have in relation to your personal information.

Bucket Flows Limited is a New Zealand company and handles personal information in accordance with the Privacy Act 2020.

1. Information we collect

The information we collect depends on how you use Bucket Flows.

Account information

When you create an account, we collect information such as:

your first name;
your last name;
your email address;
your account identifier; and
information required to authenticate and manage your account.

Your password is stored using appropriate security measures and is not available to us in plain text.

Subscription and billing information

If you purchase a subscription, we collect information relating to your subscription, such as:

your subscription status;
your selected subscription or plan;
payment and renewal status; and
transaction-related information required to administer your subscription.

Payment card information is handled by our payment processing provider, currently Stripe. Bucket Flows does not directly store your full payment card details.

Content you create

When you use Bucket Flows, we store the information you enter into the Service.

This may include:

projects;
user flows;
actions;
outcomes;
personas;
names and descriptions;
references and links; and
other information you choose to add to your projects.

You control the content you choose to enter into Bucket Flows.

You should avoid entering personal or sensitive information about another person unless you have an appropriate reason and authority to do so.

Technical and security information

When you access Bucket Flows, we may collect limited technical information necessary to operate and secure the Service, such as:

IP address;
browser or device information;
login and session information;
timestamps; and
application and server logs.

This information may be used to maintain the Service, diagnose technical issues, prevent misuse and investigate security incidents.

2. Why we collect your information

We collect and use personal information where reasonably necessary to:

create and manage your Bucket Flows account;
authenticate you when you sign in;
provide the Bucket Flows Service;
maintain your projects and content;
administer subscriptions and payments;
provide customer support;
communicate important information about your account or the Service;
maintain, troubleshoot and improve the Service;
monitor and protect the security and integrity of Bucket Flows;
prevent fraud, misuse or unauthorised access; and
meet our legal and regulatory obligations.

If you do not provide information required to create or operate an account, we may not be able to provide the relevant parts of the Service to you.

3. How we use your project data

The content you create in Bucket Flows remains your content.

We use and process project content only as reasonably necessary to operate, support, maintain and secure the Service.

We do not claim ownership of the user flows, project information or other content you create simply because it is stored in Bucket Flows.

4. Who we share information with

We do not sell your personal information.

We may provide information to service providers where this is reasonably necessary for them to provide services to Bucket Flows.

These may include providers of:

application and database hosting;
cloud infrastructure;
payment processing;
email and communications;
security and monitoring; and
technical support services.

These providers receive only the information reasonably required to perform the relevant service.

We may also disclose information where:

you have authorised us to do so;
disclosure is necessary to protect Bucket Flows, our users or others;
we are required or permitted to disclose it by law; or
it is required as part of a business restructuring, merger, acquisition or sale, subject to appropriate protection of the information.

5. Information processed outside New Zealand

Some of the service providers we use may store or process information outside New Zealand.

Where personal information is transferred or disclosed outside New Zealand, we will take reasonable steps to ensure it is handled in a manner consistent with applicable New Zealand privacy requirements.

6. Cookies and sessions

Bucket Flows uses cookies or similar technologies where necessary to operate the Service.

For example, we may use cookies to:

maintain your authenticated session;
keep you securely logged in;
support application functionality; and
protect the security of the Service.

Where we introduce additional analytics, advertising or other non-essential tracking technologies, we may update this Privacy Statement and provide any additional notices or choices required by law.

7. How long we keep your information

We keep personal information only for as long as it is reasonably required for the purposes for which it was collected, or where we are required to retain it for legal, accounting, security or other legitimate purposes.

Cancelled subscriptions

If you cancel a paid subscription, your subscription remains active until the end of the subscription period you have already paid for.

The retention period for your Bucket Flows account and project data begins when that subscription expires, not when you request cancellation.

After expiry, we retain your account and associated Bucket Flows data for three months.

If you log in after your subscription has expired, Bucket Flows will notify you of the date on which your retained data is scheduled to be deleted.

For example, if:

you cancel your subscription on 1 July; and
your paid subscription expires on 10 July;
your data will be retained until 10 October.

Following the end of the three-month retention period, your account data and project content may be permanently deleted from the active Service and may no longer be recoverable.

Certain limited records may be retained for longer where required for legal, tax, accounting, security, fraud-prevention or other legitimate purposes.

8. Security

We use reasonable technical and organisational safeguards designed to protect personal information against:

unauthorised access;
loss;
misuse;
alteration; and
unauthorised disclosure.

No online service can guarantee absolute security, but we take reasonable steps to protect the information entrusted to us.

If we become aware of a privacy breach that meets the notification requirements of the Privacy Act 2020, we will notify the appropriate parties as required by law.

9. Accessing or correcting your information

You have the right to ask us whether we hold personal information about you.

You may also ask:

to access personal information we hold about you; or
for personal information that is inaccurate or incomplete to be corrected.

Some account information may be able to be updated directly through Bucket Flows.

For other access or correction requests, contact us using the details below.

We may need to verify your identity before providing access to personal information.

10. Deleting your information

You may contact us if you wish to request deletion of personal information associated with your account.

Some information may need to be retained where we have a legal or legitimate reason to retain it.

Cancellation of a subscription is subject to the three-month post-expiry retention period described above.

11. Privacy breaches

If you believe your personal information has been accessed, used or disclosed improperly, please contact us as soon as possible so that we can investigate.

You also have the right to raise a privacy concern with the Office of the Privacy Commissioner of New Zealand.

12. Changes to this Privacy Statement

We may update this Privacy Statement as Bucket Flows develops or our privacy practices change.

If we make a material change to the way we collect, use or disclose personal information, we will take reasonable steps to notify affected users.

The latest version will always be available through the Bucket Flows website or Help Centre.

13. Contact us

For privacy enquiries, access or correction requests, or concerns about how your information is handled, please contact:

Privacy Officer
Bucket Flows Limited
New Zealand
Email: [email protected]