Summary
- We sell business software. This policy explains how AnySoft handles personal information on our Website and in our Services.
- For our own records (Website, accounts, billing, support and marketing), AnySoft decides how personal information is used. For Customer Data (documents printed or scanned, files opened through AnyDrive, and details of our customers' users), we act only on our Customer's instructions.
- We do not sell personal information. We do not use it for advertising across other websites, and we do not use Customer Data to train AI models.
- Our Website has no analytics, advertising or social media trackers. It stores a few display preferences in your browser and loads nothing from third parties.
- Scans sent through AnyScan pass through our systems so we can deliver them. AnyPrint documents pass through our systems only when a job is held for secure release, its printer is offline, or it is routed through the cloud to a printer on another network. Other print jobs go straight from the computer to the printer, and we receive only the job details.
- You can ask to access or correct your personal information, and you can complain to us or to your local regulator. Contact our Privacy Officer at [email protected].
- Your rights under the privacy and consumer laws of your country always apply, and nothing in this policy limits them.
Who we are and how to contact us
AnySoft Limited (trading as AnySoft) is a company registered in New Zealand, company number 8645107, NZBN 9429051190811. Our registered office is at 241, 46 Tamahere Drive, RD 3, Hamilton 3283, New Zealand. In this policy, “AnySoft”, “we”, “us” and “our” mean AnySoft Limited.
- Email: [email protected] (privacy) or [email protected] (general support)
- Phone: +64 9 886 5969
- Post: AnySoft Limited, 241, 46 Tamahere Drive, RD 3, Hamilton 3283, New Zealand
- Website: www.anysoft.me
Privacy Officer
Our Privacy Officer is responsible for our compliance with privacy law, including under section 201 of the New Zealand Privacy Act 2020. You can contact the Privacy Officer at [email protected], by phone on +64 9 886 5969, or by post to the Privacy Officer, AnySoft Limited, 241, 46 Tamahere Drive, RD 3, Hamilton 3283, New Zealand.
Grievance Officer and contact person for India
Our Grievance Officer for India is Abdul Nawab. The Grievance Officer is also our contact person for questions about how we process the personal data of individuals in India. Contact the Grievance Officer at [email protected] with “India Grievance” in the subject line, by phone on +64 9 886 5969 (New Zealand business hours), or by post to the address above.
Who this policy covers and our two roles
This policy applies to personal information about:
- visitors to our Website, including all regional storefronts (the Website);
- people who sign up for, administer, pay for or are billing contacts for an AnySoft account;
- people who use AnyPrint, AnyScan or AnyDrive through an organisation that subscribes to them (Authorised Users);
- staff of managed service providers in our partner program (Partners); and
- anyone who contacts us by email or phone, or books a demo.
In this policy, the Services means AnyPrint, AnyScan and AnyDrive, the portals at portal.anysoft.me and admin.anysoft.me, and our Windows and macOS agent software (the Agent). A Customer is the business or organisation that subscribes to the Services, directly or through a Partner.
When AnySoft decides how information is used
AnySoft is responsible for personal information that we collect for our own purposes: Website data, account and sign-up details, billing records, support records, Partner records and marketing contacts. Privacy laws use different names for this role, such as controller or Data Fiduciary. The Regional rights section gives the term used in each country.
When AnySoft acts for its Customers
Customer Data means information that a Customer or its Authorised Users put into the Services, or that the Services create for the Customer. It includes print jobs and their details, scanned documents and their details, files and folders accessed through AnyDrive, user details and device data from the Agent.
We process Customer Data only to provide, secure and support the Services, on the Customer's instructions and under our Terms of Service and any data processing addendum we have agreed with the Customer. In privacy law terms, the Customer is in charge of Customer Data and we act as its service provider (for New Zealand, as its agent under section 11 of the Privacy Act 2020).
Your organisation's own privacy notice governs how it uses Customer Data about you. If you are an Authorised User and have a question or request about Customer Data, please contact your organisation first. If you contact us, we will pass your request to your organisation and help it respond.
