Plan2BOQ — Privacy Policy

Effective date: 19 October 2026
Version: 1.1

1. Introduction

Plan2BOQ is construction estimating, digital takeoff and Bill of Quantities software operated by Jason Bunney, a New Zealand sole trader based in Manawatū, New Zealand.

We respect customer privacy and are committed to protecting personal information in accordance with the New Zealand Privacy Act 2020.

This Privacy Policy explains what personal information we collect, how we use and protect it, who may receive it, how long we retain it and how customers can exercise their privacy rights.

This Policy applies to the Plan2BOQ website, customer registration, desktop software licensing, subscriptions and technical support services.

2. Information We Collect

Depending on the services you use, we may collect:

  • Your name, email address and optional business name.

  • Customer registration and email verification details.

  • Records of your acceptance of our Terms of Service and Privacy Policy.

  • Licence identifiers, activation records, subscription status and installation identifiers.

  • Stripe customer, subscription and payment-status references.

  • Limited technical and security information used to operate and protect our services, including IP-related information and security event records.

  • Support enquiries, correspondence and information you voluntarily provide to us.

Some technical identifiers may be stored in hashed or otherwise protected form.

Our customer registration process does not require a Plan2BOQ account password.

We do not directly collect or store customers' full payment-card numbers or card security codes.

3. Customer Project Files

Plan2BOQ is designed to operate as desktop software on the customer's own computer.

During normal use, construction drawings, digital takeoffs, estimates, Bills of Quantities, merchant price files and other project files remain on the customer's computer.

Our online registration and licensing services do not ordinarily receive or store these project files.

If a customer voluntarily sends us project files, screenshots or other information for technical support, we will use that information to investigate and respond to the support request.

Customers are responsible for maintaining backups of their locally stored project files and protecting their own computers.

4. How We Use Personal Information

We collect and use personal information where reasonably necessary to:

  • Register customers and verify email addresses.

  • Provide and administer free trials.

  • Activate and manage software licences.

  • Process paid subscriptions and confirm payment status.

  • Provide account recovery and licensing assistance.

  • Send essential service, billing and security communications.

  • Respond to enquiries and technical support requests.

  • Detect and prevent fraud, automated abuse and unauthorised access.

  • Maintain and improve the reliability and security of our services.

  • Meet applicable legal, accounting and regulatory obligations.

Plan2BOQ does not use its customer registration process to subscribe customers to marketing emails.

If optional marketing communications are introduced in the future, they will be handled in accordance with applicable law.

5. Free Trials and Paid Subscriptions

Plan2BOQ offers a 14-day free trial that begins upon first successful activation of the desktop software under a trial entitlement.

No payment card is required for the free trial, and the trial does not automatically convert into a paid subscription.

Paid subscriptions are processed through Stripe.

Stripe handles payment-card information and provides Plan2BOQ with the customer, subscription and payment-status information necessary to manage software access.

Customers can manage their subscriptions through the available subscription-management arrangements, including the Stripe Customer Portal when enabled.

6. Service Providers and Overseas Processing

Plan2BOQ uses third-party service providers to support its website, customer registration, licensing, payments, communications and security.

These include:

  • Webador: Website hosting and contact forms.

  • DigitalOcean: Application hosting, databases and supporting infrastructure.

  • Stripe: Subscription billing and payment processing.

  • Brevo: Transactional email delivery, including verification and account recovery messages.

  • Cloudflare: Website and registration security, including protection against automated abuse.

We share or make available only the personal information reasonably necessary for each provider to perform its relevant function.

Some information may be stored or processed outside New Zealand.

We remain responsible for handling personal information in accordance with applicable New Zealand privacy law.

Where an overseas transfer constitutes a disclosure subject to Information Privacy Principle 12 of the Privacy Act 2020, we will ensure that an applicable legal basis or safeguard is in place. Depending on the circumstances, this may involve comparable privacy protections, appropriate contractual safeguards or informed authorisation where permitted by law.

Where an overseas service provider processes information solely on our behalf and does not use or disclose it for its own purposes, different rules may apply under the Privacy Act 2020.

We will review relevant provider arrangements as services are introduced or changed.

7. Information Security

We take reasonable technical and organisational measures to protect personal information against loss, misuse, unauthorised access, modification and disclosure.

Our security measures include, where applicable:

  • Restricted access to customer and licensing information.

  • Secure communications between software and online services.

  • Time-limited email verification and account recovery processes.

  • Protected authentication and installation identifiers.

