1. Who we are
Archon is operated by [Archon Technologies Limited], [Registered office address], Auckland, New Zealand. For the purposes of the Privacy Act 2020, we are the agency responsible for the personal information described in this policy. Where the EU/UK GDPR applies, we act as a data controller for account and website data, and as a data processor for the project content you upload on behalf of your organisation.
2. Information we collect
Information you provide
- Account information — name, work email, password (stored only as a salted hash by our authentication provider), and organisation details.
- Project content — building consents, drawings and plans, RFIs, specifications, correspondence, and other documents you or your team upload. These may contain personal information about third parties (e.g. applicants, owners, consultants).
- Communications — messages you send to support, feedback, and survey responses.
Information collected automatically
- Usage data — features used, actions taken, and timestamps.
- Technical data — IP address, browser and device type, and log data needed to operate and secure the service.
- Cookies — see our Cookie Policy for details.
3. How we use your information
- To provide, maintain, and improve the Archon platform.
- To authenticate you and keep your account secure.
- To analyse plans and RFIs and generate findings, drafts, and citations using AI features (see section 5).
- To provide support and respond to your requests.
- To monitor for abuse, debug issues, and protect the security and integrity of the service.
- To comply with legal obligations and enforce our terms.
4. Legal basis for processing
Under the Privacy Act 2020, we collect personal information for lawful purposes connected with our functions and activities, and only where it is necessary for those purposes. Where the GDPR applies, we rely on: performance of a contract (providing the service); legitimate interests (securing and improving the service); consent (where required, e.g. certain cookies); and compliance with legal obligations.
5. AI processing
Archon uses third-party large language models to read drawings, interpret council RFIs, and draft responses. When you use these features, the relevant project content is transmitted to our AI sub-processors solely to generate output for you. We do not permit these sub-processors to use your content to train their foundation models, and we contract for zero-retention or short-retention processing where available.
AI output is generated automatically and may be incomplete or incorrect. It is intended to assist qualified professionals and is not a substitute for professional judgement or a building consent authority determination. See the Terms of Service for the full disclaimer.
6. How we share information
We do not sell your personal information. We share it only:
- Within your organisation — with other users in your workspace, according to the access your administrator configures.
- With sub-processors — service providers who process data on our behalf under contract. Our database, authentication, and file storage are provided by Supabase (hosted on cloud infrastructure). See the full list on our Sub-processors page.
- For legal reasons — where required by law, to respond to lawful requests, or to protect rights, safety, and property.
- In a business transfer — in connection with a merger, acquisition, or sale of assets, subject to this policy.
7. International transfers
Some of our sub-processors store or process data outside New Zealand. Where we transfer personal information overseas, we take reasonable steps to ensure it is protected by comparable safeguards (e.g. contractual protections and, where relevant, the GDPR's standard contractual clauses), consistent with IPP 12 of the Privacy Act 2020. The hosting region for your primary data store can be confirmed on request.
8. Security
We take reasonable technical and organisational measures to protect your information, including encryption in transit (TLS) and at rest, role-based access controls, row-level security in our database, and audit logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. Data retention
We retain personal information for as long as your account is active or as needed to provide the service, then for the period required to meet legal, accounting, or reporting obligations. You may request deletion of your account and associated content; we will delete or de-identify it within a reasonable period, subject to backups and legal hold requirements.
10. Your rights
Under the Privacy Act 2020 you have the right to request access to, and correction of, the personal information we hold about you. Where the GDPR applies, you may also have rights to erasure, restriction, portability, and to object to certain processing. To exercise any of these rights, contact privacy@archon.co.nz. We may need to verify your identity before responding.
11. Children
Archon is a business tool not directed at children and is not intended for anyone under 16. We do not knowingly collect personal information from children.
12. Changes to this policy
We may update this policy from time to time. We will post the updated version here and revise the "Last updated" date. Material changes will be communicated through the service or by email where appropriate.
13. Contact & complaints
For privacy questions or to make a complaint, contact us at privacy@archon.co.nz. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner (New Zealand).