Partners
A Partner may manage the Services for several Customers through our online partner portal (the Partner Centre), including creating Customer accounts and allocating licences. In the Partner Centre, a Partner sees account-level information about the Customers it manages, such as the Customer's name and country, licence and seat usage, user counts and account activity. The Partner Centre does not show a Partner a Customer's print jobs, scanned documents, files or other Customer Data. A Partner can see that data only through a user account in the Customer's account, such as the administrator account the Partner set up or an account the Customer gives it. Each Partner is responsible for its own handling of that information and for passing on the notices its Customers need to give.
This policy does not cover websites and services run by others, such as Microsoft, Google, Calendly or LinkedIn, even where we link to them. It also does not cover AnySoft's own staff and job applicants, who receive a separate notice.
Information we collect
Website visitors
- Server logs. Our website hosting provider receives standard request information when you load a page: IP address, browser and device type, the page requested, the referring page and the time.
- Preferences. Your theme and region choices are stored in your own browser (see Cookies and browser storage). Our region suggestion reads your browser's language settings on your device only. We do not look up your location from your IP address.
- “Start for free” email. When you type your work email address into a “Start for free” box, the Website checks its format in your browser and then opens our sign-up page at portal.anysoft.me with your email address included in the web address. The Website keeps no copy. Because the address is part of the web address, it can appear in your browser history and in our portal's server logs, and it may be passed to services that the sign-up page loads.
- Email and phone. Email and phone links open your own email program or phone. We receive what you send us.
- Demo bookings. “Book a demo” links open Calendly in a new page. If you book, Calendly collects your name, email address, chosen time and any answers you give, and shares the booking with us. Calendly's own privacy policy applies to its handling of that information.
- We do not use analytics, advertising pixels, social media trackers or session recording on the Website.
Account and sign-up
- Each user's name and work email address, and your business name and country. If your organisation uses Microsoft sign-in, we also hold your Microsoft Entra tenant ID and each linked user's Microsoft sign-in name (user principal name).
- Sign-in credentials (passwords are stored only as a one-way hash), roles and permissions, licence assignments and portal settings. When the Agent is installed on a computer, we create a device account for that computer and store a sign-in token for it.
- Sign-in records, such as the time of your last sign-in. For AnyPrint, we also keep logs of requests to the service and an administrator activity log showing who changed what and when, both including IP address and browser details.
Billing
- Billing contact details, business name and address, and tax numbers where needed (such as a GST number, ABN or GSTIN).
- Subscription details, counts of billable users, workstations and destinations, invoices and payment history.
- Card payments are handled by our payment processor. We do not receive or store full card numbers. We receive limited details such as card type, last four digits and expiry date.
- Where a Partner bills a Customer directly, we exchange billing details with that Partner.
Support and communications
Emails, call notes, attachments, screenshots, log files you send us, and feedback.
Partner program
Partner contact details, company details, the Customers a Partner manages, and billing arrangements.
AnyPrint
- Device and Agent data: computer name and the user's sign-in name on that computer, a device identifier, network name (FQDN), processor, operating system edition, version, build and install date, Agent version, IP address, and when the Agent last contacted us. Printer assignment rules that administrators create, such as a network range, device name or WiFi network name, are stored with the Customer's settings. The Agent checks the computer's network range, name and WiFi network name on the device itself to apply those rules and does not send them to us.
- Print jobs: when a job is held for secure release, its printer is offline, or it is sent from a device that cannot reach the printer directly, a copy of the document is uploaded, encrypted in transit, to private cloud storage in Sydney, Australia. It stays there until the job is printed or deleted. Other jobs print directly over the local network, and only the job details below reach our cloud service.
- Job details: user, device, document name, printer, file size, page count, copies, paper size, colour, duplex and orientation settings, time, status, and the cost centre, department or client the job is allocated to, with its cost.
- Secure release: a 6-digit release PIN generated for each user, which the Customer's AnyPrint administrators can view, and release activity showing who released which job, at which printer and when, using the printer's QR code and the user's PIN. Each release at the printer opens a short session, about 60 seconds, linked to that user.
- Printer status: printer name and model, serial number, IP and hardware (MAC) address, status, uptime, powered-on hours, page count, and toner or ink, drum, waste toner and paper levels, collected by the Agent about every 3 minutes, with online checks every 30 seconds. This is mostly device information, not personal information.
- Reports: usage, cost allocation and billing reports that Customers create from this data.
- On the device: the Agent stores the user's sign-in details, the printers assigned to them and diagnostic logs on the computer where it is installed. These logs can include the user's email address and document names.
