Privacy policy.

What Bob collects, why, who it’s shared with, and how to access or delete it. Bob is run by NZWE, Inc., a Delaware corporation in the United States. We follow the New Zealand Privacy Act 2020 and the Australian Privacy Principles.

What we collect

• Account details: name, email and sign-in methods.
• What you choose to save: comparisons, household details and uploaded policies.
• Messages you send to advisers through Bob.
• Usage data, such as pages viewed, to keep the service working.

What we don’t do

• We don’t sell personal information.
• We don’t share your details with an adviser or insurer unless you choose to, item by item.
• Uploaded policies are never added to the open data.

Who we share it with

Only the people you choose, through the consent screen, and the service providers who host and secure Bob. Every share is recorded in My Bob, where you can withdraw it.

Where it’s stored

Your information is stored in the United States, in the US West (Oregon) region, encrypted in transit and at rest. That includes information from people in New Zealand and Australia.

Sending information overseas

Bob is run from the United States, so personal information from New Zealand and Australia is sent to and kept there. Under New Zealand law this is a disclosure overseas (Information Privacy Principle 12 of the Privacy Act 2020). Under Australian law it is a cross-border disclosure (Australian Privacy Principle 8).

Before we send it, we take reasonable steps to make sure it is protected in a way that is comparable to the protection you have at home. Every provider that handles it is bound by a contract that limits what they can do with it and requires them to keep it secure. We stay accountable to you for how they handle it.

Service providers

These companies host and run Bob for us. They only use your information to provide their service to us.

• Netlify: hosts the website. United States.
• Supabase: database and sign-in. United States, US West (Oregon).
• Amazon Web Services: infrastructure, and AI features through Amazon Bedrock when they launch. United States, US West (Oregon).
• GitHub: stores Bob’s source code. United States.
• Sentry: error monitoring. United States.
• Infisical: keeps our system passwords and keys secret. United States.
• Resend: sends email. United States.
• Cloudflare: runs our domain name system, protects the site from attacks and counts visits without cookies. A United States company; your request is handled at the nearest of its data centres.
• Google Workspace: our company email, including anything you send to an @bob.so address. United States.

Your rights

• See and export everything we hold, from account settings.
• Correct anything that’s wrong.
• Delete your account. Uploads and personal data are removed within 30 days.

Contact

NZWE, Inc. is responsible for your information. Email [email protected]. If you’re not satisfied with our response, you can contact the Office of the Privacy Commissioner (NZ) or the Office of the Australian Information Commissioner.