HiAnda — AI phone receptionist · Effective 5 October 2026 · Version 1.2
The short version
- We're LS Prime Group Limited, an Auckland company trading as HiAnda. HiAnda is an AI receptionist that answers phone calls for businesses.
- We collect what we need to run that: your account details, your business setup, and the calls our AI answers for you.
- Every call is recorded after a short spoken notice. Recordings and transcripts are deleted after 90 days.
- Our servers are in the USA (Amazon Web Services, Virginia), not New Zealand. Some of the companies that help us run the service are in the USA, Australia, the UK and China. Section 9 names each one and says what it gets.
- We don't sell personal information. We don't use it for advertising.
- If you rang a business that uses us, that business decides what happens to your details. Ask them first. You can also ask us (Section 14).
- You can ask to see or correct your information at any time: [email protected].
1. Who we are
LS Prime Group Limited, trading as HiAnda.
New Zealand company number 9009288. NZBN 9429051749620. 20 Sunshine Boulevard, Sunnyvale, Auckland 0612, New Zealand.
In this policy "we", "us" and "our" mean LS Prime Group Limited.
Our Privacy Officer handles privacy questions and requests. Email: [email protected]. Post: 20 Sunshine Boulevard, Sunnyvale, Auckland 0612, New Zealand.
This policy follows the New Zealand Privacy Act 2020 and its 13 information privacy principles (IPPs), including IPP 3A, which applies from 1 May 2026.
2. Who this policy covers
- Customers. Businesses that sign up for HiAnda, and the people who use the dashboard for them (owners and team members).
- Callers. People who phone a number that our AI answers. Most of these calls are to our customers' businesses. Some are to our own numbers: our demo line 09 886 7006 and our company office line.
- Website visitors. People who browse hianda.nz.
- Enquirers and buyers. People who use our contact form.
3. Two different roles
How the Privacy Act applies to us depends on whose call it is.
- Calls to our customers' numbers. We answer these on the business's behalf. We hold the call details for that business so we can provide the service, and we don't use them for purposes of our own. In Privacy Act terms we act as the business's agent (section 11), so the business is the one responsible for that information. If you called a business, that business's own privacy practices apply as well as this policy.
- Calls to our demo line, account data, website data. Here we decide what happens to the information, so we are responsible for it.
4. What we collect
4.1 Customers and their team
| What | Details |
|---|---|
| Sign-up details | Your name, email address, and optionally a phone number. Your business name. |
| Password | Stored only as a one-way hash (bcrypt). We can't see your password. |
| Google sign-in (if you use it) | Your Google account ID, name, email address and profile photo link. Nothing else from your Google account. |
| Business profile | Business name, phone, email, address, industry and time zone. |
| AI receptionist setup | What you tell the AI: services, prices, opening hours, FAQs, instructions, greeting. If you use the "describe your business" helper, the text you type. |
| Team | Email addresses and roles of people you invite, and who invited them. |
| Notification settings | Email addresses that receive booking alerts. Webhook addresses, Feishu/Lark or WeCom bot links you paste in. If you connect WeChat, the bot credential and the WeChat user ID it sends to (the credential is stored encrypted). |
| Google Calendar (if you connect it) | See Section 10. |
| Your customer list | Names, phone numbers, email addresses and notes you add or import in the Customers page. |
| Billing | Your plan, usage minutes, invoices and amounts, and the ID Stripe gives your account. Your card number goes to Stripe, not to us. |
| Referrals | Your referral code, who referred you (if anyone), and the email address of anyone who signs up with your code. |
| Activity | Your last login time. A log of changes made in the dashboard (who changed what, and the IP address used). |
| Messages | Emails you send us and our replies. |
4.2 Callers
When someone rings a number our AI answers, we collect:
| What | Details |
|---|---|
| Call details | The caller's number (caller ID), the number they rang, the time, how long the call lasted, and the language they chose (keypad 1 or 2). |
| Recording | An audio recording of the whole call, both sides, made after the spoken recording notice. See Section 7. |
| Transcript | A written record of what was said, created by speech-to-text. |
| Booking details | What the caller gives the AI to book or enquire: name, phone number, a separate on-site contact name and number if there is one, address, email, the service needed, preferred time, the price the AI quoted, and notes. |
A caller sometimes gives details about someone else, for example a tenant or a family member who will be at the address. See Section 6.
4.3 Website visitors
| What | Details |
|---|---|
| Analytics | We use Google Analytics 4 on hianda.nz. It records pages viewed, approximate location, device and browser type, how you arrived, and a few actions (signing up, sending the contact form, tapping our phone number). We ask Google to anonymise IP addresses. |
| Cookies | See Section 13. |
| Contact form | Your name, email, message and the topic you pick. The form uses Google reCAPTCHA to filter spam, which sends Google your IP address and some browser information. |
| Server logs | Our web server and Cloudflare record IP addresses and requests, for security and fault-finding. |
4.4 One-off purchases
If you buy a one-off service through a Stripe payment link, Stripe passes us your name, email, phone and the answers you give at checkout (such as brand name, website and industry).