AnyPrint guest printing
Guest printing is a planned AnyPrint feature and is not available yet. We do not currently collect any information through a guest printing portal. Before we make it available, we will update this policy to describe the information it collects and how we use it.
AnyScan
- Scanned documents: a multifunction printer emails each scan to AnySoft. Our mail service accepts encrypted (TLS) connections on port 465 (SMTPS). Scans sent on port 25, the standard email port, are received without encryption. Customers who need scans encrypted in transit are responsible for setting their devices to send on port 465 with TLS. We then deliver the scan to the Customer's chosen SharePoint, OneDrive or Google Drive location over encrypted connections, or to a shared folder on the Customer's own network through the Agent. We do not open, read or analyse the document beyond what is needed to deliver it and apply the Customer's rules on sender, destination and file type. Where the Customer uses separator-page splitting, we also check each page for black or blank white separator sheets so we can split the scan into separate documents.
- Scan details: sender and recipient email addresses, email subject and message headers (which can include the sending device's network address), any message text, file names and types, number of attachments, destination, delivery status and time. Our mail service also keeps operational logs that record the sender and recipient addresses, the subject, the sending device's IP address and, when documents are split, file names.
- Activity and audit records: the live activity feed, dashboard statistics, full job history and exportable audit reports.
- Destination settings: the authorisations and folder locations needed to deliver to each destination.
AnyDrive
- Authorisation: when a user connects AnyDrive, Microsoft or Google issues digital keys (OAuth tokens) that let AnyDrive act as that user, with that user's own permissions. We keep these tokens, together with the basic profile details Microsoft or Google include with them (such as the user's name and email address), in our cloud database in Sydney, Australia, and use them only to provide AnyDrive. Our servers use the tokens to reach the user's files on the user's behalf; the tokens are not sent to the user's device or shown to other users.
- File and folder details: names, paths, sizes, created and modified times and file links, so files can appear in Windows Explorer. To speed up browsing, our service keeps a copy of recent folder listings. It also logs each request it makes to Microsoft or Google, and these logs can include folder paths. File contents travel directly between the user's device and Microsoft or Google and do not pass through our servers.
- Cached files: AnyDrive keeps copies of files on the user's own device to speed up access.
- Device data: device name and Agent version.
Sensitive information
Documents that are printed, scanned or opened through the Services may contain sensitive information, such as health records, financial details, identity documents or privileged legal material. We do not seek out or inspect this information. We process it only to deliver the Services for the Customer, and the Customer is responsible for having a lawful basis to process it.
United States healthcare organisations: if you are covered by HIPAA, do not send protected health information through the Services unless you and AnySoft have both signed a business associate agreement. Contact [email protected] to ask about one.
Where we get information from
- From you, when you sign up, use the portals, contact us or book a demo.
- From your organisation or its Partner, when administrators create accounts or invite users, or set up printers, scan rules and destinations.
- Automatically, from the Agent, printers, multifunction printers, the portals and our Website host.
- From Microsoft and Google, when a user or administrator authorises AnyDrive or AnyScan to connect, or when a user signs in with Microsoft Entra ID.
- From service providers, such as our payment processor and Calendly.
Notice when we collect information indirectly
When we receive information about you from your organisation, a Partner, Microsoft, Google or a device, this policy is our notice to you. It tells you that AnySoft Limited, at the address above, holds the information, why we hold it, who we share it with, and how to access and correct it. No law requires you to give us this information. Your organisation decides whether to use the Services.
We often cannot contact these people directly, so our Terms of Service ask Customers to tell their users that they use the Services. We support this by publishing this policy and by showing a short notice, with a link to this policy, where we collect personal information: on the sign-up and trial forms, the partner application and the Agent installer.
What you must give us
We need an email address and business details to create an account, and billing details to charge for a subscription. Tax law requires some billing information. Without this information we cannot provide the Services. Demo booking details are optional. You can browse the Website and ask general questions without identifying yourself, or by using a pseudonym, but the Services need to identify users to work.
How we use information
- Provide the Services: route and release print jobs, deliver scans, map cloud storage into Windows Explorer, and show activity, reports and cost allocation.
- Run accounts: create accounts, sign users in, and manage roles and permissions.
- Billing and accounting: count billable units, invoice, take payment and keep tax records.
