← Legal & Trust
Legal

Privacy Policy

One policy for Supahuman Limited and Supahuman Pty Ltd, covering VETos, Nova 5, AI Studio and our websites, in New Zealand, Australia and the United Kingdom.

Last updated: 15 October 2026

This policy explains how SupaHuman collects, uses, stores and shares personal information across every product and service we provide: VETos, Nova 5, AI Studio and our websites. It replaces our earlier New Zealand-only policy and applies in New Zealand, Australia and the United Kingdom.

Who we are and what this policy covers

SupaHuman is a group of two companies. Supahuman Limited (NZBN 9429050314928) is a New Zealand company headquartered in Auckland. Supahuman Pty Ltd (ABN 25 701 059 743) is its Australian subsidiary. In this policy, we, us and our means whichever of those companies holds your personal information. For customers in Australia that is usually Supahuman Pty Ltd; everywhere else it is Supahuman Limited. Both companies apply this policy in full.

This is the one privacy policy for everything we do. It covers:

  • VETos, the AI operating system for vocational education, and its website, vet.supahuman.com;
  • Nova 5, including Nova Classroom, and its websites, nova.supahuman.com and nova.supahuman.io;
  • AI Studio consulting, professional services and the custom AI applications we build and run for organisations;
  • our corporate website, supahuman.com, our events, our marketing, and our recruitment.

Our customers are mostly organisations: training providers, employers and other businesses. When they use VETos or Nova 5, they put information about their learners, students and staff into our products. The section Two roles explains how we treat that information differently from the information we collect for our own purposes.

The laws we follow

We handle personal information in line with the privacy law of each place we operate:

  • New Zealand: the Privacy Act 2020 and its Information Privacy Principles. Supahuman Limited is the agency responsible.
  • Australia: the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Notifiable Data Breaches scheme. Supahuman Pty Ltd is the APP entity responsible, and Supahuman Limited complies with the Act where it handles Australian personal information on Supahuman Pty Ltd's behalf.
  • United Kingdom: the UK General Data Protection Regulation and the Data Protection Act 2018, where we provide our products to UK customers or handle the personal data of people in the UK. Supahuman Limited is the controller for the information we collect for our own purposes.

Where a term in this policy has a specific legal meaning in one of those laws (for example "personal information" in New Zealand and Australia, or "personal data" in the UK), we use it in that sense. Where the laws differ, we apply the protection that is stronger.

Two roles: ours and our customers'

We hold personal information in two different roles, and your rights depend on which applies.

When we act for a customer. A training provider, employer or other organisation that subscribes to VETos or Nova 5, or engages AI Studio, decides what information goes into the service and why. That customer is the agency (New Zealand), APP entity (Australia) or controller (UK) for that information, and we process it only on the customer's instructions, as its agent or processor. This covers learner enrolment and progress records, assessment and practice activity, role-play transcripts the customer chooses to keep, staff and assessor details, and any documents the customer uploads. The Data Processing Addendum governs how we handle it. If you are a learner or employee and want to access or correct information held in a SupaHuman product, please contact the organisation that provides your training first. We will help them respond, and we will pass on any request that reaches us directly.

When we act for ourselves. We decide why and how we collect information about our customers' staff, our prospects, website visitors, event attendees, suppliers, job applicants and the people who contact us. For that information we are the agency, APP entity or controller, and the rest of this policy explains what we do with it.

The personal information we collect

  • Identity and contact data: your name, job title, organisation, email address, phone number and postal or billing address.
  • Account data: your login details, role and permissions in a SupaHuman product, your preferences and settings, and support requests you make.
  • Financial and transaction data: bank account and payment card details, held by our payment and accounting providers (Stripe and Xero) rather than by us, and records of what you have bought from us or we have bought from you.
  • Technical and usage data: IP address, browser and device information, pages visited, features used, session and performance data, approximate location derived from your IP address, and the cookie data described below.
  • Content you give us: what you type into our products, upload, or tell us in demos, trials, workshops, surveys and events. When you use a product as a customer's user, this is usually the customer's information (see Two roles).
  • Marketing and communications data: your preferences for hearing from us, and how you interact with our emails and website.
  • Recruitment data: if you apply for a role, your CV, work history, qualifications, right-to-work information, referee details and interview notes.
  • Anything else you choose to provide, or that we ask for with your agreement.

