Privacy Policy

1. Introduction

This Privacy Policy explains how Homefree collects, uses, stores, and shares your personal information when you use the Homefree web platform at https://www.homefree.co.nz and the Homefree mobile application (collectively, the “Service”).

We are committed to complying with the New Zealand Privacy Act 2020 and its Information Privacy Principles. This policy does not limit or exclude any of your rights under the Act. For more information about the Act, see www.privacy.org.nz. If you have questions or concerns, contact our Privacy Officer (see section 14).

2. Information We Collect

2.1 Information You Provide

• Account registration: Email address and password.
• Profile information: First name, middle names, last name, preferred name, mobile phone number, and date of birth.
• Advisor business information: Business email, phone, website, company name, logo, and profile photo.
• Financial information: Loan details (account numbers, amounts, terms, interest rates, payment structures), loan balances, property addresses, property title numbers, property valuations, and related financial data.
• Property addresses: Entered via an address search feature powered by Mapbox and stored as structured location data.

2.2 Information Collected Automatically

• Authentication data: Session tokens, login timestamps, and authentication state.
• Usage analytics: Page views, session duration, feature usage, and user-linked events via Amplitude.
• Error reports: Technical details of errors and performance via Sentry, filtered to remove personal details (see section 11).
• Session recordings: Masked recordings of about 10% of sessions, and of sessions where errors occur, via Sentry. On-screen content is not captured (see section 11).
• Cookies: Authentication session cookies, a UI preference cookie for sidebar state (7-day duration), and analytics cookies.
• Device information (mobile): Device type, operating system, and app version.

2.3 Information From Third Parties

• Your advisor: If you are a client, your advisor may enter or update your profile and financial information on your behalf.
• Trail CRM: Where your advisor uses Trail and connects it to Homefree, we receive your contact details and lending details from your advisor’s Trail account. See section 6.
• Mapbox: Geocoded address data returned when you search for a property address.

3. Third-Party Collection of Information

3.1 Advisors and client data

Homefree provides software to mortgage and financial advisors and their clients. Advisors may enter, import, and update information about their clients in the Service, including from Trail CRM.

For client information entered or imported by an advisor, Homefree holds and processes that information on the advisor’s behalf to provide the Service. The advisor (and/or their advice business) is responsible for:

• having the appropriate authority to collect, enter, and use their client’s information;
• giving any notices required under Information Privacy Principle 3A when they collect information about a client from someone other than that client; and
• how they use that information, including any outputs they take from the Service (see section 5.1).

3.2 Notifying you

Where we collect your personal information from someone other than you, we will take reasonable steps to notify you that we have collected your personal information, the purpose of the collection, the intended recipients of the information, the name and address of the agency collecting and holding the information, whether the collection is authorised or required by law and, if so, the law that authorises or requires the collection, and your right to access and request correction of that information, unless an exception applies under the Privacy Act 2020.

The agency collecting and holding your information is Homefree Group Limited, 4B Quail Close, Alexandra.

4. How We Use Your Information

5. How We Share Your Information

5.1 With Your Advisor (for Clients)

When you are a member of a household, your assigned advisor can view, add, edit, and update your profile information and all financial data within your household, including loans, properties, valuations, balances, and the audit trail of changes. This sharing is based on your household membership and the advisor authority consent you provide.

Your advisor may also use information and outputs from the Service, such as reports, calculations, and exported data, in providing advice and services to you. Once your advisor takes information out of the Service, their use of it is governed by their own privacy policy, and they are responsible for it.

5.2 With Household Members

Other members of the same household can see your basic profile information and shared financial data within the household.

5.3 With Platform Administrators

Platform administrators have access to all data for operational and support purposes.

5.4 With Third-Party Service Providers

5.5 Where Required by Law

We may disclose your personal information to regulatory agencies, law enforcement, courts, and tribunals where we are required or permitted to do so by law.

5.6 We Do Not Sell Your Data

We do not sell, rent, or trade your personal information to third parties.

6. Trail CRM Integration

Advisors who use Trail CRM can connect their Trail account to Homefree to import client information.

The import only happens when an advisor connects their own Trail account and chooses to import. The advisor is responsible for having authority to transfer their clients’ information from Trail to Homefree (see section 3.1). Trail’s handling of information is covered by Trail’s privacy policy.

