Privacy Policy

Effective 1 November 2026 · Version 1.0

This policy explains how MySentinel Limited collects, uses, shares, protects, keeps and deletes personal information. It covers the MySentinel mobile apps for iOS and Android, the MySentinel web dashboard, our monitoring devices and alarm calls, and this website (together, the “Service”).

1. Who we are

The Service is provided by MySentinel Limited, a company registered in New Zealand (company number 8109007, NZBN 9429048597395). Our registered office is 273 Arapaepae South Road, RD 1, Levin 5571, New Zealand. MySentinel Limited is the developer of the MySentinel apps on the Apple App Store and Google Play, and is responsible for your personal information under the New Zealand Privacy Act 2020.

We comply with the Privacy Act 2020 (New Zealand), including the Information Privacy Principles. Where we provide the Service to customers in Australia, we also handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

2. Privacy Officer and contact

• Privacy Officer: Lance Hastie, Director
• Email: [email protected]
• Phone: 0800 269 383
• Post: Privacy Officer, MySentinel Limited, 273 Arapaepae South Road, RD 1, Levin 5571, New Zealand

We acknowledge privacy requests within 5 working days and respond in full within 20 working days, as the Privacy Act 2020 requires.

3. Information we collect

3.1 Information you or your organisation give us

• Account details: name, email address, mobile phone number, your role, and the company and sites you belong to.
• Sign-in credentials: your password is stored only as a one-way cryptographic hash. We cannot read it.
• Alarm contact list: names, phone numbers and call order of the people who should be called when an alarm occurs.
• Site and asset details: farm, shed, coolstore or hayshed names, addresses or locations, equipment, alarm thresholds and settings.
• Billing details: billing contact, invoice address and payment history. We do not collect or store card numbers in the apps.
• Support communications: messages, emails, call notes and anything you choose to send us.

3.2 Information our devices and the Service generate

• Sensor and device data: temperature, humidity, power status, digital input states, air-quality readings, battery level, signal strength, device identifiers and firmware version. This data describes your sites and equipment, not you personally. Where it can be linked to an identifiable person, we treat it as personal information.
• Alarm and call records: alarm events, which numbers were called, call times, call outcomes and who acknowledged each alarm.
• Activity records: changes made to settings, rules and devices, the user who made them and when. This is kept as an audit trail so alarm configuration can be traced and recovered.

3.3 Information collected from your phone when you use the app

• Push notification token: if you allow notifications, a token from Apple or Google so we can send alarm notifications to your device. Notifications are optional. You can still use the app without them.
• App diagnostics: crash reports and basic technical information (device model, operating system version, app version) used only to find and fix faults. These are not used to identify you or for marketing.
• Camera (optional): if you choose to scan a device QR code during setup, the image is processed on your phone to read the code. We do not store or upload the image.

The app does not access your contacts, photos, microphone, health data or precise location. It does not collect an advertising identifier or track your activity across other companies’ apps or websites.

3.4 Information from this website

• Contact form: the name, email, phone and message you submit.
• Spam protection: our forms use Google reCAPTCHA, which processes technical information about your browser to tell people from bots.
• Website analytics: we use Google Analytics to see, in aggregate, how visitors use this website (pages viewed, approximate region, device type). Analytics run on the website only, not in the apps.

3.5 Information about other people

Customers often add other people to the Service, such as staff, farm managers or family members on the alarm contact list. If you add someone, please make sure they know you have done so and point them to this policy. Under the Privacy Act 2020 (IPP3A), when we collect someone’s details from another person, we also tell that person directly. We do this by text or email when they are first added, and we tell them how to be removed.

4. How we use information

Purpose	Information used
Monitor your sites and show readings in the app and dashboard	Sensor and device data, site details, account details
Raise alarms and make automated voice calls, texts and notifications until someone acknowledges	Alarm contact list, alarm and call records, push token
Sign you in, keep your account secure and control who can see each site	Account details, credentials, activity records
Provide support, diagnose faults and improve reliability	Device data, app diagnostics, support communications
Bill for the Service and keep financial records	Billing details
Send important service notices (outages, security, changes to this policy)	Email address, phone number
Answer website enquiries	Contact form details
Meet legal obligations and respond to lawful requests	Any information required by law

We use information only for the purpose it was collected for, or a directly related purpose. We ask for your permission before using it for anything new. We send marketing only if you have opted in, and every marketing message includes a way to unsubscribe. Service notices about alarms and security are not marketing.

We do not make automated decisions about you that have legal or similarly significant effects. Alarms are triggered by thresholds that you or your organisation set.