We do not ask for sensitive information (such as health, ethnicity, religion or biometric data) for our own purposes. Our customers may hold such information in our products where their work requires it; it is then handled under the Data Processing Addendum and only on their instructions.

How we collect it

  • Directly from you: when you book a trial or demo, register for AI Academy or an event, download a guide, subscribe to our newsletter, fill in a form, email or call us, create an account, or apply for a job.
  • From your organisation: when a customer sets you up as a user of VETos or Nova 5, or names you as a contact on an agreement.
  • Automatically: from our websites and products through cookies, analytics and logs, as described below.
  • From third parties: from our analytics, advertising and CRM providers; from publicly available sources such as the New Zealand Companies Office, ASIC, training.gov.au, the NZQA register and LinkedIn; and from referees you nominate.

How we use it

We collect, hold, use and disclose personal information to:

  • provide, secure, support and improve VETos, Nova 5, AI Studio engagements and our websites, including giving you a login and responding to your requests;
  • assess whether to take on a new customer, including sanctions, fraud and credit checks where the law allows;
  • bill, collect payment and keep the financial records we are required to keep;
  • contact you about your account, your trial, an engagement, or an enquiry you have made;
  • send you marketing about our products, events and research where you have agreed or where the law otherwise allows, always with a way to opt out. We comply with the Unsolicited Electronic Messages Act 2007 (New Zealand), the Spam Act 2003 (Cth) and the Privacy and Electronic Communications Regulations 2003 (UK);
  • analyse how our websites and products are used, so we can make them work better;
  • run events, cohorts and the AI Academy, and share attendee lists only where you have agreed;
  • consider your application if you apply to work with us;
  • detect, investigate and prevent security incidents, misuse and illegal activity;
  • comply with our legal obligations, resolve disputes and enforce our agreements.

Where UK data protection law applies, our lawful bases are: performance of a contract with you or your organisation; our legitimate interests in running, securing and promoting our business, where those interests are not overridden by yours; compliance with a legal obligation; and your consent, where we ask for it. You can withdraw consent at any time.

AI and your information

Our products use artificial intelligence, including large language models from third-party providers. Our commitments:

  • We do not use customer content, learner data, or the inputs to and outputs from our AI features to train or improve any foundation or general-purpose AI model.
  • The AI model providers we use are engaged on enterprise terms that prohibit training on your data and provide for zero or limited retention. They are listed on our sub-processor list.
  • In VETos, people approve program designs and anything the AI is unsure of. In Nova 5, the AI gives learners formative feedback only; competency, grading and assessment decisions are made by your organisation's assessors, never by the AI. Nova 5's automated decisions register lists what the AI may and may not decide.
  • We do not make decisions about you that have legal or similarly significant effects by automated means alone.

Who we share it with

We share personal information only where we need to in order to run our business and provide our products:

  • Service providers that host our products and data, run our email, CRM, analytics, advertising, support, accounting and payment systems, and provide AI model inference. Those that process customer data in our products are named on the sub-processor list.
  • Within the SupaHuman group: Supahuman Limited and Supahuman Pty Ltd share systems and staff, so information held by one may be accessed by the other, under the same controls.
  • Professional advisers, insurers and auditors, under confidentiality.
  • A buyer or successor of our business or assets, if we are sold or restructured, on terms that keep this policy's protections.
  • Regulators, courts and law enforcement, where the law requires or allows it, or to establish, exercise or defend our legal rights.