- Support: answer questions, fix problems and hold demos.
- Security: monitor for suspicious activity, prevent fraud and abuse, investigate incidents and enforce our terms.
- Improve the Services: create aggregated or de-identified statistics (for example, counts of jobs, error rates, Agent versions and feature use) to maintain and improve the Services. De-identified means the statistics cannot reasonably identify a person or a Customer. We do not try to re-identify these statistics, and we require anyone we share them with not to try either. We never use the content of documents, scans or files for this.
- Service messages: send security alerts, billing notices and notice of changes to our terms or this policy.
- Marketing: send business contacts news about our products where the law allows (see Marketing).
- Legal: comply with the law, respond to lawful requests, and establish or defend legal claims.
- Business changes: as part of a merger, sale or restructure of our business.
What we do not do
- We do not sell personal information.
- We do not share personal information for advertising across other websites, and we use no advertising cookies.
- We do not use Customer Data for our own marketing, and we use it for analytics only in the aggregated, de-identified form described above.
- We do not use personal information or Customer Data to train AI or machine learning models, including large language models.
- We do not combine Customer Data with other data except as needed to provide the Services.
Legal grounds
Where a law asks us to identify a ground for processing, we rely on: performing our contract with the Customer; running and securing our business, Website and Services; complying with legal obligations; and your consent, for example for marketing emails. The grounds we rely on in India are set out in the India section.
Microsoft and Google data
AnyDrive connects to Microsoft 365 (SharePoint and OneDrive) and Google Drive using OAuth authorisation that each user gives. AnyScan delivers scans to SharePoint, OneDrive or Google Drive using access that a Customer's administrator authorises. We request only the permissions needed for the feature, and the Microsoft or Google consent screen shows them before you agree.
- We use this access only to provide the feature the user or administrator asked for.
- AnyDrive uses each user's own tokens and permissions, not a shared service account, so users see only what they can already see in Microsoft or Google.
- We never sell this data, use it for advertising, or use it to train AI models.
- Our staff do not read file content obtained this way unless the user asks us to for support, it is needed for security, or the law requires it.
- Users can revoke access at any time in their Microsoft account or Google Account settings, and administrators can revoke it for their whole organisation. When an administrator removes a storage connection in AnyDrive, we stop using its tokens. Revoking access in Microsoft or Google ends our access completely.
Where we receive information from Google APIs, AnySoft's use and transfer of that information to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We apply the same limits to data we receive through Microsoft Graph.
International transfers
AnySoft is based in New Zealand, and our team accesses information from New Zealand. Our cloud host, DigitalOcean, stores and processes the Services' data in Sydney, Australia. Stripe (card payments), Twilio SendGrid (email delivery), Google and Calendly process information in the United States and other countries. Privacy laws in those countries may differ from the laws where you live.
We protect information sent overseas by choosing providers carefully and, for our contracted service providers, by requiring them to protect it to a standard comparable to the laws that apply to us and to use it only to provide services to us. We remain accountable for that information.
- New Zealand: where a provider holds information only as our agent for storage or processing, this is not a disclosure under the Privacy Act 2020. For any other overseas disclosure, we rely on information privacy principle 12, usually by ensuring the recipient is required to protect it in a way that, overall, provides comparable safeguards to the Privacy Act 2020.
- Australia: we store personal information held in the Services in Australia, in Sydney. It is also handled outside Australia: our team accesses it from New Zealand, and some service providers, including our payment processor and email delivery provider, process it in the United States. We take reasonable steps, including contractual terms, so overseas recipients do not breach the Australian Privacy Principles, and we remain accountable under section 16C of the Privacy Act 1988.
- India: personal data is transferred to New Zealand and the countries listed above. We do not transfer personal data to any country restricted by the Central Government under section 16 of the Digital Personal Data Protection Act 2023, and recipients must maintain the same level of protection that we do.
- United States: information about people in the United States is processed in New Zealand and the countries listed above.
- Other regions: if you are in the European Union or United Kingdom, contact us to ask about the safeguards for your information.
How we protect information
- Encryption in transit for the Website, the portals, the Agent and print traffic, and for scan delivery as described in Information we collect.
- Agents and scan delivery use outbound connections only, so Customers do not need to open inbound ports.
- Role-based access controls in the admin portal, so Customers decide who can see what.