Currently, information flows one way, from Trail into Homefree. If we introduce a two-way sync, where Homefree also sends information back to Trail, we will update this section and notify you as described in section 13.

7. Data Security

We implement appropriate technical and organisational measures to protect your information, including:

• Database access controls: All database tables enforce Row-Level Security (RLS), complemented by server-side authorisation checks, so users can only access data they are authorised to see.
• Role-based access control: Granular permissions for admin, advisor, and client roles.
• Protected fields: Sensitive fields like admin status and user type are protected by database-level triggers to prevent unauthorised changes.
• Encryption: All data is encrypted in transit using TLS (HTTPS) and encrypted at rest using AES-256 by our infrastructure providers. Sensitive credentials, such as third-party API keys, are additionally encrypted at the application level.
• Session management: JWT-based authentication with short-lived access tokens and refresh-token rotation.
• Audit trail: Changes to client financial records are logged to an audit trail that users cannot modify or delete.

8. Data Retention

• Account data: Retained while your account is active. When you delete your account, your personal and financial data is deleted. Related records are removed automatically.
• Audit trail: Audit records are retained for seven years from the date of the change for regulatory compliance and security purposes, and are then deleted. When a user account is deleted, its audit entries are kept for the remainder of that period with the user reference anonymised.
• Error monitoring data: Deleted after 90 days (see section 11).
• Analytics data: Subject to Amplitude’s data retention policies.
• Session recordings: Deleted after 90 days (see section 11).

9. Your Rights

Under the New Zealand Privacy Act 2020, you have the right to:

• Access the personal information we hold about you (Information Privacy Principle 6).
• Correct any inaccurate personal information (Information Privacy Principle 7).
• Know what information is held about you and why.
• Request deletion of your account and associated data.
• Withdraw consent for advisor authority at any time.
• Complain to the Office of the Privacy Commissioner if you are unsatisfied with our handling of your information.

To exercise any of these rights, contact our Privacy Officer (see section 14).

10. International Users

Homefree primarily serves users in New Zealand. If you access the Service from outside New Zealand, please be aware that your data may be transferred to, stored, and processed in countries other than your own, including the United States, where several of our third-party service providers are located.

If you are located in the European Union or United Kingdom, we process your data on the basis of contractual necessity, consent, or legitimate interest. You may have additional rights under the General Data Protection Regulation (GDPR), including the right to erasure, data portability, and the right to object to processing.

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including the right to know, delete, and opt-out of the sale of personal information. We do not sell personal information.

11. Cookies and Tracking

Essential Cookies

Analytics Cookies

We use Amplitude for product analytics on the web platform. Amplitude may set cookies to track usage patterns and session data. On the mobile app, analytics cookies are disabled; device-level identifiers are used instead.

Error Monitoring and Session Replay (Sentry)

We use Sentry, a third-party error-monitoring service, to find and fix problems in the Homefree web platform and mobile app.

Session replay. We record about 10% of sessions, and every session where an error occurs. All on-screen text, form inputs and images are masked on your browser or device before anything is sent. Recordings show screen layouts and your interactions (clicks, scrolling, page changes), not content such as names, addresses, account details or loan figures. They also include the page addresses (URLs) you visited, browser or device details, and the address, status and timing of requests the app made, but not their contents.

Error reports. When an error occurs, we send Sentry the error message, where in our code it happened, the steps leading up to it, and your user account identifier. We do not send your name, email address, IP address or cookies. Reports are filtered before sending to remove details such as email addresses, phone numbers, bank account and IRD numbers, and authentication tokens. Error messages are generated automatically, so we cannot guarantee they never contain personal information, but we design our systems to keep it out.

Storage and retention. Sentry stores this data in the United States on our behalf and may use it only to provide its service to us. Recordings and error reports are deleted after 90 days. Only Homefree staff who maintain the Service can access them.

Managing Cookies

You can control cookies through your browser settings. Disabling essential cookies may prevent the Service from functioning correctly. Uninstalling the mobile app removes all locally stored data.

12. Children’s Privacy

The Service is not directed at children under 16 years of age. You must be at least 18 to create an account. If we become aware that we have collected personal information from a child under 16, we will delete that information promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy. Previous versions are available upon request.

14. Contact

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact our Privacy Officer:

• Privacy Officer: Gareth Jenkins, gareth@homefree.co.nz
• Support: support@homefree.co.nz
• General enquiries: contact@homefree.co.nz