Privacy Policy

This policy explains how AnMagic Limited, New Zealand, handles personal information in connection with our website, enquiries, onboarding and enabled products. Our privacy contact is the Privacy Officer at [email protected]. It covers customers and people whose information may appear in property materials, including owners, tenants, occupants and clients.

Read the Inspection privacy notes for photographs and inspection reports, and the Appraisal privacy notes for CMA setup, reports and authorised data-service access.

The public website provides product information and contact links. The AnMagic app at portal.anmagic.com provides account sign-in (including Sign in with Google), report processing and online subscriptions. This policy covers both.

Enquiries and accounts. Information you choose to provide may include your name, email address, phone number, agency or business name, city and correspondence. Appraisal setup also requires an REA licence number.

Inspection. The product processes the photographs and property information supplied for an inspection, relevant entry or earlier reports used for comparison, and the resulting observations and reports. These may reveal a property address, an identifiable person, household possessions or other information about occupants.

Appraisal. Setup involves your report template, 5–10 previous CMA examples, property addresses, relevant property and comparable-sales information, the generated reports and the account-access information necessary for the agreed data connection. Existing documents may contain client or owner details.

Account access and billing. This includes your account identifiers and sign-in information. If you sign in with Google, it includes your name, email address and Google account identifier. If you connect an email account for sending, it includes the information described in section 07. For subscriptions and purchases, it includes plan selections, credit usage, transaction references, invoices, payment status and the card brand, last four digits and expiry date. We do not receive or store full card numbers.

Technical information. Hosting, security and font-delivery services may process information such as IP addresses, browser or device details and requested pages to deliver and protect the site.

We receive information from you when you contact us or provide setup materials. For an enabled product, we may also receive information supplied by your business, authorised property professionals or the data services you authorise. A person whose details appear in a report may not have contacted AnMagic directly.

Where AnMagic processes property material solely on a customer’s behalf, the customer remains responsible for its own collection and notification obligations. Where we collect or use personal information for our own purposes, our own obligations also apply. Where the Privacy Act requires notice of indirect collection, we will take reasonable steps to ensure the affected person receives that notice, unless an applicable exception applies. We may coordinate notices with the customer; this policy is not a substitute for a required direct notification.

Information is used as needed to respond to enquiries and demo requests, check Appraisal eligibility, configure the requested service, access permitted data sources, produce reports, administer accounts and credits, manage agreed payments, provide support, investigate problems and meet legal obligations.

Submitting information for a report is not a blanket permission for unrelated advertising or AI model training. Any proposed use beyond the original purpose must have an appropriate legal basis and any required notice or permission.

We do not sell personal information. If information necessary for a requested setup or report is not provided, we may be unable to complete that task; ask us if you are unsure whether a particular item is needed.

Only provide material you are entitled to collect, share and process for the requested purpose. Take reasonable steps to inform owners, tenants, occupants and clients where required. Remove or obscure irrelevant faces, identity documents, correspondence, financial information and other sensitive details before supplying images or sample reports.

Authority to enter or photograph a property is not automatically permission to use every personal detail visible in a photo for any purpose. Limit the material to what is needed for the inspection, appraisal or setup. Contact us if you believe your information has been included without appropriate authority.

An enabled report service may need to send relevant photographs, text or property data to AI, cloud-hosting, storage and support providers so that the requested report can be produced. Authorised data services are used for Appraisal where agreed during setup. Information may also be shared where lawfully required, or with a person you authorise to receive it.

The AI provider, processing locations, provider retention settings and any model-training permissions depend on the product configuration. Those details are not fully specified on this public website. Contact us before providing personal or confidential report material so the applicable arrangements can be confirmed. This policy does not claim that every provider offers zero retention or excludes model training. Data received from Google or Microsoft account permissions (section 07) is never sent to AI providers.

The use of a provider does not remove AnMagic’s responsibilities under the Privacy Act. Processing on our behalf and disclosure to a provider for its own purposes require different consideration under that Act; a provider must not be treated as unrestricted simply because it is described as a cloud or AI service.

What we access. If you sign in with Google, we receive your name, email address and Google account identifier to create and secure your AnMagic account. If you connect a Google or Microsoft email account under Profile → Work email, we request permission to send email on your behalf (Google scope https://www.googleapis.com/auth/gmail.send; Microsoft Graph Mail.Send), together with the connected account’s email address and display name.