5. Where it comes from
- From you, when you sign up, set up the dashboard, or email us.
- From callers, through our AI during the call.
- From Google, when you sign in with Google or connect Google Calendar.
- From Stripe, about your payments.
- From your team owner, who gives us your email address when they invite you. The invite email tells you who invited you and why.
- From you about other people, such as the customer list you import, or team members you invite.
6. Information about people we didn't collect it from (IPP 3A)
From 1 May 2026, when information about you reaches us from someone else, the law expects you to be told about it in most cases.
- Team members. The invite email we send is your notice. This policy has the rest.
- People in a business's customer list, and people named by a caller (for example an on-site contact). We hold this for the business, as its agent. The business is responsible for telling those people. Our customers agree to do this in our Terms of Service.
- Account holders, from Stripe and Google. This policy is your notice.
7. Call recordings and transcripts
- The notice. Before the AI speaks, every caller hears a short notice in the language they chose. In English: "Just so you know, this call's recorded so our team can help with your booking." In Chinese: "通话会录音，方便我们团队为您安排服务。" Recording starts after that.
- Where they're kept. Recordings are saved as audio files on our server in the USA. Transcripts are saved in our database on the same server.
- Who can see them. The business you called can read transcripts in its dashboard. Recordings aren't in the dashboard yet; the business can ask us for one. Our own staff can access them to run and support the service.
- Our own numbers only. For calls to our own numbers (our demo line 09 886 7006, our company office line, and the line of a business run by our director), we also send the recording, the transcript and any booking details to a private group chat in Feishu (a workplace app run from China) so we can check call quality. We do not do this for calls to our customers' numbers. The only exception is a fault alert: if a call to any number fails, our team gets a short message with the caller's number so we can call them back.
- How long. We delete recordings and transcripts 90 days after the call. Booking details (name, phone, address, service, time) stay as part of the business's booking records while its account is open (see Section 11).
- AI training. We don't use recordings or transcripts to train AI models. Our speech, language and voice providers process the audio and text to give us a result, under their API terms.
8. Why we use it
- To answer calls, take bookings and pass them to the business.
- To run your account: sign-in, security, team access, settings.
- To bill you, issue GST tax invoices and handle payment problems.
- To check availability against your calendar, if you connect one.
- To send you emails you need: verification codes, password resets, team invites, booking alerts, invoices and service notices.
- To support you and fix problems.
- To check call quality on our own numbers.
- To understand how people use our website, so we can improve it.
- To stop spam, abuse and fraud (including referral abuse).
- To meet legal duties, such as keeping tax records.
We don't sell personal information. We don't use it for advertising. We don't send marketing SMS (we don't send SMS at all).
9. Who we share it with
We use other companies to run parts of the service. They act for us and only get what they need.
| Company | What they do for us | What they receive | Where |
|---|---|---|---|
| Amazon Web Services (Lightsail) | Hosts our servers and database | Everything we store | USA (Virginia, us-east-1) |
| Cloudflare | Sits in front of our website and app for security and speed | Web traffic, IP addresses | USA company, global network |
| Twilio | Phone numbers and call connection | Caller ID, numbers dialled, call audio while the call is live, call times. Twilio keeps its own call logs. | USA |
| Groq | Speech-to-text | Call audio, in pieces, during the call | USA |
| OpenAI | The AI that decides what to say; backup speech-to-text when Groq is busy or down; also the "describe your business" helper | Call audio, in pieces, only when the backup speech-to-text is used; transcript text during the call, your business setup, booking details given on the call, and the times and titles of your calendar events if you connect Google Calendar | USA |
| Cartesia | Text-to-speech (the AI's voice) | The text the AI is about to say | USA |
| Deepgram | Spare speech-to-text, used only if our main provider is switched off | Call audio | USA |
| OpenStreetMap Foundation (Nominatim) | Checks an address the caller gives | The address text only, with no name or number | UK |
| Stripe | Card payments and subscriptions | Your name, email, card details, billing address, payment history | USA and other countries |
| Zoho | Sends our emails (verification, invites, booking alerts, invoices) | Recipient address and the email content, including booking details | Australia (Zoho AU data centre) |
| Sign-in with Google; Google Calendar (if you connect it); Google Analytics; reCAPTCHA on the contact form | See Sections 4.3 and 10 | USA | |
| Feishu (Beijing Feishu Technology) | Internal quality review of calls to our own numbers only; fault alerts | Recordings, transcripts, caller ID and booking details from calls to our own numbers. For any number, if a call fails, a short alert with the caller's number so we can call them back | China |
Integrations you choose. If you turn these on, we send booking details (caller name, phone, address, service, time, notes) where you tell us to:
| Integration | Who receives it | Where |
|---|---|---|
| Email alerts | The addresses you list (sent through Zoho) | Australia (Zoho), then the recipient's provider |
| Google Calendar | Google, into your calendar. If you turn on "invite customer", Google emails the caller an invite. | USA |
| Tencent, to the WeChat account you linked | China | |
| Feishu/Lark or WeCom group bot | The group you set up, through Feishu/Lark or Tencent | China or elsewhere, depending on the service you use |
| Webhook | Whatever server address you give us | Wherever that server is |
You decide whether to use these. If you do, you're responsible for telling your callers (see the Terms of Service).
