Privacy Policy

WedgewoodAI Tapui Limited ("WedgewoodAI", "we", "us") is a New Zealand company. This Privacy Policy explains how we handle personal information under the Privacy Act 2020. It applies to wedgewoodai.com and all of our products and sub-domains, including:

• CaddieChat (caddiechat.wedgewoodai.com) — AI golfing companion
• AuraShop (aurashop.wedgewoodai.com) — AI shopping assistant
• AuraKin AI (aurakinai.wedgewoodai.com) — family assistant
• AuraBiz AI — business assistant
• WedgewoodAI Indoor Golf Club
• Footprints & Folios personal websites, and the WedgewoodAI Shop

Together these are the "Services". Please also read our Terms of Service.

Our Privacy Officer is Richard Lemana. You can contact them directly at [email protected] about anything in this policy, including requests to access, correct or delete your information.

3.1 Information you give us

• Contact details — name, email address and message when you use our contact form.
• Consulting enquiries — your name, email address, phone number and organisation (if you provide them), the area you are interested in, and the description of your project when you use the consulting enquiry form. We use this only to respond to your enquiry. It is seen by Richard, and is kept for 12 months then deleted unless it leads to work. It is never added to analytics or advertising.
• Account details — email address, display name and password (stored only as a secure hash), or your Google account name and email if you sign in with Google.
• Orders — name, email, delivery details and what you bought when you use the WedgewoodAI Shop.
• Product data — information you create inside our products, such as golf scores in CaddieChat, shopping preferences in AuraShop, family schedules in AuraKin AI, or business information in AuraBiz AI.

3.2 Information collected automatically

• Log data — IP address, time of access, pages requested and browser type, used for security and troubleshooting.
• Cookies — see section 9.

Some of our Services collect information about people from someone other than that person. For example, a parent may add family members to AuraKin AI, a business may add staff or customers to AuraBiz AI, and a Footprints & Folios site may include stories and photos of family and friends.

In these cases the person entering the information is responsible for having a lawful reason to share it and, where appropriate, for telling the people concerned. We use that information only to provide the relevant Service. If you believe we hold information about you that someone else provided, you can contact our Privacy Officer to access, correct or ask us to delete it. This reflects information privacy principle 3A, added by the Privacy Amendment Act 2025.

• To provide, maintain and improve the Services.
• To manage your account and process payments.
• To respond to enquiries and provide support.
• To send service notices, security alerts and changes to our terms.
• To detect and prevent fraud, abuse and security incidents.
• To meet our legal obligations.

We do not sell, rent or trade your personal information.

Each WedgewoodAI product has its own sign-in. To manage support and security across all products, wedgewoodai.com keeps a central register showing which products you use. That register holds only your email address, display name, the product name, your account status, and the date you registered and were last active.

• We use the register to show you your products in the MyProducts portal, to provide support, and to block an account across products if it is involved in abuse or a security incident.
• The data you create inside a product (for example scores, family details or business records) stays within that product and is not shared with our other products.
• The MyProducts portal on wedgewoodai.com has its own account, which shows the products registered to your email address and any WedgewoodAI Shop orders.

• Hosting — our Services are hosted by Abacus.AI, which stores and processes data on our behalf. Our websites are hosted on the Abacus.AI platform, which loads a small platform script on each page to run and manage the site.
• Payments — Stripe processes website and shop payments. Card details go directly to Stripe. WedgewoodAI never receives or stores your full card number.
• Sign-in and bot protection — if you choose Google Sign-In, Google confirms your identity to us. Cloudflare Turnstile checks that forms are being used by a person.
• AI processing — see section 8.
• Legal reasons — where required by law, or where needed to prevent a serious threat to someone's life, health or safety.

Our hosting provider, Abacus.AI, is based in the United States of America, and your information is stored and processed there. We rely on our contract with Abacus.AI to require it to protect your information and use it only to provide services to us.

When you use an AI feature, the text or files needed for that feature are sent through Abacus.AI to large language models, which may be operated by third-party AI providers, to generate a response. We send only what the feature needs. We are confirming with Abacus.AI which AI providers receive this data and the protections in their contracts, and we will list them here once confirmed.

8.1 Wedge, our AI advisor

Wedge is the AI advisor on wedgewoodai.com. When you ask Wedge a question, your question and Wedge's answer are sent to Anthropic, an AI provider based in the United States of America, to generate the response. This is an overseas disclosure under the Privacy Act 2020; we rely on Anthropic's contractual commitments not to train its models on this data and to protect it.

• We keep your Wedge questions and answers for up to 30 days to monitor quality and prevent abuse, then delete them automatically.
• We store a one-way hashed version of your IP address for rate-limiting and safety — never your actual IP address, and never your name or account details.
• Please do not type personal details (such as your full name, contact details, passwords or card numbers) into Wedge. Wedge is designed to notice and decline these, but the safest course is not to share them.

wedgewoodai.com uses only cookies and browser storage needed for the site to work:

• Sign-in cookies — keep you signed in to the MyProducts portal (7 days) or the admin area.
• Preferences — remember settings such as light or dark mode.
• Security — Cloudflare and Google Sign-In may set cookies needed to protect forms and complete sign-in.

wedgewoodai.com does not show advertising and does not use advertising or tracking cookies. Where a free tier of one of our apps shows ads, that app will explain this and ask for your consent first. We are removing advertising from AuraKin AI, and we never use family, children's, health or wellbeing information for advertising.

• You must be at least 13 to hold an account. Some products set a higher age, stated on the product page.
• Children under 13 can only use our products through a parent or guardian's account, such as a child profile in AuraKin AI.
• Children's information is entered and controlled by the parent or guardian. By adding a child's information, the parent or guardian confirms they are authorised to do so and consents to us using it to provide the Service.
• Parents and guardians can view, correct or delete their child's information at any time by contacting our Privacy Officer at [email protected].
• Children's information is never used for advertising.

AuraKin AI may hold sensitive information, such as health, disability, wellbeing and family details. We collect it only when you choose to enter it, use it only to provide the AuraKin AI service to you and your family, never use it for advertising, and will delete it on request.

• HTTPS encryption for all data in transit, with HTTP Strict Transport Security on all domains.
• Passwords stored only as bcrypt hashes. We cannot see your password.
• Accounts locked temporarily after repeated failed sign-in attempts.
• Two-factor authentication required for all administrator access.
• Sign-in cookies that cannot be read by page scripts and are only sent over HTTPS.
• Access logging and monitoring of security events.

More detail is on our Security page. No system is completely secure, but we work to protect your information and fix issues quickly.

If a privacy breach causes, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and the people affected as soon as practicable.

We may keep information longer only where the law requires it or to resolve a dispute that is under way.

Under the Privacy Act 2020 you can:

• Access the personal information we hold about you.
• Correct information that is wrong or out of date.
• Ask us to delete your information, subject to legal requirements such as tax records.
• Complain to the Office of the Privacy Commissioner at privacy.org.nz if you are unhappy with how we have handled your information.

Send requests to [email protected]. We will respond within 20 working days, as the Privacy Act requires. We may need to confirm your identity first.

We may update this policy from time to time. We will update the "Last updated" date and, for significant changes, tell account holders by email or with a notice on our website.