Privacy Policy

This Privacy Policy explains how Financial Technologies Limited, trading as Wlbr ("Wlbr", "we", "us"), collects, uses, stores, discloses and protects your personal information. We handle personal information in accordance with the Privacy Act 2020 and its Information Privacy Principles.

It applies to everyone who uses the Wlbr platform, both Buyers who fund escrow payments and Sellers who receive them. By using Wlbr you agree to the handling of your information as described here.

We only collect personal information we need to run the escrow service, process payments and keep it safe. This includes:

• Account details: your name, email address, and the password hash used to sign you in.
• Business and profile details: your display or business name and contact email, used to identify you on payments.
• Verification information: where required to meet our AML/CFT obligations, identity information (such as government photo ID and proof of address), which we hold securely and restrict to authorised review staff only.
• Payment information: the escrow payments you fund or receive, their amounts, references and status, and movements into and out of our client trust account. Funds move by bank-to-bank transfer initiated through a New Zealand open-banking provider. We store the bank account details a Seller nominates for payouts in encrypted form; we do not collect or store your internet-banking login or card details.
• Task photos and payment or dispute evidence: new image uploads are re-encoded to remove embedded location and camera metadata before storage. This does not remove personal information visible in the image. PDFs and images uploaded before this change are not covered by that processing.
• Technical information: limited log data such as IP address and browser type captured at key events (for example, when you accept the Terms) to keep the platform secure.
• Estimates and regional interest: the cost estimator no longer produces estimates, and we do not store or send anywhere the job description you type into it. If you join a waitlist, we store your email address and any region, city, hiring/working role and trade you provide so we can manage and contact you about that interest.
• Messages about a payment on hold: while a payment you are part of is frozen or in dispute, you can write to Wlbr and attach files in a private conversation. We store those messages and files. The other party to the payment cannot see your conversation, and you cannot see theirs. Our staff who handle disputes can read both. We keep them for as long as the payment's records are kept.
• API access requests: if you ask for API access for your business, or apply to have a partner app approved, we store the contact name and email address you give us, what you are building and how you expect to use the API, and for a partner app its name and website. Our staff use these to decide the request and to tell you the outcome.

We also receive information about you from third-party services we use to operate the platform:

• Identity verification: we use GBG Cloudcheck, an external service run by GBG (Verifi Identity Services Limited), to verify identities. The check runs on GBG's own page: GBG collects a scan of your photo ID and a selfie directly from you, and tells us whether the check passed and the details it verified. GBG also sends us the number of your photo ID and the home address you gave on its page. We keep the photo ID number encrypted with your identity record. Our staff screens show only its last four characters, and the full number appears only in the customer due diligence file that our compliance staff can export. We keep that address, stored encrypted with your identity record, as part of the customer due diligence we carry out under anti-money-laundering law. Section 4A describes this for the people connected to a business. Details at gbg-cloudcheck.com.
• Transaction monitoring: we use Didit, a third-party transaction monitoring provider, to monitor payments for our AML/CFT obligations. For each payment we send Didit the amount, the currency, whether the money is coming in or going out, the names of the two parties and our internal reference for each, and Didit returns a risk assessment to us. Didit does not verify your identity for us and does not check you against sanctions or politically exposed person watchlists; GBG Cloudcheck does both. If you verified your identity with Wlbr before identity checks moved to GBG Cloudcheck, Didit collected a document scan and a liveness check from you at that time. Its privacy policy is available at didit.me/privacy.
• Sanctions and politically exposed person screening: we send your name, and your date of birth if we have it, to GBG Cloudcheck, an external service run by GBG (Verifi Identity Services Limited), which checks it against the Dow Jones sanctions and politically exposed person watchlists. We do this for account holders, for people connected to a business customer and for payers: when we first verify you, again at least once a year while you use Wlbr, and whenever the name we hold for you changes. GBG tells us whether there is a possible match, and our compliance staff review any possible match before deciding anything. We also compare names with our own internal screening list.
• Identity checks for team members and for account recovery: a person added to a business's team as an operator must have an identity already verified on their Wlbr account, or pass their own GBG Cloudcheck identity check, before a payment request they create can be opened. If you lose your two-factor sign-in, our support staff can email you a private link to a new GBG Cloudcheck check, and we reset your two-factor sign-in only if the name and date of birth it verifies match an identity already verified on your account. These checks run on GBG's own page in the way section 4A describes: to start one we send GBG only a reference, and GBG collects a scan of your photo ID and a selfie. GBG tells us whether the check passed, the name and date of birth it verified, and whether the result needs review, for example because of a possible watchlist match. We keep that outcome, the verified name, the verified date of birth (stored encrypted) and whether they matched your account. We don't receive or keep the photo ID images or the selfie. If an operator's result needs review, our staff may clear the operator after reviewing it, and we keep who did that, when and why. For a recovery we keep who opened it and why, and who made the reset, when and why. When a two-factor sign-in is reset we email the account holder and the owners of each business the account belongs to.
• Business register lookups: we query the New Zealand Companies Office NZBN register and the Licensed Building Practitioners (LBP) register to confirm business and practitioner details you provide. These are public registers. When a business customer is verified, we keep the register result as part of its customer due diligence record (without the home addresses of directors or shareholders), for as long as AML/CFT law requires.
• Company directors, shareholders and registered address: when our connection to the NZBN register is switched on, we also read from it a company's current directors, its shareholders and their shareholdings, and the company's registered address. We compare these with the people and ownership the business told us about, and our compliance staff review any difference. We keep them with the register result described above.
• Official sanctions lists: we download the public sanctions lists published by the United Nations Security Council, New Zealand Police (designated terrorist entities) and the Ministry of Foreign Affairs and Trade (the Russia Sanctions Register), and keep a copy of each. We compare a business's legal and trading names with those copies on our own systems, when the business applies and again in our regular re-screening. We send nothing about you or your business to those sources. A possible match is reviewed by our compliance staff before the business can be approved.
• Open-banking account data: when you authorise a bank transfer through Akahu (our open-banking provider), Akahu shares your nominated account details and transaction reference with us to initiate and confirm the payment. Akahu collects and processes that data under its own privacy policy, available at akahu.nz/privacy.
• Accounting integration: if you connect your Xero organisation, we receive invoice and account data from Xero in order to link payments to invoices and reconcile your accounts. This data is processed only as you direct.