Others. We'll also share information:
- with our own invoicing system (hosted on our same server) to issue GST tax invoices;
- with professional advisers such as our accountant or lawyer, under confidentiality;
- if the law requires it, or to deal with a serious threat to someone's safety, as the Privacy Act allows;
- with a buyer, if we sell the business. We'd tell you first.
10. Google user data
If you sign in with Google, we receive your basic profile (name, email, profile photo link, Google ID). We use it only to create and sign in to your account.
If you connect Google Calendar, we ask for access to your calendar. We use it to:
- copy events from your primary calendar for the next 90 days into our system (start and end times, title, description, and whether you're busy), so the AI doesn't double-book you;
- check live free/busy for times close to now;
- add bookings the AI takes to your calendar, and remove them if they're cancelled.
We store an encrypted access token and the email address of the Google account you connected.
Limited Use. LS Prime Group's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We only use Google data to provide the features above. We don't sell it, use it for advertising, or let people read it except with your permission, for security, to comply with law, or to run the service. We don't use it to train AI models. To avoid double-booking, the AI that answers your calls is given the times and titles of your calendar events.
You can disconnect Google Calendar in the dashboard at any time. When you do, we delete the stored token and stop copying events; ask us and we'll delete the events already copied. You can also remove our access in your Google account settings.
11. How long we keep it
| Information | How long |
|---|---|
| Call recordings | 90 days from the call, then deleted |
| Call transcripts | 90 days from the call, then deleted. We keep the call's date, length and number for billing. |
| Booking details | While the business's account is open, then as for account data |
| Account and setup data | While your account is open. After it closes, we delete it when you ask us to, except what the law requires us to keep |
| Copied Google Calendar events | Refreshed every few minutes while connected; deleted when you ask |
| Invoices and payment records | 7 years, because NZ tax law requires it |
| Server and error logs | 90 days |
| Contact form emails | As long as we need them to deal with your enquiry |
| Website analytics | Google Analytics keeps event data for no more than 14 months |
If a law or a dispute means we must keep something longer, we keep it only for that.
12. How we protect it
- All traffic to our website and app is encrypted (HTTPS).
- Passwords are hashed with bcrypt. Google Calendar and WeChat credentials are encrypted in our database (AES-256-GCM).
- Sign-in uses short-lived access tokens (15 minutes) and a secure, http-only session cookie that lasts up to 7 days.
- Inside a business account, only the owner can change settings, billing and team members.
- Only a small number of our own people can access customer data, and only to run and support the service.
No system is perfectly secure. If we have a privacy breach that has caused or is likely to cause serious harm, we'll tell the Privacy Commissioner and the people affected as soon as we can, as the Privacy Act requires. If the breach involves a business's callers, we'll tell the business straight away.
13. Cookies and similar tools
| Name | What it's for | How long |
|---|---|---|
refresh_token |
Keeps you signed in to the dashboard. Essential. | Up to 7 days |
gcal_oauth_state |
Security check while you connect Google Calendar. Essential. | 10 minutes |
lsprime_ref |
Remembers a referral code from a link you clicked | 30 days |
| A session marker in your browser's local storage | Tells the app you were signed in | Until you sign out |
Google Analytics (_ga, _ga_*) |
Counts visits and pages on hianda.nz | Up to 2 years |
| Google reCAPTCHA | Spam check on the contact page only | Set by Google |
You can block or delete cookies in your browser. The dashboard won't work without the essential ones. To opt out of Google Analytics everywhere, use Google's opt-out browser add-on.
14. Your rights
You can ask us:
- for a copy of the personal information we hold about you (IPP 6);
- to correct it (IPP 7);
- to delete it, where we don't need to keep it.
Email [email protected]. We'll check who you are first. We'll reply within 20 working days. It's free.
If you were a caller to a business. That business is responsible for its call records. Please contact it first. If you contact us instead, we'll pass your request to the business, and help it answer.
Complaints. Tell us first and we'll try to fix it. If you're not happy with our answer, you can complain to the Office of the Privacy Commissioner: privacy.org.nz, 0800 803 909.
15. Children
HiAnda is a service for businesses. Account holders must be 18 or over. We don't knowingly collect information about children, but we can't control who phones a business.
16. Changes to this policy
We'll update this policy when our practices change. We'll change the date at the top. If a change matters, we'll email account holders before it takes effect.
17. Contact
LS Prime Group Limited, trading as HiAnda
20 Sunshine Boulevard, Sunnyvale, Auckland 0612, New Zealand
[email protected]