ArrowFlow
    Log inStart a Free Trial

    Privacy Policy

    How we handle and protect your data.

    Last updated: 6 June 2026

    This Privacy Policy explains how ARROWFLOW collects, uses, stores and protects personal information.

    In this policy, “ARROWFLOW”, “we”, “us” and “our” means ArrowFlow, the operator of the ARROWFLOW website and CRM services.

    We are committed to handling personal information carefully, fairly and in accordance with the Privacy Act 2020.

    1. What this policy covers

    This policy applies when you:

    • visit our website
    • contact us
    • book a demo or consultation
    • sign up for ARROWFLOW
    • use our CRM, marketing, sales, automation, document, review, messaging or AI features
    • receive communications from us
    • interact with one of our customers through ARROWFLOW-powered forms, emails, SMS messages, calls, bookings, landing pages or other tools

    2. Personal information we collect

    We may collect personal information such as:

    • name
    • business name
    • job title
    • email address
    • phone number
    • billing details
    • account login details
    • enquiry details
    • demo or sales information
    • website usage information
    • support requests and correspondence
    • CRM usage information
    • customer, lead, contact or communication data entered into ARROWFLOW
    • documents, contracts or forms submitted through ARROWFLOW
    • call, SMS, email, chat, booking and message history where those features are used

    We only collect information where it is reasonably necessary for our business, our website, or the services we provide.

    3. Information our customers add to ARROWFLOW

    ARROWFLOW is a CRM platform.

    This means our customers may upload, store or collect personal information about their own leads, customers, staff, suppliers or contacts.

    Where a business uses ARROWFLOW to manage its own contacts, campaigns, leads, sales activity or customer communication, that business is generally responsible for making sure it has the right privacy notices, permissions and processes in place.

    This includes responsibility for:

    • collecting customer information lawfully
    • telling people how their information will be used
    • sending marketing emails or SMS messages only where permitted
    • managing unsubscribe requests
    • using call recording, AI tools or automated messaging appropriately
    • responding to access or correction requests from their own customers
    • ensuring the information they add to ARROWFLOW is accurate and appropriate

    We may assist our customers with these obligations where required.

    4. How we collect personal information

    We may collect personal information:

    • directly from you
    • when you complete a form on our website
    • when you book a demo or contact us
    • when you sign up for or use ARROWFLOW
    • when you communicate with us by email, phone, SMS, chat or social media
    • when you use ARROWFLOW features
    • from our customers, where they use ARROWFLOW to manage their own contacts or leads
    • from third-party tools we use to operate, secure, analyse or improve our website and services

    Where we collect personal information from someone other than the individual concerned, we will take reasonable steps to ensure the individual is aware of the collection where required by law.

    5. How we use personal information

    We may use personal information to:

    • provide and operate ARROWFLOW
    • create and manage customer accounts
    • respond to enquiries
    • provide demos, onboarding, support and training
    • process subscriptions, invoices and payments
    • deliver CRM, marketing, sales, automation and communication features
    • send service updates and important account messages
    • send marketing communications where permitted
    • improve our website, platform and services
    • monitor platform performance and security
    • troubleshoot technical issues
    • personalise user experience
    • comply with legal obligations
    • protect our rights, customers, users and systems

    We do not sell personal information.

    6. Email, SMS and marketing communications

    We may send marketing communications to people who have contacted us, signed up, requested information, or otherwise agreed to hear from us.

    You can unsubscribe from marketing emails using the unsubscribe link in the email.

    For SMS or other electronic messages, we will provide a clear way to opt out where required.

    New Zealand commercial electronic messages generally require consent, accurate sender information and a functioning unsubscribe facility.

    7. AI features and add-ons

    ARROWFLOW may offer optional AI features and add-ons.

    These may help with tasks such as:

    • answering calls
    • summarising calls
    • responding to website chat
    • drafting SMS or email replies
    • qualifying leads
    • booking appointments
    • writing emails, social posts or website copy
    • summarising reviews, customer activity or marketing performance

    Where AI features are enabled, information may be processed by AI service providers for the purpose of delivering those features.

    Customers are responsible for ensuring they use AI features appropriately, including making any required disclosures to their own customers, staff or contacts.

    8. Cookies and website tracking

    Our website may use cookies and similar technologies to:

    • make the website work properly
    • understand website traffic
    • improve website performance
    • measure marketing activity
    • support advertising and remarketing

    You can control cookies through your browser settings. Some website features may not work properly if cookies are disabled.

    9. Who we may share information with

    We may share personal information with trusted third parties where reasonably necessary to operate our business and provide ARROWFLOW.

    This may include:

    • CRM platform and hosting providers
    • email, SMS, phone and messaging providers
    • payment and billing providers
    • analytics and reporting tools
    • AI service providers where AI features are used
    • support, technical and implementation partners
    • professional advisers
    • legal, regulatory or government authorities where required
    • a potential buyer or investor if our business is sold, merged or restructured

    We require service providers to handle personal information appropriately and only for authorised purposes.

    10. Overseas storage and processing

    Some personal information may be stored or processed outside New Zealand by our technology providers.

    Where this happens, we take reasonable steps to ensure personal information is protected appropriately.

    This may include using reputable providers, contractual protections, access controls and other safeguards.

    11. How we protect personal information

    We take reasonable steps to protect personal information from loss, unauthorised access, misuse, disclosure, alteration or destruction.

    These steps may include:

    • account access controls
    • secure platform access
    • staff and contractor access restrictions
    • password and authentication controls
    • data backup and recovery processes
    • monitoring and security practices
    • limiting access to information where it is not required

    No system is completely secure, but we take privacy and data protection seriously.

    12. How long we keep personal information

    We keep personal information only for as long as reasonably required for the purposes it was collected, including to:

    • provide ARROWFLOW
    • manage customer accounts
    • meet legal, tax, accounting and reporting obligations
    • resolve disputes
    • enforce agreements
    • maintain security and business records

    Where an ARROWFLOW customer closes their account, we may retain information for a reasonable period to allow account recovery, meet legal obligations, maintain backups, or resolve outstanding matters.

    13. Accessing or correcting your information

    You have the right to ask whether we hold personal information about you and to request access to that information. You also have the right to ask us to correct it if you believe it is wrong, incomplete or out of date.

    To make a request, contact us using the details below.

    We may need to verify your identity before responding.

    If your information is held by one of our customers through their use of ARROWFLOW, we may refer your request to that customer or work with them to respond.

    14. Privacy breaches

    If we become aware of a privacy breach, we will assess it and take appropriate steps to contain, investigate and respond to it.

    Where a breach is notifiable under the Privacy Act 2020, we will notify the Privacy Commissioner and affected individuals as required.

    15. Your responsibilities when using ARROWFLOW

    If you use ARROWFLOW for your own business, you are responsible for how you collect, use and communicate with your own leads, customers and contacts.

    You should make sure you have appropriate privacy notices, consent processes and internal procedures in place.

    This is especially important if you use ARROWFLOW for:

    • email marketing
    • SMS marketing
    • automated follow-up
    • call recording
    • AI replies or summaries
    • customer review requests
    • document signing
    • website forms
    • lead capture
    • customer databases

    16. Changes to this policy

    We may update this Privacy Policy from time to time.

    The latest version will always be available on our website.

    If we make material changes, we may take reasonable steps to notify affected customers or users.

    17. Contact us

    If you have any questions about this Privacy Policy, or if you want to access or correct your personal information, contact:

    Privacy Officer
    ARROWFLOW
    Email: privacy@arrowflow.co.nz