  • Controls to reduce automated registration abuse.

  • Separation of service responsibilities and appropriate operational logging.

  • Restricted handling of temporary activation credentials.

Security measures are reviewed as the system develops and becomes operational.

No online service can guarantee absolute security.

Customers are responsible for protecting their own devices, email accounts and locally stored project information.

8. Information Retention

We retain personal information for as long as reasonably necessary to provide our services, administer customer accounts and licences, maintain security, resolve disputes and meet legal obligations.

Retention depends on the type of information and the reason it was collected.

  • Active customer information: Generally retained while an account or licence remains active and for an appropriate period afterwards where required for legitimate business or legal purposes.

  • Temporary verification and recovery information: Retained only as long as reasonably needed for verification, recovery, security and related operational purposes.

  • Security and technical records: Retained for appropriate periods to investigate misuse, maintain service integrity and meet applicable obligations.

  • Subscription and financial records: Retained for applicable accounting, tax and legal requirements, which may require certain records to be kept for at least seven years.

  • Support correspondence and voluntarily supplied files: Retained only as reasonably necessary for support, follow-up, dispute resolution or legal obligations.

We are developing and implementing automated processes to remove temporary records when they are no longer required. Until those processes are operational, retention and deletion will be managed through available administrative and technical procedures.

Customer registrations, licensing information and financial records are not automatically deleted merely because a temporary verification or security record expires.

Backups, infrastructure logs and third-party service records may be subject to separate retention periods.

We will securely delete or de-identify personal information when it is no longer required, subject to applicable legal and operational requirements.

9. Accessing and Correcting Personal Information

Customers have rights under the New Zealand Privacy Act 2020 to request access to personal information we hold about them and to request correction of inaccurate information.

Requests can be sent to:

support@plan2boq.com

We may need to verify the identity or authority of the person making the request before providing or changing information.

We will make and communicate decisions on access and correction requests as soon as reasonably practicable and generally within 20 working days, subject to any lawful extension or other applicable provision.

If a correction request is declined, customers may have the right to provide a statement of the correction sought and request that it be attached to the relevant information.

10. Requests for Deletion

Customers may contact us to request deletion of personal information that is no longer required.

We will consider each request in accordance with the Privacy Act 2020, applicable recordkeeping obligations, active subscriptions or licences, security requirements and other legitimate retention needs.

Not every deletion request can necessarily be fulfilled immediately or in full.

Where deletion is appropriate, we will take reasonable steps to remove the relevant information from applicable systems, subject to backup retention and other lawful exceptions.

Deleting customer account information does not automatically remove project files stored on the customer's own computer.

11. Website Cookies and Security Technologies

The Plan2BOQ website and related online services may use cookies or similar technologies for website operation, security, session management and protection against automated abuse.

Our service providers, including Webador, Stripe and Cloudflare, may also use cookies or similar technologies when customers interact with their services.

These technologies may collect limited technical information, such as browser, device or network information, according to the service being used.

We will review and update this Policy if additional analytics, advertising or marketing tracking technologies are introduced.

12. Sharing and Disclosure of Information

We do not sell customer personal information to advertisers.

We may share relevant personal information with service providers as described in this Policy.

We may also disclose information where reasonably necessary and permitted or required by law, including to:

  • Comply with lawful requests or legal obligations.

  • Investigate fraud, security incidents or unauthorised activity.

  • Protect the rights, safety or security of customers, Plan2BOQ or others.

  • Resolve legal claims or disputes.

  • Support a lawful transfer or restructuring of the business, subject to applicable privacy requirements.

We do not ordinarily disclose customer project files to third parties.

13. Privacy Breaches

If we become aware of a suspected privacy breach, we will investigate the circumstances and take appropriate steps to contain and address the issue.

Where a privacy breach meets the notification requirements of the Privacy Act 2020, we will notify the Office of the Privacy Commissioner and affected individuals as required by law.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our software, services, security arrangements, service providers or legal obligations.

The current version and effective date will be displayed on the Plan2BOQ website.

Where changes materially affect customers, we will provide notice where appropriate or legally required.

15. Contact and Privacy Enquiries

For questions about this Privacy Policy, requests to access or correct personal information, deletion enquiries or privacy concerns, contact:

Plan2BOQ
Operated by Jason Bunney — Sole Trader
Manawatū, New Zealand
Email: support@plan2boq.com

If you are dissatisfied with our response to a privacy concern, you may contact the New Zealand Office of the Privacy Commissioner.

Website: www.privacy.org.nz