Privacy Policy

This Privacy Policy explains how Financial Technologies Limited, trading as Wlbr ("Wlbr", "we", "us"), collects, uses, stores, discloses and protects your personal information. We handle personal information in accordance with the Privacy Act 2020 and its Information Privacy Principles.

It applies to everyone who uses the Wlbr platform, both Buyers who fund escrow payments and Sellers who receive them. By using Wlbr you agree to the handling of your information as described here.

We only collect personal information we need to run the escrow service, process payments and keep it safe. This includes:

• Account details: your name, email address, and the password hash used to sign you in.
• Business and profile details: your display or business name and contact email, used to identify you on payments.
• Verification information: where required to meet our AML/CFT obligations, identity information (such as government photo ID and proof of address), which we hold securely and restrict to authorised review staff only.
• Payment information: the escrow payments you fund or receive, their amounts, references and status, and movements into and out of our client trust account. Funds move by bank-to-bank transfer initiated through a New Zealand open-banking provider. We store the bank account details a Seller nominates for payouts in encrypted form; we do not collect or store your internet-banking login or card details.
• Technical information: limited log data such as IP address and browser type captured at key events (for example, when you accept the Terms) to keep the platform secure.
• Estimates and regional interest: if you use the cost estimator, we process your chosen service, optional region and job description to generate an indicative range. Avoid names, precise addresses, contact details and sensitive information. If you join a waitlist, we store your email address and any region, city, hiring/working role and trade you provide so we can manage and contact you about that interest.

We also receive information about you from third-party services we use to operate the platform:

• Identity and AML/CFT verification: we use Didit, a third-party identity and transaction monitoring provider, to verify identities and screen payments against AML/CFT obligations. Didit may collect biometric data (a liveness check and document scan) directly from you on our behalf, and it returns a structured verification result and risk assessment to us. Its privacy policy is available at didit.me/privacy.
• Business register lookups: we query the New Zealand Companies Office NZBN register and the Licensed Building Practitioners (LBP) register to confirm business and practitioner details you provide. These are public registers and the information returned is not stored beyond what is needed for the check.
• Open-banking account data: when you authorise a bank transfer through Akahu (our open-banking provider), Akahu shares your nominated account details and transaction reference with us to initiate and confirm the payment. Akahu collects and processes that data under its own privacy policy, available at akahu.nz/privacy.
• Accounting integration: if you connect your Xero organisation, we receive invoice and account data from Xero in order to link payments to invoices and reconcile your accounts. This data is processed only as you direct.

We use your personal information to:

• create and operate your account and the escrow service;
• create, fund, hold, release and refund escrow payments, and pay out to Sellers;
• verify identity and meet our Anti-Money Laundering and Countering Financing of Terrorism Act 2009 obligations;
• detect, prevent and investigate fraud, abuse and security incidents;
• provide support, send service notifications, and handle complaints and disputes;
• generate requested cost estimates and manage regional or product access requests;
• comply with our legal obligations.

We do not sell your personal information. We do not use it for unrelated marketing without your consent.

Where optional journey analytics is enabled, we record daily totals for a fixed set of product interactions and successful steps. These aggregates contain no person or session identifier, free-text input or payment token, and are retained for 90 Auckland calendar days including the current day. Browser collection honours Do Not Track and Global Privacy Control. These totals are separate from the operational payment records and security logs described elsewhere in this Policy.

We share personal information only where necessary:

• with the other party to a payment, for example a Buyer and the Seller can see the display name and reference associated with the payment between them;
• with service providers who help us operate (such as our hosting, database, email and open-banking payment providers), under confidentiality obligations;
• with regulators, law enforcement or others where the law requires or permits it, including AML/CFT reporting; and
• if our business is sold or reorganised, with the relevant party, subject to this Policy.

Some of our service providers process data outside New Zealand. By using wlbr you authorise these transfers. The overseas locations and the nature of each transfer are:

• Amazon Web Services (Australia): our database, application hosting and file storage run on AWS infrastructure in the Sydney region (ap-southeast-2). All personal information in your account, including payment records, verification outcomes and any documents or evidence you upload, is stored there. AWS holds SOC 2 and ISO 27001 certifications. Details at aws.amazon.com/privacy.
• Didit (European Union / United States): identity verification and AML/CFT transaction monitoring. Your identity documents and biometric liveness data are processed by Didit's infrastructure, which spans the EU and US. Supplier processing locations, retention and safeguards require confirmation before this draft is approved. Details at didit.me/privacy.
• Resend (United States): transactional email delivery. Service notifications (payment receipts, status updates, dispute notices) are relayed through Resend's US infrastructure. Details at resend.com/privacy.
• Sentry (United States): error monitoring. When something goes wrong in the app, a report describing the error is sent to Sentry so we can fix it. We scrub personal information such as email addresses and bank account numbers from these reports before they leave our systems. Details at sentry.io/privacy.
• Upstash: abuse-prevention counters and short-lived worker wake-up locks. Counter keys can contain an IP address, account identifier or email address, depending on the action. Our configured rate-limit windows extend to 24 hours; the overlapping counters expire after up to 48 hours and one second under the current library configuration. Wake-up locks expire after 5 or 10 seconds. We do not put payment records, identity documents or passwords in this store. The deployed storage location and supplier retention arrangements still require confirmation for this draft. Details at upstash.com/trust.
• Vercel AI Gateway and OpenAI: the cost estimator's current application configuration sends the selected service, optional region and job description through Vercel AI Gateway for the OpenAI GPT-4.1 mini model to produce an indicative estimate. Processing locations, provider routing and supplier retention arrangements still require confirmation for this draft; no New Zealand-only processing or zero-retention promise is made. A task draft carried onward from an estimate is kept in that browser tab without copying the original free-text description. Details at vercel.com/legal/privacy-policy and openai.com/policies/privacy-policy.
• Neon and Vercel hosting (United States): our former database and web hosts. Until those hosting resources are fully decommissioned, historical copies of data may remain under the same safeguards described here. Those copies are being retired and are not used to host the Platform. Vercel AI Gateway is a separate active estimator dependency described above.

We assess the safeguards for overseas processing, including the information involved, provider practices and contractual arrangements. Provider certifications may inform that assessment; they do not by themselves establish that a particular transfer meets our obligations. The supplier assessments and wording in this draft remain subject to review. If you would like more detail about a specific transfer, contact us at support@wlbr.app.

We take reasonable steps to keep your information safe, including encryption in transit, encryption of nominated bank account numbers at rest, access controls that restrict sensitive verification documents to authorised review staff, and signed/secured sessions.

We keep personal information only for as long as we need it for the purposes above or as required by law. AML/CFT records, for example, must be kept for at least five years. When information is no longer needed, we delete or de-identify it.

Under the Privacy Act 2020 you have the right to ask for access to the personal information we hold about you, and to request that we correct it if it is wrong. Wlbr also gives you self-service tools in your account:

• Download my data: export a machine-readable copy of your account, business profile, payments and notifications at any time.
• Delete my account: permanently remove your account and personal profile data. Some records tied to completed payments or AML/CFT obligations may be retained in a minimised form where the law requires, and cannot be deleted while you have funds in escrow or an open dispute.

You can also contact us at support@wlbr.app to exercise any of these rights. If you are not satisfied with how we handle your information, you may complain to the Office of the Privacy Commissioner (privacy.org.nz).

We may update this Privacy Policy from time to time. The version and effective date are shown at the top. If we make material changes we will take reasonable steps to let you know.

Questions about privacy can be sent to support@wlbr.app.