Privacy Policy

Last updated: 24 October 2026

NED ("NED", "we", "us") provides ready-to-run, manager-led sales-training modules for real estate teams. NED is operated by AIREA DIGITAL LIMITED (trading as NED by Airea Digital Limited; NZBN 9429053969149; GST 149731849), registered at 4 Sackville Street, Grey Lynn. This policy explains how we handle personal information, consistent with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs). Questions: hello@airea.co.nz.

Information we collect

Who	What	Why
Attendees (your team)	Full name, email address, and a per-device identifier; the answers and attendance for a session	To record who attended a training session, email each attendee a confirmation copy, and add the record to their manager's training register
Account holders	Name, email, agency/office details (office name, licensed agency name and licence number, branch address, contact), trial and subscription status, receipts and session history	To run your account, manage your trial or subscription, print office details on attendance records, and show your attendance and billing records
Payments	Card and billing details are entered directly with Stripe. We receive and keep only your Stripe customer and subscription references, your plan, the subscription status and its renewal or end date. We never receive or store your full card number or CVV	To set up and manage your subscription, prevent duplicate charges, end access if a payment is refunded or disputed, and point you to your Stripe invoices
Sign-in	Your email (magic link) or your verified Google or Microsoft account email; for Microsoft sign-in, also the account's tenant and object identifiers	To authenticate you, passwordlessly, and make sure only the Microsoft account you first used can open your NED account

How we use it

We use personal information only for the purposes above: recording and confirming attendance, providing your account and the modules, taking payment, and communicating with you about your account or a session. We do not use attendee or manager email addresses for marketing without consent (consistent with the Unsolicited Electronic Messages Act 2007).

Who we share it with

We share personal information only with the providers needed to deliver the service:

Your manager / agency: attendance records are made available to the manager who ran the session, as their internal training record.
Hosting, network and database providers (including Hostinger and Cloudflare): used to operate the website, API, account records, receipts and training registers.
Stripe: payment processing, tax invoices and billing.
Google: only if you choose "Sign in with Google".
Microsoft: only if you choose "Sign in with Microsoft".
Email delivery: to send sign-in links, attendance confirmations, and trial, subscription and account emails.

We do not sell personal information.

Overseas processing

Some providers we use, including payment, sign-in, email delivery, hosting, monitoring or support providers, may process information outside New Zealand. Where IPP 12 applies, we use providers and arrangements intended to provide comparable privacy safeguards.

Cookies and local storage

We use strictly-necessary cookies for manager sign-in and for Google and Microsoft sign-in security. The join page uses your browser's local storage to remember the session you joined, your name, your email address, and a per-device identifier so your phone can answer questions and avoid duplicate sign-ins. We do not use third-party advertising or analytics cookies. The homepage records an anonymous view count (the page only, with no cookies, IP address or identifiers stored).

Retention

Attendance records are kept in the manager's account so they remain available as a training record. Transient live-session data (the in-room question/answer state) is deleted automatically after 14 days. Expired sign-in tokens and sessions are purged regularly. You can ask us to delete personal information we hold about you (see below), subject to any record-keeping the manager or the law requires.

Your rights (access and correction)

Under IPP 6 and IPP 7 you may ask us for a copy of the personal information we hold about you, and ask us to correct it. Email hello@airea.co.nz and we will respond within the timeframes the Privacy Act requires. Note that the manager who ran your session also holds their own copy of the attendance record.

Security

Access is authenticated, data in transit is encrypted (HTTPS), passwords are not used (passwordless sign-in), and server credentials are kept out of the codebase. Subscriptions, receipts and attendance registers are checked server-side. Payment card entry happens on Stripe-hosted Checkout, so NED does not store card numbers or CVVs. More detail is available in our Security Overview. No system is perfectly secure, but we take reasonable steps to protect personal information from loss, misuse and unauthorised access (IPP 5).

Privacy breaches

If we become aware of a privacy breach that has caused, or is likely to cause, serious harm, we will assess and notify as required by the Privacy Act 2020, including notifying the Office of the Privacy Commissioner and affected people where required.

Complaints

If you have a privacy concern, contact us first at hello@airea.co.nz. If you are not satisfied, you can contact the New Zealand Office of the Privacy Commissioner (privacy.org.nz).

Changes

We may update this policy as the service evolves. The "last updated" date above shows the current version.

This policy is provided in good faith for transparency and is not legal advice. If your obligations are significant, have it reviewed by a New Zealand privacy/legal professional before relying on it.