- Request logging for our print and scan services, an administrator activity log in AnyPrint, and limits on repeated sign-in, password reset and secure release PIN attempts.
- Passwords stored only as one-way hashes, and new or reset passwords checked against known breached passwords using a method that sends only a short, anonymous fragment of the password's hash to the Have I Been Pwned service.
- Print documents held in private cloud storage that is not publicly accessible, with any download or upload links for them expiring within 15 minutes, and deleted once the print job completes.
- Contracts with our service providers that require them to protect information.
Limits of security
No system is completely secure. We take the steps described above, but we cannot promise that information will never be accessed without permission. This statement does not reduce our obligations under privacy law or our Terms of Service. Security is shared: we protect the Services, and Customers protect their own devices, networks, printers and accounts, for example by using strong, unique passwords and, for accounts that sign in with Microsoft, enabling multi-factor authentication in Microsoft Entra ID. If you think your account has been compromised, contact us straight away.
How long we keep information
We keep personal information only for as long as we need it for the purposes in this policy, or as the law requires. Then we delete it or de-identify it.
- AnyScan documents: held only as long as needed to deliver them, including any retries if delivery fails, and then deleted.
- AnyPrint documents: when a job is held for secure release, or is sent while its printer is offline, the document is uploaded to private cloud storage. It is deleted when the job is printed or when a user or administrator deletes the job. Documents for jobs that are never released, or that fail to print, are not deleted automatically. Job details, such as the document name, are kept as part of job history (see below).
- Activity logs, job history, audit logs and device data: kept for at least one year, and for as long as the Customer's subscription is active, unless the Customer deletes them sooner where the Services allow. After that, they are handled as set out under Account and Customer Data after cancellation.
- AnyDrive: cached files stay on the user's own device. To speed up browsing, we keep short-lived copies of folder listings (file and folder names and details) on our servers, and we refresh them as folders are viewed or changed. We stop using a user's Microsoft or Google access when an administrator removes the AnyDrive connection. The user or their administrator can also revoke access at any time in Microsoft or Google.
- Trial accounts: data from a free trial that does not become a subscription is handled in the same way as data from a cancelled account.
- Account and Customer Data after cancellation: during a subscription, Customers can export reports, such as job history and activity logs, as CSV files from the Portal. When a subscription ends, Portal access stops. The Customer can then ask us at [email protected] for a copy of its data or for its deletion. We delete or de-identify Customer Data as set out in our Terms of Service, or sooner on request, except where we must keep it by law.
- Backups: deleted data is removed from backups as they cycle out on their normal schedule.
- Billing and tax records: 7 years, as New Zealand tax law requires.
- Support records and Website logs: for as long as we need them for support, security and record keeping, and then deleted.
- Marketing: until you unsubscribe. We keep a minimal record of your opt-out so we do not contact you again.
We may keep information longer where needed for a legal claim, investigation or legal requirement, and only for that purpose.
Your rights and how to use them
Depending on where you live, you may have the right to access your personal information, correct it, delete it, receive a copy in a portable format, withdraw consent, object to some uses, and complain. The Regional rights section explains the rights in New Zealand, Australia, India and the United States.
How to make a request
Email [email protected] with “Privacy request” in the subject line, or call +64 9 886 5969. Tell us what you are asking for. We will confirm your identity, usually by checking the email address on your account or asking for details only you would know. If someone makes a request for you, we will ask for proof of their authority and may confirm with you directly.
Making a request is free. In New Zealand and Australia we may charge a reasonable fee to provide a copy of information in some cases, and we will tell you the amount and get your agreement first. We never charge to correct information.
How long we take
We acknowledge requests promptly and respond within the time set by your local law: 20 working days in New Zealand, 30 days in Australia, no more than 90 days in India (one month for grievances under the Information Technology Rules 2011), and 45 days in California, after confirming receipt within 10 business days (extendable by a further 45 days with notice). If we need more time where the law allows it, we will tell you within the original period. If we refuse a request, we will explain why in writing and tell you how to complain.
Customer Data
If your request is about Customer Data, we will usually send it to your organisation, which decides how to respond. We will help your organisation respond on time.
Marketing
We may email business contacts about our products and events where we have consent, or where the law allows it because of an existing business relationship or because a work email address is published and relevant to the message. Marketing consent is never a condition of using the Services, and we do not use pre-ticked boxes.
