Privacy policy
1. Introduction
This Privacy Policy explains how Route2AI (ABN 82 471 871 202), operating in New Zealand, collects, uses, stores, and discloses personal information.
Route2AI provides an AI-powered voice and messaging assistant service to hospitality businesses (“Customers”). If you call, send a WhatsApp message to, or receive an SMS from a business that uses Route2AI, this policy applies to you as an “End User”.
This policy is written in accordance with the Privacy Act 2020 (NZ) and the 13 Information Privacy Principles (IPPs).
Contact: support@route2ai.com
Website:
route2ai.com/nz/privacy
2. What personal information we collect
User-provided data
Information you provide directly during a call, WhatsApp message, or SMS interaction:
| Data type | Why we collect it |
|---|---|
| Phone numbers | Caller identification, SMS and WhatsApp delivery |
| Names (if provided by the caller) | Personalised service, booking references |
| Booking details (date, time, party size, preferences) | Reservation management on behalf of the Customer's business |
| Marketing consent records (opt-in / opt-out) | Compliance with spam legislation |
Service-generated data
Information created as a result of delivering the service:
| Data type | Why we collect it |
|---|---|
| Call recordings | Service delivery, quality assurance, dispute resolution |
| Conversation transcripts (voice and WhatsApp) | Service delivery, quality assurance |
| Booking records | Reservation management and confirmation |
Automatic collection
Information collected automatically when you interact with the service:
| Data type | Why we collect it |
|---|---|
| IP addresses | Security, fraud prevention |
| Device information | Service compatibility, troubleshooting |
| Usage patterns | Service improvement, analytics |
Information we do NOT collect
Route2AI does not collect or store:
- Payment card data or financial account details
- Government-issued identification numbers (e.g. driver licence, passport, IRD number)
- Medical or health information
3. How we collect information
We collect personal information directly from you when you:
- Make an inbound voice call to a phone number operated by one of our Customers. An automated notice is played at the start of calls advising that the call is recorded.
- Send a WhatsApp message to a business account operated by one of our Customers.
- Receive and respond to an SMS sent on behalf of one of our Customers (for example, a booking confirmation link or a marketing message you have opted in to receive).
We do not collect personal information from third-party data brokers or public directories.
4. Why we collect it (purposes)
We collect personal information for the following purposes:
- Service delivery — answering calls, responding to messages, and handling enquiries on behalf of the Customer's business.
- Call forwarding — transferring your call to the right person at the business when needed.
- SMS link sharing — sending you booking links, menu links, or other information requested during the conversation.
- FAQ answering — providing you with accurate information about the Customer's business (opening hours, menu items, location, etc.).
- Marketing consent management — recording whether you have opted in or opted out of promotional messages, so the business can communicate with you lawfully.
- Quality assurance — reviewing conversations to maintain and improve the accuracy and helpfulness of the service.
- Compliance — meeting legal obligations under the Privacy Act 2020, Unsolicited Electronic Messages Act 2007, and other applicable laws.
5. Third-party services
Route2AI uses the following third-party service providers to deliver the service:
| Provider | Purpose |
|---|---|
| Google Cloud Platform (GCP) | Cloud hosting, data storage, and computing infrastructure. Data is stored in the Australia region. By using the service, your personal information may be transferred to and stored in Australia. |
| Twilio | Telephony (voice calls), SMS messaging, and WhatsApp messaging. |
| Stripe | Payment processing for Customer subscriptions only. Stripe does not receive End User personal information. |
| AI language model providers (such as Google Gemini, Anthropic Claude, OpenAI) | Natural language understanding and response generation. See Section 6 for details on data handling. |
Use of these third-party services is subject to their respective privacy policies and terms. Route2AI selects providers that maintain appropriate security and privacy standards.
