Privacy Policy

This Privacy Policy applies to Personal Information that Factalog Limited (“we”, “us” or “our”) collects, holds, uses or discloses in connection with our website, our software and services.

This Privacy Policy explains what Personal Information we collect and how we comply with the requirements of applicable privacy laws, including the New Zealand Privacy Act 2020 (“Privacy Act”).

In this Privacy Policy:

“Cloudflare” means the third party cloud infrastructure provider we use to host and support parts of Factalog, including our website, account and licensing services, the optional sync service, software downloads and updates, and email services.

“Factalog” means Factalog Limited’s desktop record-keeping application;

“Paddle” means the relevant Paddle entity through which you purchase a subscription and which acts as a merchant of record and authorised reseller of our product, including processing payments, billing, renewals, cancellations and refunds. Paddle processes information you provide during checkout in accordance with its own privacy terms.

“Personal Information” means any information that relates to an identifiable individual and, where applicable, includes “personal data” as defined under the EU GDPR and the UK GDPR.

“you” and “your” means the individual to whom the Personal Information relates.

Personal information we collect

The Personal Information we collect depends on the products and services you use, and your interaction with us.

For example, you can download and use the free plan of our software without creating an account, providing contact information to us, or paying a subscription fee. Limited technical information may be processed when you visit our website, check for, download or update the software, as described below.

If you purchase a paid plan, we receive and hold the limited information needed to administer your subscription, licence and to provide any additional online services you choose to use.

For example, we may collect:

• identity and contact information, such as your email address;
• subscription information we receive from Paddle, including Paddle customer and subscription identifiers, your plan, subscription status, and billing period information;
• account and licensing information, including your licence key and random device identifiers used to activate and manage your licensed devices;
• where you use the optional sync service, encrypted logbook content together with limited account, device and service metadata needed to provide and secure that service, such as device enrolment information, device and operating system information, and the timing and size of the encrypted sync activity and storage totals;
• information you provide to us when you contact us for support including correspondence and diagnostic material; and
• any other Personal Information that you provide to us or authorise us to collect.

If you use the optional sync service, your logbook content is encrypted on your device before being transmitted through and stored by Factalog’s sync service, which is hosted using Cloudflare infrastructure. We do not hold the keys required to decrypt that content and cannot read it.

We do not receive or store your payment card or other payment instrument information. We do not automatically collect crash or error reports, product analytics or usage telemetry from the software.

Except for encrypted logbook content stored through the optional sync service, we do not receive or store your logbook content unless you choose to provide it to us, for example when seeking support. Your readable logbook content is otherwise stored locally on your device.

How we collect Personal Information

We collect Personal Information:

• directly from you when you contact us or otherwise provide information to us;
• through your use of Factalog, for example when you activate or verify your licence, manage activated devices or use the optional sync service; and
• indirectly from Paddle, when you purchase or maintain a subscription.

You do not need to provide Personal Information to download or use the free plan. If you purchase a paid plan, certain information, including your purchase email address and subscription information received from Paddle, is necessary for us to create and administer your licence and provide paid plan functionality. If that information is not provided, we may be unable to provide the paid plan or related services.

How we use Personal Information

We may use Personal Information for the following purposes:

• to confirm your identity, identify your licence or subscription and communicate with you, including to deliver your licence key and send essential service, support or security communications;
• to respond to your queries and support requests;
• to create and administer your licence, subscription or paid plan;
• to activate and verify your licence and manage activated devices;
• to provide, administer and secure the sync service and any other online services
• to maintain the security and integrity of our software, systems and services and to detect, prevent and respond to fraud, misuse or other unlawful activity;
• to comply with our legal obligations;
• for any other purpose we tell you about, or you authorise; and
• as permitted or required by applicable law.

Lawful basis for processing

Where the EU General Data Protection Regulation (EU GDPR) or UK General Data Protection Regulation (UK GDPR) applies to our processing of your Personal Information, we rely on one or more of the following lawful bases:

• Contract – where processing is necessary to provide the product and services or to perform our contractual obligations to you, including administering your subscription and licence and providing our services;
• Legitimate interests – where processing is necessary for our legitimate interests or those of another person, including responding to support requests, maintaining and securing our software, systems and services, providing software updates and preventing fraud, misuse or other unlawful activity, provided those interests are not overridden by your rights and interests;
• Legal obligations – where processing is necessary for us to comply with a legal or regulatory obligation; and
• Consent – where we ask for your consent to process Personal Information for a particular purpose. Where we rely on consent, you may withdraw it at any time, although this will not affect processing carried out before you withdraw your consent.

Sharing and Overseas Processing of Personal Information

We may provide Personal Information to third party service providers, including Cloudflare, where necessary for them to provide services on our behalf. Where a service provider stores or processes Personal Information solely on our behalf, we remain responsible for that information in accordance with the Privacy Act.

Cloudflare provides infrastructure used for our website, account and licensing services, optional sync service, software downloads and updates, and email services. Personal Information processed through those services may be processed or stored outside New Zealand as part of Cloudflare’s global infrastructure.

Paddle acts as merchant of record for purchases of paid plans. Information you provide directly to Paddle during checkout is processed by Paddle under its own privacy terms found here https://www.paddle.com/legal/privacy. Paddle provides us with limited information needed to administer your subscription, including your email address, Paddle customer and subscription identifiers, plan, status and billing-period information. We do not receive your payment card or other payment-instrument information.