We use your personal information to:

• create and operate your account and the escrow service;
• create, fund, hold, release and refund escrow payments, and pay out to Sellers;
• verify identity and meet our Anti-Money Laundering and Countering Financing of Terrorism Act 2009 obligations;
• detect, prevent and investigate fraud, abuse and security incidents;
• provide support, send service notifications, and handle complaints and disputes;
• manage regional or product access requests;
• comply with our legal obligations.

We do not sell your personal information. We do not use it for unrelated marketing without your consent.

Once your identity has been verified on your registered Wlbr account (as a payer, as the holder of your own business account, as a person named on a company, or in your own check), we use that verification for later payments you make from that account, so you are not asked to verify again. We do not use it if it has been revoked, if a newer check of you was declined, or if identities verified on your account disagree about your date of birth. The checkout tells you when your verification was used. Each payment is still screened, against your verified name as well as the name you pay under.

When you pay again from the same registered account, the checkout shows the home address and politically exposed person answer from your most recent payment for you to confirm or change, and shows the bank account you gave for refunds with most of its digits hidden. You can choose a different account. Each payment keeps its own copy of the details you confirm.

Where optional journey analytics is enabled, we record daily totals for a fixed set of product interactions and successful steps. These aggregates contain no person or session identifier, free-text input or payment token, and are retained for 90 Auckland calendar days including the current day. Browser collection honours Do Not Track and Global Privacy Control. These totals are separate from the operational payment records and security logs described elsewhere in this Policy.

On our public information pages (pricing, trust, transparency, security, terms, privacy and complaints) and on the sign-in and sign-up pages, we use Google Tag Manager and the Google Analytics and Google Ads tags it loads. These tags set cookies and similar identifiers in your browser so that we can measure visits to those pages and our advertising, including which ads led people to create a Wlbr account. When you create an account on the sign-up page we tell these tags that a sign-up happened; we don't give them your name, email address or any account identifier. We don't load these tags inside the signed-in app, on checkout or payment pages, or in identity verification, and we don't load them when your browser sends a Do Not Track or Global Privacy Control signal. You can block or delete these cookies in your browser settings, and you can control how Google uses them for advertising in Google's ad settings (adssettings.google.com).

We share personal information only where necessary:

• with the other party to a payment, for example a Buyer and the Seller can see the display name and reference associated with the payment between them;
• with service providers who help us operate (such as our hosting, database, email and open-banking payment providers), under confidentiality obligations;
• with regulators, law enforcement or others where the law requires or permits it, including AML/CFT reporting; and
• if our business is sold or reorganised, with the relevant party, subject to this Policy.

When a business signs up, anti-money-laundering law requires us to verify the people who own, control or act for it. The person setting up the business gives us the names, roles, ownership and email addresses of those people, and we may also get directors' and shareholders' names from the New Zealand Companies Office (NZBN) register.

