Questions about this page: hello@blackcreek.co.nz
Black Creek Solutions: Privacy Statement
Black Creek Solutions Limited (NZ company number 9470357) ("we", "us"), Wellington, New Zealand. This statement explains what personal information we collect, why, where it's kept, and your rights.
What we collect
- Your contact details: names, email addresses, phone numbers and job titles of the people at your business we deal with.
- Documents you send us for a tender or claim. These are mostly business records, but they can include personal information: names on timesheets, staff CVs and qualifications in a tender, signatures, and photos from site.
- If you use our online app (it isn't open yet): your name, email address and role on each project; what you and your team add to a project (claims, schedules, invoices, payments, rates, variations, site diaries, timesheets, documents and photos, which can show names, hours, signatures, faces, vehicle plates and sometimes injuries); and a log of who did what and when. One-time access codes and network addresses are kept only in a scrambled (keyed hash) form.
- Account and payment records: what you bought, invoices and payment status. We don't take card payments yet: we invoice, and you pay by bank transfer. When card payments start, our payment provider (Stripe) will handle card details, and we'll never see or store your full card number.
- Website use: the basic technical logs any website keeps (for example, an IP address and the pages visited), used for security and to keep the site working.
- Our free tools (including the deadline checker, claim builder, retention calculator, debrief letter and company check) run entirely in your browser. What you type into them isn't sent to us, isn't stored, and no cookies are set. The company check opens the government register's own website, which has its own privacy terms.
Why we collect it (IPP 1 and 3)
Only to provide our services: checking and reporting on your claims, running your projects in the online app, invoicing you, supporting you, and meeting our legal obligations. We don't sell personal information, and we don't use it for advertising.
How AI is used
Our system checks claims with the assistance of AI. Documents you send, or add to a project that uses the evidence check, are processed by an AI service to read them (for example, the supplier, amount and date on an invoice), and the matching pages are sent when you ask a question. We use an AI service with model training switched off for our account. It deletes what it receives within 30 days, with limited exceptions under its own terms. Anything the system isn't sure of is flagged for you to check before you submit.
Where it's kept and how it's protected (IPP 5)
In the online app, once it opens:
- Your project's documents, photos and outputs are encrypted with that project's own key before they're stored, and each person sees them only as their role allows.
- They're stored with Cloudflare. We ask for storage in Oceania, but storage in New Zealand isn't guaranteed.
- Before your first upload to a project, you're asked to agree how your files are handled, and that agreement is kept.
- The database is backed up each night, and backups are kept for 30 days.
When you order a check by email:
- When you email us, the email passes through our email forwarding service to our Microsoft mailbox, and a copy is forwarded to a Google (Gmail) mailbox. We move any documents into your job folder, and delete the email copies from both mailboxes when the job ends.
- We ask you to email only the claim and the contract pages with the rates and payment terms. Anything more goes through a private upload link for your job.
- When you upload documents, they're moved off the upload link and sealed (encrypted) in a job folder as soon as we receive them. Each customer's job is kept separate.
- Each job has its own upload link, shared only with you, and removed when the job ends.
- Access is limited to the people who need it to do your job.
Who we share it with, including overseas (IPP 11 and 12)
We only share personal information with the services we need to run ours:
| Service | What for | Where |
|---|---|---|
| Microsoft (OneDrive) | Receiving uploads and returning finished packs | Microsoft data centres, which may be outside NZ |
| Anthropic (Claude) | AI reading and checking of documents | United States |
| Stripe | Card payments, when card payments start (not used yet) | Overseas |
| Porkbun (email forwarding and domain name records) | Passing emails sent to hello@blackcreek.co.nz on to our mailbox, and pointing our web address to our services | United States |
| Microsoft (Outlook) | Our mailbox: emails to and from you, and documents you email us | Microsoft data centres, which may be outside NZ |
| Google (Gmail) | A copy of emails sent to hello@blackcreek.co.nz, forwarded to a Gmail mailbox | Google data centres, which may be outside NZ |
| Cloudflare | Running the website and the online app, and storing app data, documents and backups | Cloudflare's global network; storage requested in Oceania, not guaranteed to stay in NZ |
| Resend | Sending one-time access codes and invitations for the online app: it sees the address and the email's text | Overseas |
These providers are bound by their own privacy and security commitments, which give protections comparable to the Privacy Act's. We'll update this list if it changes.
We also share information where the law requires it.
How long we keep it (IPP 9)
- Online app projects: when a project is closed, it's kept read-only for 30 days so you can export it or reopen it. Then its records, documents, photos, reports and log are deleted. Our backups age out within a further 30 days.
- Job documents you send us by email or upload link: deleted within 30 days after the job ends, unless you ask us to keep them. The copies on the upload link are deleted as soon as they're sealed.
- Your claimed-items register: to stop the same invoice, document or person's hours being claimed twice across your contracts, we keep a short record of each item you've claimed through us. It holds the supplier, invoice number, amount, date, the contract and claim it went on, the names and dates on timesheets, and a digital fingerprint of each file. The fingerprint can't be turned back into the document. It holds no documents. It's only ever compared with your own claims, never another customer's. We keep it while you're a customer and delete it within 30 days of you leaving.
- Our own business records (invoices to you and payments): kept for 7 years, because NZ tax law requires it.
- Contact details: for as long as we work together, and then for up to 2 years unless you ask us to delete them.
Your rights (IPP 6 and 7)
You can ask to see the personal information we hold about you, and to have it corrected. You can also ask us to delete it, subject to the records the law requires us to keep. We'll reply within 20 working days. Email us at hello@blackcreek.co.nz.
If something goes wrong
If a privacy breach is likely to cause anyone serious harm, we'll tell the people affected and the Office of the Privacy Commissioner as soon as practicable, as the Privacy Act requires.
Complaints
Contact us first at hello@blackcreek.co.nz. If you're not satisfied, you can complain to the Office of the Privacy Commissioner (privacy.org.nz). Australian customers can also contact the OAIC (oaic.gov.au).
Changes
We'll post any changes here, with the date, and email existing customers about anything significant.
Last updated: 3 November 2026.