We may also disclose Personal Information:

• to our professional advisers, including lawyers and insurers;
• where you have authorised the disclosure;
• where disclosure is permitted or required by law; or
• where reasonably necessary to facilitate the sale or other disposition of all or part of Factalog Limited’s business.

Some of our service providers may process or store Personal Information outside New Zealand or the country in which you are located. We take reasonable steps to ensure that service providers processing Personal Information on our behalf have appropriate contractual, confidentiality and security protections in place.

Optional Third Party Services

Factalog may allow you to connect to third party services that you choose, such as Harvest or an AI system or endpoint selected by you. These third party services or integrations are optional and are initiated and configured by you.

These third party services are not service providers engaged by us and do not process Personal Information on our behalf. They are separate from service providers that process Personal Information on our behalf, such as Cloudflare, and from Paddle, which acts independently as our merchant of record and authorised reseller.

Where you use an optional third party service, information may be transmitted directly from your device to that service. We do not receive or control that information. Your use of the third party service, and its handling of your information, is governed by the terms and privacy arrangements between you and that third party.

AI Tools used by Factalog Limited

We may use third party AI tools that have been approved internally to assist with limited business functions, including investigating a support issue. Where we use such a tool to process Personal Information you have provided to us, we will ensure that appropriate confidentiality, security and data protection arrangements apply and that the use is consistent with this Privacy Policy and applicable law.

This is separate from any optional AI integration that you configure, as described under the heading Optional Third Party Services above.

Security of Personal Information

We take reasonable technical and organisational steps to protect Personal Information against loss, unauthorised access, use, modification or disclosure. These measures include access controls, secure transmission of information and, for the optional sync service, encryption of logbook content before it leaves your device.

Access to Personal Information held by us is restricted to persons who require access for legitimate business purposes.

While we take reasonable steps to protect Personal Information, no method of transmission or storage is completely secure.

Retention of Personal Information

We will retain your Personal Information only for as long as reasonably required for the purposes for which we may lawfully use that information.

In particular:

• subscription and paid plan licensing information may be retained while your subscription is active, and for up to 12 months after your subscription ends, unless a longer period is reasonably required for a specific lawful purpose described below;
• support correspondence may be retained for up to 24 months after the relevant issue has been raised or resolved, where reasonably required for support, business records or dispute resolution purposes. Diagnostic files or other material you provide to us for troubleshooting as part of our support service will be deleted once the relevant issue has been resolved, unless there is a lawful reason to retain them for longer;
• if you have used the optional sync service, encrypted data held through that service will be retained for up to 90 days after your subscription ends and will then be permanently deleted, unless it is deleted earlier at your request or we are required by law to retain it for longer;
• a limited record of subscription or transaction events may be retained for up to 7 years where required for tax, accounting or other legal record-keeping purposes; and
• we may retain Personal Information for as long as necessary to comply with legal obligations, maintain security, prevent fraud, establish or defend legal claims or resolve disputes.

Logbook content stored only on your own device is not retained by us.

Your Privacy Rights

Under the New Zealand Privacy Act you have the right to request access to your Personal Information where it can be readily retrieved, and to request that your Personal Information be corrected.

We may require you to verify your identity and specify what information you require before responding to an access or correction request.

You can make requests to access or correct Personal Information, or raise any concerns about our handling of your Personal Information by emailing support@factalog.com

If you are not satisfied with our handling of a privacy matter, you may also make a complaint to the New Zealand Office of the Privacy Commissioner on 0800 803 909.

EU and UK Privacy Rights

Where the EU GDPR or UK GDPR applies to our processing of your Personal Information, you may have additional rights, subject to applicable law, including the right to:

• request access to the Personal Information we hold about you;
• request correction of inaccurate or incomplete Personal Information;
• request deletion of your Personal Information in certain circumstances;
• request that we restrict the processing of your Personal Information in certain circumstances;
• object to our processing of your Personal Information based on our legitimate interests in certain circumstances;
• receive Personal Information you have provided to us in a structured, commonly used and machine-readable format, and request that it be transferred to another organisation where the right to data portability applies; and
• withdraw consent at any time where we rely on your consent to process Personal Information.

You may exercise these rights by contacting us using the details set out under How to contact us. We may need to verify your identity before responding to your request.

Some of these rights are subject to exceptions and will not apply in every circumstance.

If you are located in the European Economic Area, you have the right to lodge a complaint with the Data Protection Supervisory Authority in the country where you live or work, or where you consider an infringement has occurred.

If you are located in the United Kingdom, you may raise a complaint with us and can also lodge a complaint with the UK Information Commissioner’s Office.

Children

Factalog and our website are not directed at anyone under the age of 18. We do not knowingly collect Personal Information about anyone under the age of 18.

Cookies and Website Analytics

We use Cloudflare Web Analytics to obtain limited information about website traffic and performance. Cloudflare Web Analytics does not use cookies to track visitors, and we do not use advertising cookies, tracking pixels or browser or device fingerprinting to track individuals across websites.

Cloudflare may process limited technical information, such as IP address and request information, as part of hosting and delivering our website and providing website analytics.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our products or services, our information handling practices, or applicable law.

We will publish the updated Privacy Policy on our website with a revised effective date. Where a change materially affects how we collect, use or disclose your Personal Information, we will take reasonable steps to notify you of that change.

How to contact us

If you have a query about this Privacy Policy, wish to exercise a privacy right or have a concern about how we handle Personal Information, please contact us by email at support@factalog.com.

Last Updated

This Privacy Policy was last updated on 18 September 2026.