- Every marketing email identifies AnySoft, includes our postal address and has a free unsubscribe link that works for at least 30 days after we send it.
- We act on unsubscribe requests within 5 working days.
- We do not buy email lists or use address-harvesting software.
- We do not send marketing text messages or make marketing calls without your consent. Any marketing calls or text messages to Indian numbers follow TRAI rules, including registration and Do Not Disturb preferences.
- Service messages, such as security alerts and billing notices, continue while you have an account.
- You can ask us where we got your contact details.
Automated decisions and AI
We have reviewed where computer programs make, or substantially and directly inform, decisions that could significantly affect individuals. We review this section whenever we change a feature. The programs we use are:
- Customer rules. The Services act automatically on rules each Customer sets, for example sending a print job to a printer based on network location, applying print quotas, or rejecting a scan from an unapproved sender. These use the user's identifier, location on the network, page counts or sender address. The Customer sets and controls these rules, and questions about them should go to the Customer.
- Billing. If a subscription payment fails, our payment processor may send reminders and, if payment is still not made, cancel the subscription. Our system then automatically removes the licence for that subscription, which restricts access to that product. This uses the subscription's payment status. A person reviews any restriction on request.
- Payments. Our payment processor may automatically decline a card payment using its own fraud checks.
None of these programs decides matters such as employment, credit or access to essential services. We do not use personal information or Customer Data to train AI or machine learning models, including large language models. If we introduce other automated decision-making that could significantly affect individuals, we will update this policy before we start, describing the kinds of personal information used and the decisions made.
Children
The Services are for businesses and are not directed at children. Our Website and Services are not intended for anyone under 18, and we do not knowingly collect personal information from children for our own purposes. If a Customer, such as a school or library, lets people under 18 use the Services, we act for that Customer, and the Customer is responsible for any required parental consent. Customers that let people under 18 use the Services must not use the Services to track or monitor the behaviour of those users beyond what is needed to provide the Services, or to direct advertising at them. If we learn that we have collected a child's personal information for our own purposes, we will delete it. Parents or guardians can contact us at [email protected].
Privacy breaches
If we become aware of a breach that affects personal information we are responsible for, we assess it straight away, contain it and notify as the law requires. We do not wait for a full investigation to finish before notifying.
- New Zealand: we notify the Office of the Privacy Commissioner and affected individuals as soon as practicable where the breach has caused, or is likely to cause, serious harm.
- Australia: we assess a suspected eligible data breach within 30 days, and notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable where it is an eligible data breach.
- India: once the relevant Digital Personal Data Protection Rules 2025 are in force, we will inform affected individuals and the Data Protection Board of India without delay and give the Board a detailed report within 72 hours of becoming aware of the breach. Where CERT-In directions apply, we report to CERT-In within 6 hours.
- United States: we notify affected individuals and regulators as state breach laws require.
If a breach affects Customer Data, we notify the Customer without undue delay, and in any case within 48 hours of becoming aware of it, and we give the Customer the information it needs to meet its own obligations. We work with the Customer so that, where possible, one notification covers both of us.
Regional rights
This is one policy for all our storefronts. The sections below add the rights and details that apply in each region. Local laws may give you further rights, and nothing in this policy limits them.
New Zealand
- For information we collect for our own purposes, AnySoft is the “agency” under the Privacy Act 2020. For Customer Data, we hold information as the Customer's agent under section 11.
- We comply with the Privacy Act 2020 and its 13 information privacy principles, including principle 3A on information collected from someone other than you (see Where we get information from).
- You can ask for access to, and correction of, your personal information under Part 4 of the Act (see How long we take). If we do not agree to correct information, you can ask us to attach a statement of the correction you asked for.
- We assign our own user and device identifiers and do not use government-issued identifiers to identify you.
- Customers in the health sector are subject to the Health Information Privacy Code 2020. We hold their health information as their agent.
- If you are not satisfied with our response to a complaint, you can complain to the Office of the Privacy Commissioner at www.privacy.org.nz or on 0800 803 909.
Australia
- We carry on business in Australia and are an “APP entity” for information we collect for our own purposes. We comply with the Australian Privacy Principles in the Privacy Act 1988 (Cth) whether or not the small business exemption in that Act applies to us.
- You can deal with us anonymously or with a pseudonym when browsing or making general enquiries (APP 2).
- You can ask for access to (APP 12) and correction of (APP 13) your personal information (see How long we take). We will give written reasons if we refuse.
- You can opt out of direct marketing at any time and ask us where we got your details (APP 7).
- Overseas disclosures are explained in International transfers (APP 8). New Zealand is not a prescribed country, so we rely on contractual safeguards and remain accountable.
- Data breaches are handled under the Notifiable Data Breaches scheme (see Privacy breaches).
- Automated decisions are covered in Automated decisions and AI, which we will keep up to date for the transparency rules that apply from 10 December 2026.
- To complain, contact our Privacy Officer. We will acknowledge your complaint promptly and aim to respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.
India
This section is our notice to individuals in India (Data Principals). It applies under the Digital Personal Data Protection Act 2023 and the Digital Personal Data Protection Rules 2025 as their provisions come into force. Until then, we also comply with section 43A of the Information Technology Act 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011.
Our role. AnySoft is the Data Fiduciary for Website, account, billing, support, Partner and marketing data. For Customer Data, the Customer is the Data Fiduciary and AnySoft is its Data Processor.
Personal data we process as Data Fiduciary, and why:
- Name, work email, phone and business name: to create and manage your account and contact you about it.
- Sign-in credentials and sign-in records: to sign you in and keep your account secure.
- Administrator audit logs (who changed what and when, with IP address and browser): to secure accounts and investigate incidents.
- Billing contact details, GSTIN and payment history: to invoice, take payment and meet tax law. Card details are held only by our payment processor.
- Support emails and call notes: to answer your questions and fix problems.
- Website server logs (IP address, browser and device details, pages viewed): to deliver and secure the Website.
- The work email you enter in a “Start for free” box, which reaches our portal and its server logs: to start your sign-up.
- Demo booking details (name, email, chosen time and your answers) received from Calendly: to hold the demo you booked.
- Partner contact and company details and the Customers a Partner manages: to run the partner program and billing.
- Marketing contact details and preferences: to send product news, only with your consent.
Grounds. We process account, billing, support, Partner and demo booking data because you gave it to us for those purposes and have not told us you do not consent (section 7(a)). We process tax records to comply with law. We process marketing data and Website server logs on the basis of your consent, which you give by choosing to use the Website after seeing this notice. You can withdraw that consent as described below.
Passwords and financial information. When you create an account or add billing details, we ask for your consent to collect your password and billing information. We use it only to sign you in, secure your account and take payment. We share it only with our payment processor and hosting provider, and we do not keep full card numbers. You can withdraw this consent by closing your account.
Withdrawing consent. You can withdraw consent as easily as you gave it, by using the unsubscribe link in any marketing email or by emailing the Grievance Officer. Withdrawal does not affect processing before it. After withdrawal we, and our processors, stop the processing within a reasonable time, unless the law requires us to continue. You can also give, manage or withdraw consent through a Consent Manager registered with the Data Protection Board of India once that system is available, and we will act on those instructions.
Your rights. You can ask us for:
- a summary of the personal data we process about you and how we process it;
- the names of the Data Fiduciaries and Data Processors we have shared it with, and what we shared;
- correction, completion, updating or erasure of your personal data; and
- a response to a grievance.
You can also nominate another person to use your rights if you die or cannot act. To use these rights, email the Grievance Officer with your name and the email address on your account (see How long we take). Requests about Customer Data go to your organisation, and we help it respond.
Data Protection Board. If you are not satisfied after using our grievance process, you can complain to the Data Protection Board of India through its digital office.
Your duties. When exercising your rights, please give accurate information, do not impersonate anyone, and do not file false or frivolous complaints.
Transfers. Your personal data is transferred to and processed in New Zealand, in Australia by our cloud host (DigitalOcean, Sydney region), and in the United States by our email delivery provider (Twilio SendGrid) and our payment processor (Stripe). Retention. We keep account data while your account is active and for the period set out in our Terms of Service after it closes, billing records for 7 years, and logs for at least one year. We then erase the data. Security. We use encryption in transit, role-based access controls, logging and contractual safeguards on our processors. Breaches. We will tell you without delay if a breach affects your personal data, and say what happened, the likely consequences and the steps you can take.
