Privacy
Effective date: 2026-10-29. How automate.business, operated by NZWE, Inc., handles information for invited business accounts.
The policy
automate.business is operated by NZWE, Inc., a Delaware C Corporation. The company contact address is NZWE, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, US.
For privacy questions and general questions, the contact is info@nzwe.com, the owner-designated contact.
The service helps US small businesses with administrative work. It is designed as a private preview for invited accounts. It is not a public self-serve service at the effective date. Live work and voice are temporarily paused. Authentication email for invited accounts is active. Customer email replies and Gmail are not available. No model inference is active. No model provider is enabled at launch. Each model provider is added with the 30 day subprocessor notice described under Change control on our subprocessors page.
The service can receive business records, instructions, documents, messages, and other content that a customer chooses to provide. The private runtime was retired on 2026-10-11 and no customer runtime is active. When a service is enabled, it can use external model providers to prepare outputs for the customer's review.
Nothing produced by the service is intended to leave the customer's business without human approval. This is a product rule and a safety control. The customer remains responsible for deciding whether to send, publish, rely on, or act on an output.
The customer decides what information to put into the service and why. For customer business data, NZWE, Inc. acts as a service provider or processor, as applicable, and processes that data to provide the service under the customer's instructions.
For account, access, billing, support, security, and service administration information about the customer's own personnel, NZWE, Inc. may act as the business or controller, as applicable.
The customer is responsible for having the rights, notices, permissions, and authorizations needed to provide customer business data to the service and to connect any third-party source. The customer should not provide data it is not authorized to use.
The categories depend on the customer's configuration. They may include:
Customers must not submit sensitive data or children's data, including health information, government identifiers, or payment-card numbers. Both are prohibited in v1.
We use information to:
We do not use customer business data for our own model training. We do not use it for aggregation or cross-tenant analysis. We do not sell customer business data. These statements concern NZWE, Inc.'s own use and do not state the terms of an external model provider. The provider-specific terms and configuration must be checked before we route data to any provider, and we will give customers prior notice before enabling a provider.
The locations below are facts about the current configuration. They are not a residency warranty.
No public claim of US data residency may be made on the basis of these location facts. The subprocessor inventory on our subprocessors page records each provider's current location and the provider links.
We use encryption in transit. Stored data is protected by the encryption our hosting and database providers apply. The service is designed around one customer per instance. Access is limited by authentication, workspace membership, service permissions, and operational need.
The service is designed to keep customer business data separate between customer instances. The control plane stores customer account and operational metadata, not the customer's business records. This is an architecture statement, not a certification or compliance claim.
External actions are held behind a human approval step. OAuth connections are customer-authorized and may be revoked. We do not promise that any system is immune from every security event.
If we become aware of a confirmed security incident affecting customer business data, we notify affected customers within 24 hours after awareness. Notices to individuals or regulators are the responsibility of the customer as controller, unless law or contract says otherwise.
For customer business data we process on a customer's instructions, we notify the customer so they can meet their own obligations. For account data we hold as the controller, we notify affected people and regulators as applicable law requires, including US state breach laws and, for New Zealand personal information, the Privacy Act 2020. A notice describes what happened, the kinds of data involved, what we are doing about it and how to reach us.
We disclose information only as needed to provide the service, follow customer instructions, operate a customer-authorized integration, process billing, maintain security, or comply with law. The current provider set and purpose for each provider are on our subprocessors page.
Gmail is a customer-directed source rather than a provider we select, and it is not active. We may disclose information to a model provider that we enable after the 30 day subprocessor notice described on our subprocessors page. We do not enable a provider for every customer by default.
We may disclose information to professional advisers, insurers, acquirers, or authorities when reasonably necessary for a permitted business purpose or required by law, subject to confidentiality and legal limits.
We keep customer business data while the customer's account and configured service require it. On termination, the customer may export customer business data for 30 days. We then delete it from active systems within the next 30 days, and backups are purged within 30 more days.
We may retain limited account, billing, security, and legal records for as long as required by law or needed to establish, exercise, or defend legal claims. We will not retain customer business data longer than the approved schedule merely for our own purposes.
Depending on applicable law and the relevant role, an individual may have rights to request access, correction, deletion, portability, restriction, or information about processing. The scope and timing of those rights depend on the law that applies. This policy does not decide that question. Where a US state privacy law such as the CCPA applies to us as a business, we will give the notices and honor the rights that law requires.
Customer personnel may send a request to info@nzwe.com. A person whose information appears in customer business data should normally contact the customer that supplied the data, because the customer decides the purpose and context of that processing. We will reasonably assist the customer with a request where required by an applicable agreement or law.
The service uses strictly necessary browser storage or cookies for authentication, security, and operation. Our public website uses analytics cookies from Google Analytics. You can block them in your browser settings or with a browser privacy extension, and the site works the same without them. No advertising cookies are used, and the customer application sets no analytics cookies.
This is a business service for invited business accounts. Children's data is prohibited in v1, and customers must not knowingly provide it.
We may update this policy as the service, providers, or law changes. We give account owners 30 days email notice before a material change takes effect.
Privacy, data requests and general contact: info@nzwe.com.
Company contact address: NZWE, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, US.
Privacy questions