We do not sell personal information.

Where your information is held

Customer data in VETos and Nova 5 is hosted on Amazon Web Services in Sydney, Australia (ap-southeast-2), with backups held in Australia. Nova 5 uses Stripe for subscription payments; its processing locations are on the sub-processor list. AI model inference may take place outside Australia where no regional endpoint exists for a required model; customers can opt out of the capabilities that would require it.

The business systems we use for email, CRM, analytics, support and accounting are provided by companies that may store information in the United States, Europe or elsewhere. Where we send personal information overseas we take the steps each law requires: in New Zealand, Information Privacy Principle 12; in Australia, APP 8; and for UK personal data, reliance on the UK adequacy regulations for New Zealand and, for other destinations, an International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

How long we keep it

  • Customer data in our products: for the subscription or engagement term. After it ends, the customer can export its data for 30 days, after which we delete it in line with the Data Processing Addendum, apart from copies in backups, which are retained for up to 12 months.
  • Account and contact data for customers and prospects: for as long as we have a relationship with you or your organisation, and for a reasonable period afterwards so we can answer questions and meet our obligations.
  • Marketing data: until you unsubscribe or ask us to stop.
  • Financial and contract records: for the periods tax and company law require, which is at least seven years in New Zealand and five years in Australia.
  • Recruitment data: for up to 12 months after a process ends, unless you ask us to delete it sooner or you join us.
  • Security and audit logs: for at least 12 months.

When we no longer need personal information we delete it or de-identify it.

Security

We protect personal information with encryption in transit and at rest, role-based access with multi-factor authentication, logging and monitoring, regular independent penetration testing and a secure development lifecycle. Our Security Statement describes these controls. No transmission over the internet is completely secure, so we cannot guarantee the security of information you send us, but we will tell you and the relevant regulator about any breach as the law requires.

Cookies and analytics

Our websites use cookies and similar technologies. Some are strictly necessary (for example, to remember your region or keep you logged in). Others help us understand how the site is used (Google Analytics, through Google Tag Manager) and show you relevant advertising on other sites (Google and LinkedIn). You can block or delete cookies in your browser; strictly necessary cookies are needed for parts of the site to work. Our products use only the cookies needed to run them.

Your rights

  • Access and correction: you can ask for a copy of the personal information we hold about you and ask us to correct it. We will respond within 20 working days in New Zealand, 30 days in Australia, and one month in the UK, and we will tell you if the law lets us withhold something.
  • Deletion, restriction and objection: you can ask us to delete your information, limit how we use it, or stop using it for direct marketing. In the UK you also have the right to data portability.
  • Marketing: every marketing email has an unsubscribe link, or you can write to us.
  • Complaints: contact our Privacy Officer first and we will investigate and reply in writing. If you are not satisfied you can complain to the Office of the Privacy Commissioner (New Zealand), the Office of the Australian Information Commissioner, or the Information Commissioner's Office (UK).

If your information is held in a SupaHuman product on behalf of a customer, we will direct your request to that customer and help them answer it.

Learners and young people

Vocational education includes learners under 18. Our customers, not SupaHuman, decide which learners use VETos or Nova 5 and are responsible for any consents their learners need. We design our products so that learner data is used only to deliver and support their learning, and we never use it for marketing.

Our websites link to other sites, including our customers' and partners'. We do not control those sites and this policy does not apply to them.

Changes to this policy

We may update this policy from time to time. We will publish the new version here with a new date, and we will tell customers directly about any change that materially affects how we handle their data.

Contact us

Our Privacy Officer is Zane Hemmingsen-Jensen, Chief Operating Officer. Write to zane@supahuman.ai, or post to Supahuman Limited, GridAKL, 101 Pakenham Street, Auckland 1010, New Zealand. Australian customers may also write to Supahuman Pty Ltd, Stone & Chalk, Level 1, 477 Pitt Street, Haymarket NSW 2000.