6. AI model training & data use
Third-party AI providers
Route2AI selects its third-party AI providers (such as Google Gemini, Anthropic Claude, and OpenAI) and configures its use of them with the intention that Customer content is processed for inference only and is not retained by, or used to train the general-purpose models of, those providers. However, third-party providers operate under their own terms and policies, which are outside Route2AI's control, and Route2AI does not warrant or guarantee the data-handling practices of any third-party provider.
Route2AI's own use of data
Route2AI does not sell Customer or End User content. Route2AI may use aggregated and de-identified data — which does not identify any individual End User or Customer — to operate, support, secure, and improve the Service, including to develop, train, and improve Route2AI's own AI models and to generate analytics and insights. Any use of personal information is handled in accordance with this Privacy Policy and applicable privacy law.
7. Data storage and security
We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure.
- Location: All primary data is stored on Google Cloud Platform in the Australia region. Personal information of New Zealand individuals is transferred to and stored in Australia. Route2AI ensures appropriate safeguards are in place for this cross-border transfer in accordance with Information Privacy Principle 12.
- Encryption at rest: AES-256 encryption.
- Encryption in transit: TLS (Transport Layer Security) for all data transmitted between systems.
- Architecture: Serverless infrastructure with tenant-level isolation, meaning each Customer's data is logically separated from every other Customer's data.
- Access control: Access to personal information is restricted to authorised personnel on a need-to-know basis.
No method of electronic storage or transmission is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security.
8. Data retention
We retain personal information only for as long as reasonably necessary for the purposes described in this policy, or as required by law.
| Data type | Retention period |
|---|---|
| Conversation transcripts | 12 months from the date of the conversation |
| Call recordings | 12 months from the date of the recording |
| Booking records and names | Duration of the Customer's service agreement + 30 days |
| Phone numbers | Duration of the Customer's service agreement + 30 days |
| Marketing consent records | 7 years (as required by the Unsolicited Electronic Messages Act 2007) |
| Aggregated and anonymised statistics | Indefinitely (these do not identify individuals) |
Upon termination of a Customer's service agreement and upon written request, we will delete personal data from active systems within a reasonable period, subject to legal retention obligations and permitted backups.
9. Your rights
Under the Information Privacy Principles, you have the right to:
- Access — Request access to the personal information we hold about you.
- Correction — Request correction of any personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading.
- Deletion — Request deletion of your personal information, subject to any legal obligations that require us to retain it.
- Complain — Make a complaint if you believe we have breached the Information Privacy Principles.
To exercise any of these rights, contact us at support@route2ai.com. We will respond to your request within 20 working days.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner:
- Website: www.privacy.org.nz
- Phone: 0800 803 909
- Post: PO Box 10-094, The Terrace, Wellington 6143
10. Disclosure and sharing
We may disclose your personal information to the third-party service providers listed in Section 5, but only as necessary to deliver the service.
We may also disclose personal information if required or authorised by law (for example, in response to a court order or lawful request by a government agency).
We do not sell, rent, or trade personal information to any third party.
11. Marketing
Route2AI facilitates marketing communications on behalf of its Customers. These communications are only sent to End Users who have provided explicit opt-in consent.
- You can unsubscribe at any time by following the opt-out instructions included in each marketing message, or by contacting the business directly.
- We maintain marketing consent records to ensure compliance with the Unsolicited Electronic Messages Act 2007 (NZ).
12. Children
Route2AI's service is not directed at children under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us at support@route2ai.com and we will take steps to delete it.
13. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify affected parties by updating the “Last updated” date at the top of this page and, where practicable, by providing notice through the service or by email.
Your continued use of the service after the updated policy takes effect constitutes acceptance of the changes.
14. Contact and complaints
If you have any questions about this Privacy Policy, or if you wish to make a complaint about how we have handled your personal information, please contact us:
Route2AI
ABN 82 471 871 202
Email: support@route2ai.com
We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied with the outcome, you may escalate your complaint to the Office of the Privacy Commissioner at www.privacy.org.nz.