Draft for legal review. Items shown like [this] are placeholders to fill in. We have assumed New Zealand incorporation and governing law, hosting in Sydney, and the sub-processor list shown — confirm these, and have a qualified lawyer review before you publish.
Last updated: 28 June 2026 · Effective: 28 June 2026. Operated by Wonn Labs Limited (New Zealand company no. [NZ company number] / NZBN [NZBN]), registered office [registered office address]. Contact: support@wonnapp.com. Governing law: New Zealand.
1. Introduction
This Privacy Policy explains how Wonn Labs Limited ("Wonn", "we", "us", "our") collects, uses, discloses and protects personal information when you visit our websites, create an account, or use the Wonn application and related services (together, the "Service"). It also sets out your rights and how to exercise them.
Wonn serves customers worldwide. Depending on where you are, different laws apply, including the EU and UK General Data Protection Regulation (GDPR), the New Zealand Privacy Act 2020, the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), and US state privacy laws such as the California Consumer Privacy Act as amended by the CPRA (collectively, "Privacy Laws"). Where a specific law gives you more rights, that law prevails for you.
Controller and processor
For personal information about you as a Wonn customer or website visitor (your account, billing and usage data), Wonn is the data controller. For personal information that you load into Wonn about your own clients, staff and contacts ("Customer Data"), you are the controller and Wonn acts as your processor under our Data Processing Addendum. This Privacy Policy describes our role as controller; the DPA governs our role as processor.
2. Who this applies to
- Visitors to our websites and users of our free tools.
- Account holders and the individual users on their team.
- People who contact us, subscribe to our emails, or apply for a role.
It does not change the agreement between you and your own clients about their data, which you control.
3. Information we collect
3.1 Information you give us
- Account and profile: name, email, phone, company name, role, password (stored hashed), and branding you upload (logo, colours).
- Billing: plan, billing contact and country, and tax details. Card payments are processed by our payment provider; we do not store full card numbers.
- Customer Data: the scopes, quotes, proposals, client records, schedules and inspection results you enter. This may include personal information about your clients and staff, which you control.
- Support and communications: messages, attachments and feedback you send us.
- Marketing: if you subscribe, your email and preferences.
3.2 Information we collect automatically
- Usage and device data: log data, IP address, device and browser type, pages and features used, dates and times, and approximate location derived from IP (used for region settings).
- Cookies and similar technologies: as described in our Cookie Policy.
3.3 Information from third parties
We may receive information from our payment provider (payment status), authentication providers, and analytics tools, and from anyone who refers you to us.
4. How we use information, and our lawful bases
We use personal information to operate, secure and improve the Service, to bill you, to provide support, to communicate with you, to comply with law, and to develop new features. Where the GDPR or UK GDPR applies, we rely on these lawful bases:
- Performance of a contract: to provide the Service you have signed up for, manage your account and process payments.
- Legitimate interests: to secure, maintain and improve the Service, prevent fraud and misuse, understand usage, and carry out limited direct marketing to existing customers. We balance these against your rights.
- Consent: for optional cookies and certain marketing, which you can withdraw at any time.
- Legal obligation: to meet tax, accounting and other legal requirements.
Automated processing and AI
Wonn uses AI to help structure scopes and generate inspection checklists from content you provide. These features assist you; they do not make decisions that produce legal or similarly significant effects about any individual without human involvement.
5. Cookies and tracking
We use cookies and similar technologies as set out in our Cookie Policy. Where required, we ask for your consent and offer granular choices through our cookie banner.
6. How we share information
We do not sell your personal information. We share it only as follows:
- Sub-processors and service providers who help us run Wonn (hosting, AI, email, analytics, payments), listed on our sub-processors page, under contracts that require appropriate protection.
- Legal and safety: where we must comply with law, enforce our terms, or protect the rights, property or safety of Wonn, our users or the public.
- Business transfers: in connection with a merger, acquisition or sale of assets, subject to this Policy.
- With your direction or consent.
7. International data transfers
Wonn is hosted in Sydney, Australia (AWS ap-southeast-2). If you are in the EEA, UK or elsewhere, your information will be transferred to and processed in Australia and other countries where our sub-processors operate. Where required, we use appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), together with our DPA. You can request a copy of the relevant safeguards from support@wonnapp.com. EU region hosting is on our roadmap for customers who require in-region storage.
8. How long we keep information
We keep personal information for as long as your account is active and as needed to provide the Service, then for the period required to meet legal, tax, accounting and dispute-resolution obligations, after which it is deleted or anonymised. You can export or request deletion of your data at any time (see Your rights).
9. Security
We apply appropriate technical and organisational measures, including per-company isolation with row level security, encryption in transit and at rest, private file storage with short-lived signed links, access controls and regular backups. See our security overview. No system is perfectly secure, but we work to protect your information and to notify you of breaches as required by law.
10. Your rights
Subject to the law that applies to you, you may have the following rights. To exercise any of them, email support@wonnapp.com. We will verify your identity and respond within the time the law allows (generally within 20 working days in New Zealand, one month under the GDPR, or 45 days under the CCPA/CPRA, with extensions where permitted).
EU and UK (GDPR)
- Access your data and receive a copy.
- Correct inaccurate data.
- Erase data ("right to be forgotten") in certain cases.
- Restrict or object to processing, including profiling and direct marketing.
- Data portability.
- Withdraw consent at any time.
- Complain to your supervisory authority (in the UK, the ICO).
New Zealand (Privacy Act 2020)
- Access and correction of your personal information held by us.
- Complain to the Office of the Privacy Commissioner.
Australia (Australian Privacy Principles)
- Access and correction, and to complain to the Office of the Australian Information Commissioner.
United States (CCPA/CPRA and similar state laws)
- Know what personal information we collect, use and disclose.
- Access and delete your personal information.
- Correct inaccurate personal information.
- Opt out of "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined.
- Non-discrimination for exercising your rights.
11. Children
Wonn is a business tool and is not directed to, or intended for, anyone under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
12. Direct marketing
We may send service messages (which you cannot opt out of while you hold an account) and, where permitted, marketing about features and content. You can opt out of marketing at any time using the unsubscribe link or by contacting us.
13. Third-party links
Our sites may link to third-party sites we do not control. This Policy does not apply to them; please read their privacy notices.
14. Changes to this Policy
We may update this Policy from time to time. If changes are material, we will notify you by email or in the Service before they take effect. The "Last updated" date shows the latest version.
15. Contact and complaints
Privacy contact: support@wonnapp.com, Wonn Labs Limited, [registered office address]. You may also complain to your local supervisory or privacy authority.Questions? Email support@wonnapp.com or our contact page.