Privacy policy

What we collect, why, who it goes to and in which countries, how long we keep it, and what you can ask us to do about it, including the information you hold about your own customers.

Last updated 22 October 2026

1. Who we are

GoSmoko is provided by GOSMOKO LIMITED (NZBN 9429053954558), a New Zealand company based in Taranaki, New Zealand. GoSmoko is a trademark of GOSMOKO LIMITED.

We have a privacy officer, as the New Zealand Privacy Act 2020 requires. Reach them at privacy@gosmoko.com. A person reads that inbox, not a ticket queue.

2. What this policy covers

This policy covers personal information GoSmoko handles about the people who use it (you and your crew), people who visit our website or contact us, and the people whose details you enter into GoSmoko (your customers, their tenants and site contacts, and your suppliers' staff). It covers the website, the web app and the phone app.

For information about you as our customer, we decide how it is handled and this policy applies directly. For information you enter about your customers, your business decides what is collected and why, and we hold and process it for you as your agent, on the terms in our Data processing terms. Under section 11 of the Privacy Act 2020 that information is treated as held by your business.

We handle personal information in line with the New Zealand Privacy Act 2020 and its Information Privacy Principles, and, for people in Australia, the Australian Privacy Principles in the Privacy Act 1988.

3. What we collect about you

Account details: your name, email address and phone number, and the business details you enter (legal and trading name, address, GST number, and bank account for your invoices).
Sign-in information: a password hash, or the identity Google returns if you sign in with Google. We never see your Google password.
Your crew: names, email addresses, roles, pay and charge-out rates, and the hours they record. When you invite someone, we get their email from you rather than from them, and our invite email tells them which business invited them to GoSmoko.
Billing information: your plan, add-ons, AI credit use and billing history. Card details are held by Stripe, not by us.
Things you send us: support emails, feedback and bug reports you send from the app, and replies to our emails.
Technical information: IP address, browser and device type, and the time of each request, kept to secure the service and fix faults.

4. What you put in about your customers

GoSmoko stores the records you create: customer names, emails, phone numbers, addresses, site notes and access details, and the enquiries, quotes, jobs, photos, chats, invoices and payments attached to them.

We use this only to provide GoSmoko to your business: showing it back to you and your crew, putting it on the documents you send, sending the emails and texts you ask us to send, and passing it to the integrations and AI features you use. We do not market to your customers and we do not sell or share their details with anyone else.

Your business is responsible for telling your customers how you use their information, and for having a lawful reason to collect it. If you collect someone's details from another person (for example a tenant's number from a property manager), the Privacy Act 2020 (principle 3A, from 1 May 2026) may require you to let that person know. GoSmoko gives you the tools to see, correct, export and delete any customer's details.

5. The phone app

The phone app is offline-first: it keeps an encrypted copy of your business on the device so it works with no signal. Signing out deletes that copy. We do not store Xero, Stripe or email keys on the device.

Camera: only opened when you tap to take a photo. Photos are attached to the job and uploaded when you have signal. We do not read your photo library.
Microphone: only on while you hold the mic or dictate. The recording is turned into text and then discarded; we keep the text, not the audio.
Location: stamped when you check in or out of a job and when you take a photo, so a photo can show where and when work happened. That stamp is visible only to people in your business. GoSmoko does not track you in the background. If you switch on location samples for your own day (part of Timeline), those points are visible only to you and are used to draw your day. The hours you confirm are the record, and you can ask us to delete your location samples at any time.
Push notifications: if you turn them on, we store a device token from Apple or Google so we can notify you. Turning them off in your phone's settings stops them.
No advertising identifier is read, no third-party analytics or advertising SDK is bundled, and nothing is used for tracking as Apple defines it.

6. How we use information

To run the service: storing your records, producing documents and reports, and calculating GST at the rate you set.
To send the emails and texts you ask us to send, from your business, to your customers.
To keep the service secure: detecting misuse, verifying webhooks, and investigating faults.
To bill you, and to tell you about your account, your trial, billing, security and changes to our terms.
To support you. Our team only opens a business's records when you ask for help, to fix a fault affecting you, or when the law requires it.
To improve GoSmoko using aggregated usage (which features are used, where errors occur). This does not involve reading your customers' details.
If we send you product news, you can unsubscribe from it at any time. Account, billing and security emails are part of the service and cannot be switched off while your account is open.

7. Artificial intelligence

Some features use AI to turn what you say, type or forward into a proposed draft: Talk it out, reading a quote, invoice or supplier bill you drop in, and @Smoky in a job chat. GoSmoko does not record phone calls.