How we use it. We use the send permission only to send inspection notices and inspection reports that you write or review and choose to send from AnMagic. Every email is sent only when you click Send. We use your email address to show which account is connected and as the sender address.

What we do not do. We do not read, list, search, modify or delete messages in your mailbox, and we do not request permission to do so. We do not use Google or Microsoft account data for advertising, we do not sell it, and we do not use it to train AI models. No person at AnMagic reads data obtained through these permissions, except where you ask us to for support, where it is needed for security, or where the law requires it.

Storage and security. To keep your account connected, we store an authorisation token, encrypted at rest (AES-256-GCM), and send all data over encrypted connections. Short-lived access tokens are held in memory only. AnMagic keeps a record of the emails you send through AnMagic (recipients, subject, message and report attachment) in your property’s email history. This record is created by AnMagic, not read from your mailbox.

Sharing. Google and Microsoft account data is not shared with or transferred to third parties, except to Google or Microsoft as needed to send the email you requested, or where required by law.

Disconnecting and deletion. You can disconnect at any time under Profile → Work email. This revokes our access where the provider supports it and deletes the stored token. You can also remove AnMagic’s access from your Google Account (myaccount.google.com/permissions) or Microsoft account settings. Closing your AnMagic account also removes any connected email account.

Limited Use. AnMagic’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Information may be processed or stored outside New Zealand where a relevant hosting, AI or other provider operates. The locations for a particular report service should be confirmed during onboarding; we do not promise New Zealand-only storage or a fixed country for every provider.

Where an overseas transfer is a disclosure covered by information privacy principle 12, we must have an appropriate basis, such as comparable legal or contractual safeguards. Where a provider only stores or processes information on our behalf, we retain the applicable responsibilities for that information. This policy is not a blanket consent to unprotected overseas disclosure.

We are required to take reasonable steps to protect personal information against loss, unauthorised access, use, alteration or disclosure. No online service can promise absolute security. Except as described in section 07, this policy does not claim a particular security certification, encryption configuration or audit.

Personal information must not be kept for longer than necessary for a lawful purpose. Relevant purposes can include providing the agreed service, responding to a support issue, resolving a dispute and meeting record-keeping obligations. Specific retention periods for report files, access information, logs and backups should be confirmed for your product during onboarding.

You can request deletion or account closure by contacting [email protected]. We will explain what can be removed, what must be retained and any applicable provider or backup limitations. Cancelling billing does not itself confirm that all records have been deleted. An Add-on credit balance having no expiry does not mean personal information is stored indefinitely.

If a privacy breach is likely to cause serious harm, we will meet the applicable obligations to notify the Privacy Commissioner and affected people as soon as practicable, subject to lawful exceptions. Please contact us promptly if you suspect a privacy or access problem.

The current website’s own code does not add advertising or analytics trackers, or store report information in browser storage. Hosting and security services may still process technical information needed to serve and protect the site. This statement should not be read as a guarantee that every infrastructure provider uses no cookies.

Fonts are currently loaded from Google Fonts. Loading them can send technical request information to Google; see Google’s Privacy Policy. External links and your email service have their own privacy practices.

Payments are processed by Stripe through an embedded checkout. AnMagic does not receive or store full card numbers; we keep the card brand, last four digits, expiry month and year, transaction references, invoices and payment status to administer your subscription. See the Stripe Privacy Policy for how Stripe handles payment data.

You can ask whether we hold personal information about you and request access or correction by contacting the Privacy Officer at [email protected]. We may need to verify your identity or authority before releasing information. You do not need to be a paying customer to raise a concern about your own information.

We will respond to access and correction requests within the time required by the Privacy Act, generally 20 working days, or tell you if a lawful extension or other permitted response applies. If a requested correction is not made, you may ask for a statement of the correction sought to be attached to the information.

You may also request deletion; this is subject to the purpose for which information is held and any lawful retention requirements, rather than an unconditional right to erase every record. If information is processed for an agency client, we may need to coordinate the request with that agency and will explain the next step.

If your concern is not resolved, you can contact the Office of the Privacy Commissioner. This does not limit any other right or remedy available to you.

We will update this policy as the website or product processing arrangements change and provide additional notice where required. The date above identifies this version. For the processing arrangements relevant to your account, privacy requests or complaints, contact AnMagic Limited’s Privacy Officer at [email protected].