We use this information only to carry out customer due diligence on the business under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009. We email each person a private link to verify their own identity online with GBG Cloudcheck, an identity verification service run by GBG (Verifi Identity Services Limited). Everyone must verify this way: we can't verify a person's identity from documents instead. Before the person leaves Wlbr, our link page asks for their full legal name, date of birth and home address. We collect these ourselves and store them encrypted, as the details the person gave us, to compare with the result of the check. GBG Cloudcheck is an external service, not part of Wlbr: the link takes the person to GBG's own page, and to start the check we don't send GBG the person's details (that request carries only a reference). There the person gives their details to GBG, and GBG collects a scan of the person's photo ID (a passport or New Zealand driver licence) and a selfie, which it matches to the photo, then checks their name, date of birth and address against the Department of Internal Affairs, NZ Transport Agency and illion databases and against sanctions and politically exposed person watchlists. GBG handles this information under its own privacy policy (gbg-cloudcheck.com). We have not yet confirmed GBG's processing locations and retention periods with GBG.

A check run in GBG's test environment, which we use only to test this flow, is never used as evidence to verify a person or a business.

GBG sends us the result: whether each check passed, the name and date of birth it verified, the type of photo ID and its number, the home address the person gave on GBG's page, and any watchlist match. We don't receive or keep the photo ID images or the selfie. We keep the photo ID number encrypted with the person's identity record. Our staff screens show only its last four characters, and the full number appears only in the customer due diligence file that our compliance staff can export. We store the verified date of birth encrypted and use it only to confirm it matches the details the person gave us. We keep the home address the person gave on GBG's page, stored encrypted with their identity record, as part of the customer due diligence we carry out under anti-money-laundering law.

Where the online check could not confirm a person's ID with its issuer, or our record of the check does not show that it did, our compliance staff also contact that person for a proof of address dated within the last three months, such as a utility bill, bank statement or government letter. Otherwise we keep the home address the person gave and don't ask for a proof of address. A proof of address is checked as well as the online check, never instead of it.

Where we checked a proof of address, we record the home address we verified, stored encrypted, and keep the document in restricted storage that only our compliance staff can open. We also check each person against sanctions lists and lists of politically exposed persons: for that check we send the person's name and date of birth to GBG Cloudcheck, when we verify them and at least once a year after that.

While reviewing a business, our compliance staff may also ask for a named document: a proof of address, a register extract, an authority letter or another document they describe. We ask the person who set up the business to upload it in Wlbr, or we email a named person a private link to upload their own document. We keep each uploaded document with the business's customer due diligence record. A document about a person, and any proof of address, can be opened only by our compliance staff.

The person who set up the business only sees whether each check is complete. They never see another person's date of birth, address, identity documents or check results. Our compliance staff see these details only when reviewing the business.

We keep these records and documents for the periods in our evidence retention schedule for customer due diligence: at least five years after the business relationship ends, as AML/CFT law requires. Anyone we hold information about can ask to see it and ask us to correct it by contacting support@wlbr.app.

Some of our service providers process data outside New Zealand. By using Wlbr you authorise these transfers. The overseas locations and the nature of each transfer are:

