Privacy Policy

Last updated: 19 August 2026

This policy explains how Refund ("we", "us") handles your personal information, in line with the New Zealand Privacy Act 2020. It sits alongside our Terms of Service.

What we collect

  • Account details:your name, email, and (if you provide it) mobile number.
  • Case information:the notice or claim you're dealing with, your account of what happened, and any documents you upload (photos of notices, receipts, evidence).
  • Correspondence:messages between you, us and the relevant authority for your case.
  • Payment information:handled by our payment processor (Stripe). We don't store your full card number.
  • Identity and vehicle details an authority asks for:the notice number and registration plate, and — only where the authority's own process requires it, such as Waka Kotahi NZTA's form for approving someone to act for you — your date of birth, home address, phone number and driver licence number. We ask you for these at the time; we never make them up.
  • Usage data:basic technical information needed to run and secure the service.

How we use it

  • To run your case: read your notice, prepare submissions, and act for you.
  • To communicate with the relevant council or transport authority on your behalf.
  • To keep you updated (by email, and by text if you opt in).
  • To charge the success fee if we win, and to provide invoices.
  • To read and summarise documents with AI — your notice, and any attachment an authority sends back — and to draft the correspondence we send for you.
  • To improve and secure the service.

Who we share it with

We share your information only as needed to run your case and the service:

  • The relevant authority:the council, transport operator or government agency handling your matter, as part of acting for you.
  • A named individual, where an authority will only deal with a person.Some processes — Waka Kotahi NZTA's "approve someone to act for you" form in particular — will not accept a company. On those, the identity details listed above go to the authority on that form, and the individual named on it can then deal with that authority about your notice. We only do this with your specific authorisation, we name the person when we ask for it, and you can cancel the authority with that authority directly at any time.

We also use service providers that process information on our behalf, under their own safeguards and only for the purpose listed:

  • Supabase:database, sign-in and file storage.
  • Vercel:hosting, and bot detection on public endpoints.
  • Google:if you choose to sign in with a Google account.
  • Anthropic (and OpenRouter as a fallback route to the same model):the AI that reads your notice, reads replies from the authority, and drafts your correspondence.
  • Langfuse:records of those AI steps, which include case content, so we can check the agent's quality.
  • Stripe:payments and invoices. We don't store your full card number.
  • Resend:email we send you, and replies from an authority to your case address.
  • Twilio:text messages, if you opt in to them.
  • Plain:the in-app support chat, if you use it.
  • PostHog:product analytics, so we can see how the service is being used.
  • Sentry:error reports when something breaks.
  • CapSolver:solving the anti-bot check on an authority's own online form where one blocks a lodgement, which involves sending that page's challenge content.

We don't sell your personal information. Your case information is kept private to you. The agent works on one case at a time and does not share one customer's details with another.

Storage & security

Your data is held under access controls, with row-level security so each account can only see its own data. No system is perfectly secure, but we take reasonable steps to protect your information.

Overseas. The providers listed above are based outside New Zealand, and store and process information overseas — principally in the United States and Europe. We only use providers that are subject to privacy safeguards comparable to those in the Privacy Act 2020, or that agree to protect your information in a way that meets it.

Your rights

Under the Privacy Act 2020 you can ask to access or correct the personal information we hold about you, and ask us to delete it (subject to any legal record-keeping we must do). You can edit your profile in your account, or contact us for anything else.

Retention

We keep your case — the notice, your account of what happened, and the correspondence — while the case is open, and afterwards while you have an account with us, so you can go back to what was said and done on your behalf. Billing records are kept for seven years, because tax law requires it. Close your account and ask us to delete your cases and we will, apart from records we are required to keep.

Cookies

We use essential cookies only, to keep you signed in. We don't use advertising cookies.

Contact

For any privacy request or question, email support@refund.co.nz. If you're not satisfied with our response, you can contact the Office of the Privacy Commissioner.

We may update this policy; we'll change the date above for material changes. This policy is governed by the laws of New Zealand.