Language and updates. This notice is in English, and you can ask for it in any language listed in the Eighth Schedule to the Constitution of India by emailing the Grievance Officer. If you consented before the Rules came into force, we will send you an updated notice as soon as reasonably practicable after they do.
United States: California
This section adds to this policy for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. It covers business contacts as well as other individuals. For information we collect for our own purposes, AnySoft is a “business”. We process Customer Data as a service provider to our Customers, so it is not included below. In the past 12 months we have collected the following categories of personal information for the purposes in How we use information, from the sources in Where we get information from, and disclosed each category for business purposes to the recipients in Who we share information with:
- Identifiers: name, email address, phone number, IP address, and account and device identifiers.
- Customer records (Cal. Civ. Code 1798.80(e)): billing contact details and business address. Card details are held by our payment processor.
- Commercial information: subscriptions and purchase history.
- Internet or other network activity: Website server logs, pages viewed on the Website, and portal sign-in and administrator logs.
- Professional or employment information: employer name.
- Sensitive personal information: account sign-in credentials. We use these only to provide and secure the Services, which the law permits.
We do not collect precise geolocation or biometric information, and we do not create profiles to infer characteristics about you. We did not sell or share personal information in the past 12 months, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. We do not disclose personal information to third parties for their own direct marketing.
You have the right to know what personal information we hold (including specific pieces), to delete it, to correct it, to opt out of sale or sharing (we do not sell or share), and not to be discriminated or retaliated against for using these rights, including as an employee, contractor or business contact. Because we operate online and have a direct relationship with our users, you can make requests by email to [email protected]. You can also call us on +64 9 886 5969. Response times are set out in How long we take. An authorised agent can make a request for you with your signed permission, and we may ask you to verify your identity directly. We do not use automated decision-making technology for significant decisions about you.
United States: other states
- If you live in a state with a comprehensive privacy law, including Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, you may have the right to confirm whether we process your personal data, access it, correct it, delete it, receive a portable copy, and opt out of targeted advertising, sale and profiling with significant effects. We do not carry out targeted advertising, sale or such profiling.
- Appeals: if we decline your request, you can appeal by replying to our decision or emailing [email protected] with “Privacy appeal” in the subject line. We respond to appeals within 60 days of receiving them (45 days in Colorado) and explain our decision in writing. If we deny your appeal, we will give you a link or address for your state Attorney General so you can submit a complaint.
- Oregon and Minnesota: you can ask for a list of the specific third parties we have disclosed your personal data to.
- Minnesota: you have the right to question the result of profiling. We do not carry out profiling that produces legal or similarly significant effects.
- Connecticut: we do not collect, use or sell personal data to train large language models.
- Texas: we do not sell sensitive personal data.
- Nevada: we do not sell covered information. You can still send us an opt-out request.
- We honour Global Privacy Control signals as an opt-out of sale and targeted advertising (see Cookies and browser storage).
- Marketing emails meet the CAN-SPAM Act (see Marketing).
Changes to this policy
The date of the last update is shown at the top of this policy. We review this policy at least once a year. We keep previous versions and will give you a copy on request.
If we make a material change, we will tell account administrators by email, show a notice in the portal and on the Website, and do so at least 30 days before the change takes effect. A material change is one that affects what we collect, how we use or share it, or your rights. We will not use personal information we already hold in a materially different way without your consent where the law requires it. Other changes, such as corrected contact details or clearer wording, take effect when we publish them and do not reduce your rights. If you are a Customer and do not accept a material change, you can end your subscription as set out in our Terms of Service.
Contact and complaints
For any question, request or complaint about privacy, contact our Privacy Officer at [email protected], on +64 9 886 5969, or at AnySoft Limited, 241, 46 Tamahere Drive, RD 3, Hamilton 3283, New Zealand. Individuals in India can also contact our Grievance Officer as set out in Who we are and how to contact us.
We will acknowledge your complaint, look into it and reply in writing. If you are not satisfied, you can contact the Office of the Privacy Commissioner (New Zealand), the Office of the Australian Information Commissioner, the Data Protection Board of India, or your state Attorney General or the California Privacy Protection Agency in the United States.
This policy is published as accessible web content. If you need it in another format, such as PDF or by email, contact us.
