Onfile is made in Aotearoa New Zealand for licensed real estate salespeople. The product's whole premise is that your client file is your own record — so this policy is built on the same idea: collect only what the service needs, never sell anything, and keep the exit open.
Onfile touches two very different sets of information, and your rights differ for each:
Everything below is organised around that split.
You can use Onfile's free tier with no account at all. In that mode everything — contacts, notes, listings, drafts — lives only in your browser on your device. We have no copy; there is nothing for us to lose, leak, or hand over. Clearing your browser data clears your file, which is why the export button is always one click away. If you later start a trial, you can bring your local file into your account — that upload happens once, on your click.
To know whether the product works, we record a small set of anonymous usage events — things like "a first newsletter was generated" or "the contact limit was reached". These events:
When Pro drafts message text for you, the relevant snippet of context is sent to our AI provider (Anthropic) to generate the draft, under an agreement that it is not used to train models. Drafting happens on your click; nothing on your file is sent to any model in the background. Every draft is yours to edit before it goes anywhere.
| Provider | What for | What they can see |
|---|---|---|
| Cloudflare | Hosting, sync storage, scheduling (Sydney region, ap-southeast-2) | Encrypted service data |
| Stripe | Billing | Your billing details; never your file |
| Google / Microsoft | Sign-in; sending newsletters from your own mailbox (Pro, with your authorisation) | The emails you send through your own account |
| Anthropic | AI drafting (Pro, on your click) | The snippet being drafted; no training on it |
| Mailchimp (Intuit, USA) | Our own occasional emails to salespeople who asked for them — never to anyone on your file | Your name and email if you opted in; every email carries an unsubscribe link |
No provider on this list may use your information for its own purposes, and none of them — and no one else — ever receives your file for advertising or resale, because that never happens.
The Friday send works by sending from your own mailbox, which you authorise once via Google or Microsoft sign-in (OAuth). What we ask for is deliberately narrow:
gmail.send scope; Microsoft's Mail.Send). Onfile cannot read, search, delete
or manage anything in your inbox — the permission we hold doesn't allow it.Onfile is operated from New Zealand; Pro data is stored in Sydney (ap-southeast-2). Where information is held overseas, it stays subject to this policy and to safeguards comparable to the Privacy Act (IPP 12). Everything moves over TLS; sending tokens are envelope-encrypted; access inside Onfile is role-based and logged — and as a design rule, our own admin tools show usage counts only and are structurally unable to open the contents of anyone's file.
Your account data and Pro file are kept while your account is active. When you delete your account, deletion cascades — file, tokens, sync copies — within 30 days. Two things persist longer, on purpose: invoices (tax law requires it) and unsubscribe suppressions, because "take me off the list" must survive even your account being rebuilt.
Under the Privacy Act 2020 you can ask what we hold about you (IPP 6), and ask us to correct it (IPP 7). Most of that is faster in-product — your file is already yours to read and edit — but for anything else, email hello@onfile.co.nz and we'll respond within 20 working days. If you're not happy with our answer, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).
If a salesperson emails you through Onfile, the record about you is their record — they collected your details from you, usually at an open home or when you enquired, and their email footer says exactly when and where. Your rights of access and correction sit with them in the first instance; if you'd rather come to us, email us and we'll help route the request. And to stop hearing from them: reply "stop", or use the one-click link — the removal takes effect immediately and is kept permanently. We never email you on our own behalf, and we never use your details for anything except delivering what your agent sends.
If we change this policy in a way that matters, we'll say so in the app before the change takes effect — not bury it. The current version always lives at this address.
Onfile · Aotearoa New Zealand
hello@onfile.co.nz