Legal

Privacy Policy

Effective date: October 11, 2026

This policy explains how Units (UnitsHQ, "we") collects, uses, shares, and protects personal information when you use unitshq.com, the Units app, the tenant portal, and our online booking pages. We handle personal information in line with the New Zealand Privacy Act 2020.

Who this policy covers

Storage operators and their staff (our customers). We are responsible for the account information you give us.
Tenants and prospective tenants of facilities that use Units. The facility decides what tenant information it collects and how it is used, and we process it on the facility's behalf to provide the service. If you are a tenant, contact your facility first; we will help them respond.

Information we collect

Account details such as name, email address, phone number, and business details. Sign-in is handled by Google Firebase; we do not store passwords.
Facility and tenant records entered by operators or tenants, including contact details, tenancy agreements and documents, invoices, payments, notes, and uploaded files and photos.
Payment information. Card and bank details are entered on Stripe's pages and held by Stripe. We store payment references and status, never full card numbers.
Data from accounting software and mailboxes you choose to connect, described below.
Technical and usage data such as logs, IP address, browser and device details, and product analytics.
Support and communication history when you contact us.

How we use information

To provide and support Units, including invoicing, payments, reminders, the tenant portal, and bookings.
To keep your records in step with the accounting software you connect.
To send the emails you or your automations trigger, such as invoices, receipts, and reminders.
To secure the platform, prevent misuse, and keep the service reliable.
To understand how Units is used and improve it.
To communicate service updates and meet legal, tax, and regulatory obligations.

We do not sell personal information, and we do not use your data for advertising.

Accounting integrations (QuickBooks Online and Xero)

If a facility connects QuickBooks Online or Xero, Units:

Reads and writes only what the sync needs: customers or contacts, invoices, payments, credit notes, and the products, accounts, and tax settings chosen in the integration settings.
Uses that data only to keep the facility's records in Units and its accounting software in step. It is never shown to other customers, sold, or used to train AI models, and it is shared only with the service providers listed below that host and run Units.
Stores connection tokens encrypted. A facility can disconnect at any time from its Units settings, which revokes our access and deletes the tokens. Records already synced remain in both systems.

Connected mailboxes (Gmail and Outlook)

If a facility connects its Gmail or Outlook mailbox, Units:

Reads the facility's email so staff can read, reply to, label, archive, and trash conversations inside Units, and sends emails and saves drafts when staff ask it to.
Checks each new email for storage enquiries. The sender, subject, and message text, with up to three earlier messages in the conversation, are sent to TypeSafe, which tells Units whether the email is an enquiry and which unit type fits. An enquiry becomes a lead holding the sender's name, email address, phone number, subject, and message text.
Sends an email to OpenAI only when a staff member opens the assistant on that email, for example to draft a reply.
Does not keep a copy of the mailbox. Messages are fetched from Gmail or Outlook when staff open them. Units stores the emails staff send from Units, leads created from enquiries, assistant conversations, and the message IDs it needs so an email is not processed twice.
Uses email only to provide these features. We do not sell it, use it for advertising, or use it to develop, improve, or train generalised AI models. Our team reads a facility's email only with the facility's permission, for security, or where the law requires it.
Stores connection tokens encrypted. Disconnecting the mailbox from Units settings revokes our Gmail access and deletes the tokens.

Units' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI features

Units includes an optional assistant (UnitsAI) and pricing suggestions that use OpenAI's API. When you use them, relevant records from your account, such as units, tenancies, contacts, and invoices, are sent to OpenAI to generate a response. OpenAI does not use data sent through its API to train its models, and neither do we. Email is sent to OpenAI only as described under connected mailboxes above.

Service providers

We use these providers to run Units. Each receives only the information it needs for its role:

DigitalOcean: application hosting and database (Sydney, Australia).
Cloudflare: file storage, website delivery, and a bot check (Turnstile) on our demo request form.
Google Firebase: sign-in and authentication.
Stripe: card and bank payments, and subscription billing.
Resend: email delivery.
OpenAI: the AI assistant and pricing suggestions.
TypeSafe: spotting storage enquiries in a connected mailbox.
PostHog: product analytics.
Google (Gmail) and Microsoft (Outlook): only if a facility connects its mailbox.
Intuit (QuickBooks Online) and Xero: only if a facility connects its accounting software.

We may also disclose information where the law requires it, or to protect the rights and safety of others.

Where data is stored

Our main database is in Sydney, Australia. Some providers process data in other countries, including the United States. We use providers that protect personal information with safeguards comparable to New Zealand law.

Security

Data is sent over HTTPS, connection tokens are encrypted, and access to customer data is limited to what is needed to run and support the service. If a privacy breach is likely to cause serious harm, we will notify the affected facilities, individuals, and the Privacy Commissioner as the law requires.

Retention and deletion

We keep data while an account is active. When a facility closes its account, we delete or anonymise its data within a reasonable period, except records we must keep for legal, tax, or dispute purposes. Backups are replaced on a rolling basis. Facilities can ask us for an export of their data before closing.

Your rights

You can ask to access or correct your personal information. Where the law that applies to you gives further rights, such as deletion, we will honour them. We may need to verify your identity first. If you are unhappy with how we handled a request, you can complain to the New Zealand Privacy Commissioner at privacy.org.nz.

Cookies

We use cookies and browser storage to keep you signed in and to understand how our website and app are used. You can block cookies in your browser, but parts of Units may then not work.

Children

Units is not directed at children under 16, and we do not knowingly collect their information.

Changes to this policy

We will update the effective date when this policy changes and tell customers about significant changes.

Contact

For privacy questions or requests, contact hello@unitshq.com.