• Amazon Web Services (Australia): our database, application hosting and file storage run on AWS infrastructure in the Sydney region (ap-southeast-2). All personal information in your account, including payment records, verification outcomes and any documents or evidence you upload, is stored there. AWS holds SOC 2 and ISO 27001 certifications. Details at aws.amazon.com/privacy.
• Didit (European Union / United States): AML/CFT transaction monitoring. The payment details and names described in section 2 are processed by Didit's infrastructure, which spans the EU and US. Identity documents and liveness data that Didit collected before identity checks moved to GBG Cloudcheck were processed there too. We have not yet confirmed Didit's processing locations, retention and safeguards with Didit. Details at didit.me/privacy.
• GBG Cloudcheck (Verifi Identity Services Limited): identity verification and sanctions and politically exposed person screening. Wlbr sends GBG a screened person's name and, if we have it, their date of birth. We have not yet confirmed GBG's processing locations, retention and safeguards with GBG. Details at gbg-cloudcheck.com.
• Resend (United States company; sending from Japan): transactional email delivery. Service notifications (payment receipts, status updates, dispute notices) are sent through Resend, a United States company. Our sending domain is set up in Resend's Tokyo region, so the emails leave through Amazon Web Services infrastructure in Japan. We have not yet confirmed where else Resend processes or keeps them. Details at resend.com/privacy.
• Sentry (United States): error monitoring. When something goes wrong in the app, a report describing the error is sent to Sentry so we can fix it. We scrub personal information such as email addresses and bank account numbers from these reports before they leave our systems. Details at sentry.io/privacy.
• Upstash (Australia): abuse-prevention counters and short-lived worker wake-up locks. Counter keys can contain an IP address, account identifier or email address, depending on the action. Our configured rate-limit windows extend to 24 hours; the overlapping counters expire after up to 48 hours and one second under the current library configuration. Wake-up locks expire after 5 or 10 seconds. We do not put payment records, identity documents or passwords in this store. The store is an Upstash database hosted on Amazon Web Services in the Sydney region. We have not yet confirmed Upstash's own retention arrangements. Details at upstash.com/trust.
• Google reCAPTCHA (United States company): on the sign-in and sign-up forms, the payer sign-in link form, and the complaint, reference check and scam report forms, Google's reCAPTCHA service checks that a person, not an automated program, is using the form. To do that Google collects information about your device and browser, including your IP address, under its own Privacy Policy (policies.google.com/privacy) and Terms of Service. Each of those forms says so.
• Google Tag Manager, Google Analytics and Google Ads (Google LLC, United States company): on the public information pages and the sign-in and sign-up pages described in section 3, these Google tags collect information about your visit, device and browser, including your IP address and the cookies and identifiers they set, and send it to Google LLC, which processes it in the United States and other countries outside New Zealand under its own Privacy Policy (policies.google.com/privacy). How long Google keeps this data depends on the settings of our Google accounts, which we have not yet confirmed here. Details at policies.google.com/technologies/partner-sites.
• Google Workspace (United States company): our email for the wlbr.app domain, including support@wlbr.app, is hosted by Google Workspace. Messages you send us there, and our replies, are held in Google's systems, which operate in several countries. Details at policies.google.com/privacy.
• Neon and Vercel hosting (United States): our former database and web hosts. Until those hosting resources are fully decommissioned, historical copies of data may remain under the same safeguards described here. Those copies are being retired and are not used to host the Platform.

We assess the safeguards for overseas processing, including the information involved, provider practices and contractual arrangements. Provider certifications may inform that assessment; they do not by themselves establish that a particular transfer meets our obligations. Where this section says a supplier's locations or retention are not yet confirmed, we are still assessing that supplier. If you would like more detail about a specific transfer, contact us at support@wlbr.app.

We take reasonable steps to keep your information safe, including encryption in transit, encryption of nominated bank account numbers at rest, access controls that restrict sensitive verification documents to authorised review staff, and signed/secured sessions.

We keep personal information only for as long as we need it for the purposes above or as required by law. AML/CFT records, for example, must be kept for at least five years.

Some records are deleted automatically once they are no longer needed: error logs, notifications, failed background tasks and the expired links they carried, expired sign-in and verification links, API replay records and the journey analytics totals. We have not yet adopted a schedule for disposing of identity verification records and other evidence, so we keep those and do not yet delete them. No AML/CFT record has yet reached the end of its minimum period.

We also back up our database. Every day we make an encrypted copy of the whole database and keep it in storage in the Sydney region that, by design, nobody can change or delete for at least seven years. Our database host also keeps its own backups for seven days. Information deleted from the live system remains in those backups until they expire, and we use them only to restore the service or our records.

Under the Privacy Act 2020 you have the right to ask for access to the personal information we hold about you, and to request that we correct it if it is wrong. Wlbr also gives you self-service tools in your account:

• Download my data: export a machine-readable copy of your account, business profile, payments and notifications at any time.
• Delete my account: permanently remove your sign-in, personal profile and notifications. Records tied to payments, identity checks, complaints and AML/CFT obligations are kept in full for as long as the law requires; deleting your account does not shorten or reduce them. You cannot delete your account while you have funds in escrow, an open dispute or complaint, or while a legal or compliance hold requires us to keep your account as it is.
• Close my account: stop using Wlbr without deleting anything. A closed account cannot sign in or create new payment requests. A business that only you own is suspended, and its API keys and Xero connections are switched off. We keep all of your records, and our support team can reopen the account if you ask. You cannot close your account in any situation where you could not delete it.

Your data download also includes your own account closures, your own identity checks and two-factor recoveries, your API access requests, and the messages in your own conversations with Wlbr about a payment on hold, with the name and size of each file in them. It never includes the other party's conversation.

You can also contact us at support@wlbr.app to exercise any of these rights. If you are not satisfied with how we handle your information, you may complain to the Office of the Privacy Commissioner (privacy.org.nz).

We may update this Privacy Policy from time to time. The version and effective date are shown at the top. If we make material changes we will take reasonable steps to let you know.

Questions about privacy can be sent to support@wlbr.app.