When you use one of these features, we send OpenAI the text, recording or file you gave it, plus enough of your business for it to match things up: for example recent customer names and towns, site addresses, open job numbers and titles, your charge-out rate, stock item names and prices, and what is on the screen you used it from (such as the lines of an open invoice). For @Smoky, it is the recent messages in that job's chat with the names of who sent them, plus the job's open to-dos and logged parts. We do not send bank details, passwords or payment information.

OpenAI does not use data sent through its API to train models, and neither do we. OpenAI may keep API data for up to 30 days to detect abuse, then deletes it.

Nothing an AI proposes is saved until a person taps to accept it. If you would rather not use AI, do not use those features; everything else in GoSmoko works without them.

9. Other disclosures

We may disclose information where the law requires it, to a court or regulator, to prevent a serious threat to someone's life, health or safety, or to protect our legal rights. If we are asked for your business's data, we will tell you first unless the law prevents us.

If GoSmoko or its business is sold or merged, information may pass to the new owner, who must keep protecting it under this policy. We will tell you before that happens.

10. Sending information overseas

Your main database is in Sydney, Australia, and the application runs in Sydney. Some of our providers process or store information in other countries, mainly the United States. This means personal information may be disclosed to recipients outside New Zealand and Australia.

For New Zealand, we only do this where principle 12 of the Privacy Act 2020 allows: the recipient is subject to comparable safeguards, or is bound by a contract to protect the information to that standard. For Australia, we take reasonable steps under Australian Privacy Principle 8 to make sure overseas recipients handle it consistently with the Australian Privacy Principles.

If you need your data held only in New Zealand or Australia, email us before you sign up and we will tell you honestly whether we can do that.

11. How we protect it

Everything travels over HTTPS and is encrypted at rest by our hosting providers.
Integration keys and tokens are encrypted with AES-256-GCM before they are stored, with a key held outside the database.
Every record belongs to one business, and every query is limited to the signed-in person's business. Crew roles limit what each person can see and change.
Quote and invoice links your customers open use long random tokens, show one document each, and are hidden from search engines.
Payment webhooks are checked against their signing secret before anything is marked paid.
The database is backed up daily, and backups are encrypted and regularly test-restored.

12. If there is a privacy breach

If a privacy breach happens that has caused or is likely to cause serious harm, we will notify the New Zealand Privacy Commissioner and the people affected as soon as practicable, as the Privacy Act 2020 requires. Where the Australian Notifiable Data Breaches scheme applies, we will notify the OAIC and affected people under it. If the breach involves your customers' information, we will tell your business promptly so you can meet your own obligations, as set out in our Data processing terms.

13. How long we keep it

We keep your account data while your account is open. You can delete your business yourself at any time from Settings, on the phone or the web. Deletion is immediate, and our account deletion page sets out exactly what goes and what briefly remains.

After deletion, encrypted database backups age out within 35 days and email delivery logs within 30. We keep billing records, such as our invoices to you, for seven years, because New Zealand tax law requires it.

Integration credentials are deleted as soon as you disconnect an integration.

14. Your rights

You can ask for a copy of the personal information we hold about you, and ask us to correct it. Email privacy@gosmoko.com. We will respond within 20 working days in New Zealand, or 30 days for requests under the Australian Privacy Principles, and it is free. We may need to confirm who you are first.

You can delete your business yourself in Settings, without going through us. Export first if you want a copy, because afterwards we genuinely cannot get it back.

If one of your customers asks about information your business holds about them in GoSmoko, that request is your business's to answer. You can view, correct, export and delete their records yourself, and we will help if you need it. If a customer contacts us directly, we will pass the request to you.

You do not have to give us your name to ask a general question, but we cannot provide an account without knowing who you are.

15. Complaints

If you are unhappy with how we have handled your information, tell our privacy officer at privacy@gosmoko.com. We will acknowledge your complaint within 5 working days and aim to resolve it within 20 working days.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner in New Zealand (privacy.org.nz), or, in Australia, the Office of the Australian Information Commissioner (oaic.gov.au).

16. Children

GoSmoko is a business tool for adults. It is not meant for anyone under 16, and we do not knowingly collect their information as users.

17. Cookies

We set one strictly necessary cookie, to keep you signed in. We do not use advertising or analytics cookies, and there are no third-party trackers on the website. The phone app uses no cookies. Our Cookies page has the detail.

18. Changes and contact

If we change this policy in a way that materially affects you, we will tell you by email or in the app before it takes effect. The date at the top shows when it last changed.

Privacy questions: privacy@gosmoko.com. Security concerns: security@gosmoko.com (we confirm receipt within two business days). Anything else: hello@gosmoko.com.

This document is written to be read, not to be impenetrable. If anything in it is unclear, email hello@gosmoko.com and we will explain it in plain terms.