Draft — pending legal review. Not yet in effect.
Privacy Policy
Last updated: [Last updated date]
This policy explains how [Delta Strike legal entity name] (“Delta Strike”, “we”) handles personal information in Delta Suite and on this website. We follow the New Zealand Privacy Act 2020 and its 13 information privacy principles.
Our role
When your organisation uses Delta Suite, the personal information in it — for example your customers’ contact details or your staff’s training records — belongs to your organisation. We hold and process it on your organisation’s behalf to provide the service (section 11 of the Privacy Act 2020). Your organisation is responsible for how it collects and uses that information.
We are responsible for the personal information we collect for our own purposes, such as account details and messages you send us.
What we collect
- Account details: name, email address and Google profile details when someone signs in with Google.
- Content your organisation puts into the apps, including contacts, deals, emails, schedules, projects, courses and articles.
- Data from accounts you choose to connect, such as Gmail, Google Ads, Google Analytics, Aircall or HubSpot.
- Technical records created by our hosting providers when the service is used, such as request logs.
- What you tell us when you contact us.
This website itself sets no cookies and runs no analytics. See the Cookies page.
How we use it
- To provide, maintain and secure Delta Suite.
- To provide support and answer your questions.
- To tell you about changes to the service or these policies.
- To meet our legal obligations.
[Confirm before publishing: whether we sell or share personal information for advertising]
Subprocessors
These providers process data on our behalf to run Delta Suite. Each is listed with the data it receives.
| Provider | What for | What it receives | Where | Apps |
|---|---|---|---|---|
| Google Cloud (Cloud Run, Cloud SQL, Cloud Storage) | Hosting, database and file storage for apps on the CRM platform | All data stored in Delta CRM and Delta Knowledge | Australia (Sydney, australia-southeast1) | Delta CRM, Delta Knowledge |
| Google Cloud and Firebase (Cloud Run, Firestore, Firebase Hosting, Firebase Authentication) | Hosting, database and sign-in for apps on the Delta Ops platform | All data stored in Delta Schedule, Delta Projects and Delta Learn; name and email address at sign-in | United States (app servers in us-central1); database location [to be confirmed] | Delta Schedule, Delta Projects, Delta Learn |
| Auth0 (Okta) | Sign-in for apps on the CRM platform (Sign in with Google) | Name, email address and Google profile details at sign-in | [Auth0 tenant region — to be confirmed] | Delta CRM, Delta Knowledge |
| Anthropic | AI features: the knowledge-base assistant, AI drafting of knowledge articles, contact scanning and lead research | The question asked and excerpts of the relevant knowledge-base articles; ticket notes (with personal details redacted) when drafting articles; the image or text submitted to contact scanning; research queries | [Processing location — confirm with Anthropic’s terms] | Delta CRM, Delta Knowledge |
| Amazon Web Services (Simple Email Service, SNS) | Sending email campaigns and receiving delivery and bounce events | Campaign recipients’ email addresses and the message content | [AWS region — to be confirmed; the example config uses ap-southeast-2, Sydney] | Delta CRM (email campaigns) |
| [Geocoding provider — OpenStreetMap Nominatim / Photon, or Mapbox] | Turning addresses into map locations and suggesting addresses as you type | The address text being looked up | [Depends on the provider in use] | Delta CRM |
| Google reCAPTCHA | Spam protection on public web forms, when switched on | A verification token from the person submitting the form (their browser also contacts Google directly) | [Google — global] | Delta CRM web forms |
These services receive data only if your organisation connects its own account with them:
| Provider | What for | What it receives | Where | Apps |
|---|---|---|---|---|
| Google (Gmail) | Syncing a connected Gmail inbox into the CRM and sending email from it | Messages sent from the CRM; the CRM reads the connected inbox (read and send access only) | Delta CRM | |
| Google Ads | Reporting on ad performance and uploading conversions for leads that came from ads | SHA-256 hashed email address and phone number, plus the ad click ID, of converted leads | Delta CRM | |
| Google Analytics 4 and Search Console | Reading website analytics reports into CRM dashboards | Report requests only — the CRM reads data from Google | Delta CRM | |
| Aircall | Logging phone calls against CRM records | Aircall sends call details to the CRM when a call ends | Aircall | Delta CRM |
| HubSpot | Migrating your existing data from HubSpot into the CRM | Read requests only, using your HubSpot access — data flows from HubSpot into the CRM | HubSpot | Delta CRM |
[Process for notifying customers of new subprocessors — to be confirmed]
Where information is stored
Delta CRM and Delta Knowledge are hosted in Sydney, Australia. Delta Schedule, Delta Projects and Delta Learn run on servers in the United States. Some subprocessors above process data in other countries.
When personal information is sent overseas, we take reasonable steps to make sure it is protected in a way comparable to New Zealand law (information privacy principle 12). [Safeguards relied on for each country — to be confirmed]
Security
We take reasonable steps to protect personal information from loss and misuse. What is in place today is described on our Security page.
How long we keep it
We keep personal information only as long as it’s needed for the purposes above or required by law. [Retention period after an account closes — to be confirmed].
Access and correction
You can ask for access to the personal information we hold about you, and ask us to correct it (information privacy principles 6 and 7). Email privacy@example.com. If the information is held for one of our customers, we may refer your request to them.
Privacy breaches
If a privacy breach is likely to cause anyone serious harm, we will notify the Office of the Privacy Commissioner and affected people as soon as practicable, as Part 6 of the Privacy Act 2020 requires. Where we hold the information for a customer, we will also tell that customer.
Australian customers
Where the Australian Privacy Act 1988 (Cth) applies, we handle personal information in line with the Australian Privacy Principles, and eligible data breaches are notified under the Notifiable Data Breaches scheme. You can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
Questions and complaints
Contact our Privacy Officer, [Privacy Officer name or title], at privacy@example.com or [Registered office address, New Zealand]. If you’re not satisfied with our response, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).
Changes to this policy
We may update this policy. We’ll post the new version here with its date, and tell customers about material changes.