Privacy Policy

Lewis Harris Ltd ("we", "us", "our") operates sub.management ("the Service"), a subcontract management platform for New Zealand construction contractors. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Service.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the Service.

We collect the following categories of personal information:

• Account information: Name, email address, job title, and company name provided during registration.
• Company information: Company name, logo, physical address, NZBN, and other details you enter in Company Settings.
• Contract data: Subcontract documents, variations, payment schedules, notices, and other documents you create or upload using the Service.
• Usage data: Information about how you access and use the Service, including IP address, browser type, pages visited, and timestamps.
• Communications: Any messages you send to us via email or the AI Advisor feature.

We use the information we collect to:

• Provide, operate, and maintain the Service;
• Process and store subcontract documents and related data you create;
• Send transactional communications such as account verification and password reset emails;
• Respond to your inquiries and provide customer support;
• Monitor and analyse usage to improve the Service;
• Detect, prevent, and address technical issues and security incidents;
• Comply with legal obligations applicable to Lewis Harris Ltd in New Zealand.

The Service includes an AI Advisor feature powered by Anthropic's Claude API. When you use the AI Advisor, content from your subcontracts and your queries may be transmitted to Anthropic for processing. We do not instruct Anthropic to use your data to train their models. Please refer to Anthropic's Privacy Policy for details on how they handle data.

Do not submit information to the AI Advisor that you are not authorised to share with a third-party service provider.

Your data is stored using Supabase, a cloud database service with infrastructure hosted in the United States. By using the Service, you consent to your data being transferred to and stored in that jurisdiction.

We implement industry-standard security measures including encrypted connections (HTTPS), row-level security policies, and access controls. However, no method of electronic storage is 100% secure, and we cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account.

We retain your personal information and contract data for as long as your account is active or as needed to provide the Service. If you request deletion of your account, we will delete or anonymise your personal information within 30 days, subject to any legal obligations to retain records.

Certain data may be retained in backup systems for up to 90 days following deletion.

We do not sell your personal information. We may share your information with:

• Service providers: Third-party vendors who assist in operating the Service (including Supabase for data storage, Anthropic for AI processing, and Resend for transactional email). These providers are contractually required to protect your information.
• Legal requirements: Where required by New Zealand law, court order, or other legal process.
• Business transfers: In connection with a merger, acquisition, or sale of all or part of Lewis Harris Ltd, subject to confidentiality obligations.

Under the New Zealand Privacy Act 2020, you have the right to:

• Request access to personal information we hold about you;
• Request correction of inaccurate personal information;
• Request deletion of your personal information, subject to legal retention obligations;
• Complain to the Office of the Privacy Commissioner if you believe your privacy rights have been breached.

To exercise these rights, contact us at office@lewisharris.co.nz.

The Service uses session cookies and local storage to maintain your authenticated session. We do not use third-party advertising trackers or analytics cookies. Usage analytics are collected server-side via Supabase logs.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

If you have questions or concerns about this Privacy Policy, please contact Lewis Harris Ltd at: