Conflow is online software for New Zealand civil and construction businesses. It is used for estimating, tendering, projects, forecasting and progress claims. Conflow is run by 3 Sixty One Limited ("361", "we", "us"), a New Zealand company (company number 8505168, NZBN 9429050929252), of Hopetoun Residences, 15 Hopetoun Street, Freemans Bay, Auckland 1011, New Zealand.
This policy explains what personal information we collect, why, where it is kept, who we share it with, and your rights under the New Zealand Privacy Act 2020. We wrote it in plain English. If anything is unclear, email us at support@3sixtyone.co.
The short version
- The work data a business puts into Conflow belongs to that business. We hold it for them, and we only use it to run Conflow for them.
- We collect only what we need to sign you in, run the service, keep it secure and send you account emails.
- Conflow's servers and database are in Microsoft Azure's New Zealand North (Auckland) region.
- We do not sell personal information. We do not use advertising or tracking cookies, and Conflow has no product analytics switched on.
- You can ask to see or correct the personal information we hold about you.
1. Two kinds of information, two roles
Business data (we act for the business). Businesses that use Conflow ("customers") put their own work into it: estimates, tenders, rates, price books, projects, costs, claims, files, and the names and contact details of their staff, clients, suppliers and subcontractors. The customer decides what goes in and what it is used for. 361 holds and processes this data only on the customer's behalf. We hold it for them, like a storage company holds goods for its owner. The Privacy Act 2020 calls this acting as the customer's agent (section 11). We do not use it for our own purposes.
If your personal information is in a customer's Conflow account (for example, you are a subcontractor named in a tender) and you have a question about it, please contact that business first. They are responsible for it. We will help them answer you.
Account and service information (we decide). We are responsible for the information we collect to run, secure and bill Conflow itself: who has an account, how people sign in, sign-in and security records, account emails, and our business relationship with customers (contracts, invoices, support). This is our own information, also when you use Conflow as a member of a customer's team. The audit history of changes inside a customer's account is part of that customer's business data. The rest of this policy is mostly about our own information.
2. What we collect and why
| What | Why | Where it comes from |
|---|---|---|
| Name, work email address, role in the business | To create your account, sign you in, show who did what, and send you invitations and password resets | Usually from your employer's Conflow administrator, who invites you; sometimes from you |
| Optional profile details (job title, mobile, location, manager name) | So your colleagues can see who you are inside your business's Conflow | You or your administrator |
| Password (only if your business uses password sign-in) | To sign you in. We store only a scrambled one-way "hash", never the password itself | You |
| Microsoft 365 or Google Workspace sign-in details (if your business uses them) | To sign you in with your work account. We receive only your name, email address and an account ID. We do not receive your password, mailbox, files or contacts | Microsoft or Google, when you choose to sign in that way |
| Sign-in and security records: date and time of sign-ins, IP address, browser type (user agent) and active sessions | To keep accounts secure, detect misuse and fix problems | Automatically, when you use Conflow |
| Audit log: a record of important changes in a business's account and who made them (with IP address and browser type) | So the business can see who did what. This is part of the business's data | Automatically, when you use Conflow |
| Technical logs and error reports (for example, a request that failed and the time it happened) | To keep Conflow working, find faults, and measure performance | Automatically, from our servers and from your browser when an error happens |
| AI connection records (only if your business turns on Conflow AI and you connect an AI app) | To show which AI app is connected to your account, and to let you or your administrator remove it | Automatically, when you connect |
| Customer contact and billing details (business name, contact person, email, phone, postal address) | To agree contracts, send invoices and keep tax records | The customer |
| Emails and messages you send us | To answer you and keep a record of support requests | You |
| Website enquiries: what you type into the contact or demo form on www.conflow.3sixtyone.co (for example your name, company, email, phone, role, details about your company and work, a message, and an optional voice note you record) | To reply to you, arrange a demo and prepare a price | You |
We do not knowingly collect sensitive information such as health information, and Conflow is not designed for it. Please do not put it in Conflow.
No law requires you to give us this information. If you do not give us your name and work email address, we cannot create a Conflow account for you.
When someone else gives us your information. Most Conflow users are invited by their employer's administrator, so we receive your name and email address from them. This policy, the invitation email and the sign-in pages are how we tell you about that collection (Information Privacy Principle 3A).
3. Cookies and browser storage
Conflow uses only the cookies it needs to work:
- Sign-in cookies that keep you signed in and protect your session, and a security cookie that protects forms against cross-site request forgery.
- Short-lived cookies used during Microsoft or Google sign-in.
Conflow also saves some screen preferences (for example, column widths and the last view you used) in your browser's local storage, so the screens open the way you left them. This stays on your device.
We do not use advertising cookies, cross-site tracking, or product analytics in Conflow or on the Conflow website. The website uses no cookies and loads no third-party scripts or fonts.
4. Who we share personal information with
We do not sell or rent personal information. We share it only with:
Service providers who help us run Conflow. They process information only on our instructions and must keep it secure.
| Provider | What they do | Where the data is |
|---|---|---|
| Microsoft Azure (Microsoft) | Hosts the Conflow servers, database, file storage, backups, secret keys and logs | New Zealand North (Auckland) |
| Microsoft Azure Static Web Apps | Delivers the Conflow web page files (the app's code, styles and images) and the Conflow website to your browser. It passes requests for 361's super admin pages through to our servers in New Zealand. It also receives the website contact and demo forms and passes them to SMTP2GO to email to us; it does not store them | East Asia (Hong Kong) region. Your business's work data does not pass through it: the Conflow app talks directly to our servers in New Zealand |
| SMTP2GO | Sends invitation and password-reset emails, and emails website form messages to us. It keeps the sender, recipient, subject, time and delivery status for about 35 days. Email archiving is off, so it does not keep the email text | Australia |
| Google Workspace | 361's own email: support emails you send us, and the website form messages we receive | United States and other countries |
| Xero | 361's accounting system, for customer invoices | United States and other countries |
Microsoft and Google, when you sign in with them. If your business uses Microsoft 365 or Google Workspace sign-in, Microsoft or Google learns that you signed in to Conflow. Their own privacy policies apply to that.
AI apps that your business chooses to connect. Conflow AI is off for every new business, and Conflow AI cannot be turned on yet. When it is available and your business administrator turns it on, a user can connect their own AI app account (currently Anthropic's Claude, OpenAI's ChatGPT, or a compatible app running on the user's own computer) to Conflow. The AI app can then read, and with the user's approval change, the business's Conflow data that the user is allowed to see. That data goes to the AI provider the user chose, under the user's or business's own agreement with that provider. 361 does not send Conflow data to any AI provider itself, and we do not use Conflow data to train AI.
When the law requires it. We may disclose information if a New Zealand law, court order or lawful request requires it, or to prevent a serious threat to someone's life, health or safety. Where the law allows, we will tell the affected customer first.
If 361 or Conflow is sold or restructured. Information may pass to the new owner, who must keep protecting it under this policy. We will tell customers before that happens, where we are allowed to.
361 staff. A small number of 361 staff run Conflow. Our "super admin" tools show only a business's name, its people (name, email, role, last sign-in), sign-in settings and invitations, not the business's work data. Our engineers can technically reach the database to run and repair the service. They look at a customer's work data only when the customer asks for help, when it is needed to fix a fault or keep the service secure, or when the law requires it.
5. Storing information outside New Zealand
Most information stays in New Zealand. Some information is held in, or passes through, other countries:
- Hong Kong (Microsoft Azure Static Web Apps): web page files, super admin requests, and website form messages on their way to us.
- Australia (SMTP2GO): invitation, password-reset and website form emails.
- United States and other countries (Google Workspace and Xero): 361's own email and accounting.
These providers act for us and do not use the information for their own purposes. We choose providers with strong security, and we stay responsible for the information they hold for us.
6. How we keep information secure
- All connections to Conflow are encrypted (HTTPS/TLS). Data in the database, file storage and backups is encrypted at rest by Microsoft Azure.
- Passwords are stored only as one-way hashes. Secret keys are kept in Azure Key Vault.
- The database requires an encrypted connection and a password, and accepts connections only from inside Microsoft Azure. Each business's data is kept separate from other businesses' data inside Conflow, and the software checks every request against the user's business and permissions.
- Sign-in sessions time out after a period of no activity.
- Only a small number of 361 staff can reach production systems.
No system is perfectly secure. If a privacy breach is likely to cause someone serious harm, we will tell the affected customers and people, and the Office of the Privacy Commissioner, as soon as practicable, as the Privacy Act 2020 requires. For business data we hold for a customer, we will tell the customer without undue delay (and within 72 hours) and help them meet their own duties.
7. How long we keep information
| Information | How long |
|---|---|
| Account details | While the account is active |
| Business data | While the customer's subscription is active, then 30 days for the customer to export it, then deleted from the live system within 60 days |
| Database backups | Automatic backups for 35 days (never later than 90 days). Deleted data leaves the backups when they expire |
| Deleted files | Recoverable for 14 days, then removed |
| Server logs and error reports | 30 days |
| Sessions and sign-in records | Up to 12 months |
| Audit log | Kept with the business's data for as long as the business keeps its account (the business needs to know who did what, also after a person leaves) |
| Contracts, invoices and tax records | 7 years, as New Zealand tax law requires |
| Support emails and website enquiries | 2 years after the last contact |
8. Your rights
Under the Privacy Act 2020 you can:
- ask for a copy of the personal information we hold about you (Information Privacy Principle 6), and
- ask us to correct it if it is wrong (Information Privacy Principle 7). If we do not agree to correct it, you can ask us to attach a statement of the correction you asked for.
Many details can be changed by you or your business administrator inside Conflow. For anything else, email support@3sixtyone.co. We may need to check who you are before we answer. We will answer within 20 working days, as the Act requires. There is no charge.
If your information is part of a customer's business data, we will pass your request to that customer and help them answer.
Complaints. If you have a concern, please tell us first and we will try to fix it. If you are not satisfied, you can complain to the Office of the Privacy Commissioner at privacy.org.nz or on 0800 803 909.
9. Changes to this policy
We may update this policy when Conflow or the law changes. We will change the date at the top, and tell customer administrators by email about any important change before it takes effect.
10. Contact us
Privacy Officer, 3 Sixty One Limited, support@3sixtyone.co, Hopetoun Residences, 15 Hopetoun Street, Freemans Bay, Auckland 1011, New Zealand.
Structure based on the NZ Office of the Privacy Commissioner's Priv-o-matic guidance (Information Privacy Principle 3). Parts of the wording are adapted from the 37signals (Basecamp) policies, https://github.com/basecamp/policies, used under the Creative Commons Attribution 4.0 licence (CC BY 4.0, https://creativecommons.org/licenses/by/4.0/). Changes were made.