5. Who we share information with

We do not sell, rent or trade personal information. We share it only with service providers who help us run the Service, and only what they need for their task:

Provider	What they do	Location
Amazon Web Services	Cloud hosting, data storage, sign-in, and automated alarm calls and texts	Australia, Singapore and the United States
emnify GmbH	Cellular connectivity for our monitoring devices (device data only)	Germany and the European Union
Apple and Google	Delivering push notifications to your phone, and app distribution	United States
Xero	Invoicing and accounting	New Zealand, Australia and the United States
SuiteDash	Customer records and support	United States
Google (website only)	Website analytics and reCAPTCHA spam protection	United States

Every provider is bound by contract or published terms to protect personal information to the same or an equal standard as this policy, to use it only to provide services to us, and to delete or return it when the service ends. We also share information:

• within your own organisation, with the users your organisation has given access to a site;
• with your installer or integration partner, but only where your organisation has authorised it;
• with professional advisers (such as our accountant or lawyer) under a duty of confidence;
• with a buyer or successor, if MySentinel’s business is sold or restructured, on the condition that this policy continues to apply; and
• where the law requires it, or where it is needed to prevent a serious threat to someone’s life, health or safety.

6. Storing information outside New Zealand

Some of our providers store or process information outside New Zealand, in the locations listed above. Before we send personal information overseas, we take reasonable steps to make sure it is protected in a way that, overall, is comparable to the Privacy Act 2020 (Information Privacy Principle 12). We do this through contractual protections, and by choosing providers subject to comparable privacy laws such as the Australian Privacy Act and the EU General Data Protection Regulation.

7. How we protect information

• All data travelling between the app, the dashboard, our devices and our servers is encrypted in transit (TLS).
• Data is encrypted at rest in our cloud databases and backups.
• Passwords are stored as one-way hashes, never in readable form.
• Access is role-based: each user sees only the companies and sites they are authorised for. Staff access is limited to people who need it for support, and is logged.
• Our devices use private cellular connections that do not expose them to the public internet.
• Changes to alarm settings are recorded in an audit trail, and deleted settings can be recovered for a limited period so that a mistake cannot silently disable an alarm.
• We apply security updates promptly and review access regularly.

If a privacy breach is likely to cause anyone serious harm, we will notify the affected people and the Office of the Privacy Commissioner as soon as practicable, as the Privacy Act 2020 requires. For Australian customers, we follow the Notifiable Data Breaches scheme.

8. How long we keep information

Information	How long we keep it
Your user account and profile	While your account is active. Deleted within 30 days of you deleting your account.
Alarm contact entries	Until removed by you, your organisation or the contact. Deleted within 30 days of removal.
Push notification tokens	Until you sign out, turn off notifications or delete the app or account.
Sensor readings, alarm history and call records	For as long as your organisation is a customer. Growers often need a long-term record for compliance, insurance and audits, so this history stays available while the subscription continues. Deleted or anonymised within 90 days of your organisation asking us to, or of the subscription ending, unless it asks us to keep or export it.
Audit trail of setting changes	For as long as your organisation is a customer. Records naming a deleted user are anonymised within 30 days.
Recovery copies of changed or deleted settings	7 days
App crash diagnostics	Up to 90 days
Invoices and financial records	7 years, as New Zealand tax law requires
Website enquiries	Up to 2 years after the last contact
Encrypted backups	Overwritten on a rolling cycle of up to 35 days

9. Your rights and choices

Whether you are in New Zealand, Australia or elsewhere, you can:

• Access the personal information we hold about you.
• Correct information that is wrong or out of date. Most details can be changed directly in the app.
• Export your information, and your organisation’s site data, in a common machine-readable format.
• Delete your account and personal information (see section 10).
• Withdraw consent at any time, for example by turning off notifications or camera access in your phone settings, or by unsubscribing from marketing. This does not affect anything we did before you withdrew consent.
• Be removed from an alarm contact list by asking us or the organisation that added you.
• Complain to us, and to a regulator if you are not satisfied (see section 13).

Contact our Privacy Officer to use any of these rights. Requests are free. We may need to confirm your identity before acting on a request.

10. Deleting your account

You can delete your account at any time:

• In the app: open Settings → Account → Delete account and confirm.
• On the web: visit mysentinel.co.nz/delete-account. You do not need the app installed.
• By email: write to [email protected] from the email address on your account.

When you delete your account, we:

• sign you out of all devices and stop all notifications and alarm calls to you;
• permanently delete your name, email, phone number, credentials, push tokens and preferences within 30 days; and
• anonymise your name in your organisation’s audit trail and alarm history, so the records remain without identifying you.

Deleting a user account does not delete your organisation’s site and sensor history. That belongs to the customer organisation and stays available to its other users. An organisation owner can ask us to delete all of the organisation’s data. We do this within 90 days, apart from invoices, which tax law requires us to keep for 7 years. Copies in encrypted backups are overwritten within 35 days.

If you are the only administrator of your organisation, we will check with you before deleting your account, so that alarms for your sites are not left with no one responsible for them.

11. Children

The Service is a business tool for farms and commercial sites, and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us their information, contact us and we will delete it.

12. Changes to this policy

We will post any update on this page with a new effective date. If we make a material change, we will notify account holders by email or in the app before it takes effect. We will not use information already collected in a materially new way without your consent.

13. Complaints

If you have a concern about how we have handled your information, contact our Privacy Officer first. We aim to resolve it within 20 working days. If you are not satisfied:

• in New Zealand, you can complain to the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909; or
• in Australia, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.