Legal
Privacy policy
This policy explains what personal information Dash collects, why we hold it, who else touches it, and what you can ask us to do with it. It is written to be read, not to be survived.
1. Who we are
Dash is job management software for trade businesses, built and operated from New Zealand. In this policy, "we", "us" and "Dash" mean the operator of the service reachable at godash.nz.
For anything in this policy, including access and correction requests, write to privacy@godash.nz. A person reads that inbox, and we answer.
2. Two kinds of information
It matters which of these we are talking about, because our obligations differ.
- Information about our customers
- The trade business that subscribes to Dash, and the people who sign in. We decide how this is handled, so we are the agency responsible for it.
- Information our customers put into Dash
- Their own customers, sites, jobs, photos, signatures and paperwork. That belongs to the subscribing business. We hold and process it on their instructions, and we do not use it for our own purposes. If you are the customer of a business that uses Dash, your privacy request goes to them, and we will help them answer it.
3. What we collect
Directly from you, when you sign up and use Dash:
- Name, email address, phone number and the workspace you belong to
- An encrypted hash of your password, and two-factor secrets if you enable it
- Billing contact and subscription details
- Support correspondence
Created as you work:
- Jobs, quotes, invoices, bills, purchase orders and progress claims
- Timesheets, leave and reimbursement claims
- Photos, notes, signatures, forms, checklists and certificates
- Site addresses, asset records and floor plans
- Vehicle positions and trips, but only if you switch on the fleet module and connect a GPS provider
- Site and customer access credentials, which are encrypted at rest, and every reveal is recorded
- An audit history of who changed what and when, and sign-in session records
Collected automatically:
- IP address, browser and device information, and timestamps
- Application error and performance logs
This marketing site sets no cookies and runs no analytics. It makes no third-party requests at all. Tracking in the application itself is limited to what is needed to keep you signed in.
4. Why we hold it
- To provide Dash and keep your workspace working
- To authenticate you and protect accounts from misuse
- To bill you and keep the records tax law requires
- To support you when you ask, and to investigate faults
- To meet legal obligations
We do not sell personal information. We do not share it for advertising. We do not use the content of customer workspaces to train machine-learning models.
5. Artificial intelligence
Dash uses AI for six specific jobs: reading an inbound email into a draft job, extracting supplier bills, parsing supplier statements, amending a job from an email reply, drafting quote wording, and interpreting search terms.
To do that, the relevant content is sent to Google (Gemini models) for processing and the result is returned to your workspace. We record which feature ran, which model, how many tokens it used and whether it succeeded, so we can meter usage. AI output is always returned as a draft for a person to approve. Nothing is posted, sent or filed automatically.
6. Who else touches your data
These are our sub-processors. Each is used for one job, and each is bound by its own terms.
| Provider | What for | What it sees |
|---|---|---|
| Postmark | Sending and receiving email | Message content, addresses, attachments |
| Stripe | Subscription billing | Billing contact and payment details. Card numbers go to Stripe directly and are never stored by us |
| Xero | Accounting sync, if you connect it | Contacts, invoices, bills, credit notes, payments and, with Xero Payroll, timesheets and leave |
| AI features and maps | Content submitted to an AI feature; addresses submitted for geocoding | |
| Cloudflare R2 | File storage and off-site backups | Uploaded files, generated documents, database backups |
| Pipit GPS | Fleet tracking, if enabled | Vehicle positions, trips and geofence events |
| New Zealand VPS hosting | Servers and database | All application data at rest |
We will tell customers before adding a sub-processor that materially changes where or how their data is handled.
7. Where your data lives
Dash runs on servers located in New Zealand, and your workspace data lives there. Several of the sub-processors listed above operate outside New Zealand, so information passed to them may be stored or processed overseas. Where that happens we rely on that provider's contractual commitments to protect it to a standard comparable to the New Zealand Privacy Act 2020.
8. How long we keep it
- While your subscription is active, we keep your workspace data so the product works.
- After you cancel, we keep your workspace for 90 days so you can come back or take an export, then we delete it.
- Backups are taken daily and pruned on a rolling schedule: 30 daily, 12 weekly and 6 monthly copies, held off-site. Deleted data can persist in backups until those copies age out.
- Billing and tax records are kept for seven years, as New Zealand law requires.
9. Keeping it safe
- Encrypted in transit, and site and customer credentials encrypted at rest
- Role-based permissions, so people see only what their role allows
- A full audit history of changes to jobs, money and settings
- Optional two-factor authentication
- Daily database backups with off-site copies
- Databases and internal services not exposed to the public internet
No system is perfectly secure. If a breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Privacy Commissioner as the Privacy Act 2020 requires.
10. Your rights
Under the New Zealand Privacy Act 2020 you may ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. If you are in the United Kingdom or the European Union, you may also have rights to erasure, restriction, portability and objection.
Email privacy@godash.nz. We will respond within 20 working days. If you are unhappy with our answer you can complain to the Office of the Privacy Commissioner.
If your information sits inside a workspace belonging to a business that uses Dash, send your request to that business. We will help them respond.
11. Changes
If we change this policy in a way that materially affects you, we will tell you by email or in the application before it takes effect. The version and date at the top always reflect the current document.
12. Contact
Privacy questions, access requests and corrections: privacy@godash.nz. Anything else: hello@godash.nz. If you need a postal address for a formal request, ask and we will provide one.