Who we are
Ngaro is [Ngaro Limited, NZBN ●●●●●●●●●●●●●], a company based in Auckland, Aotearoa New Zealand. We build a platform that lets people turn their own documents into a private AI assistant.
For the purposes of the Privacy Act 2020 we are the agency responsible for the information described here. If you are somewhere that uses different language, we are the data controller.
Anything to do with privacy — a question, a request, a complaint — goes to ngaro.help@gmail.com.
What this covers
This policy covers the Ngaro website at ngaro.ai, our waitlist, the builder you use to create an AI, portals we host for you at ngaro.app, the desktop app you can download, and the API your finished AI can expose.
There is one significant thing it does not cover, and it is not an oversight. Once you have downloaded your AI, the conversations you have with it and the documents it reads are not covered by this policy — because they never reach us. There is nothing for us to describe, protect, or hand over. That is the entire point of the download tier.
Two architectures, two answers
Almost every question about your privacy has a different answer depending on which version you chose, so it is worth settling that first.
If you downloaded your AI, we hold your account details and your billing record. That is all. Your documents, your knowledge base and every conversation you have with your AI live on your computer. They are not copied to us, not synchronised, and not readable by us. If we vanished tomorrow your AI would keep working.
If you host with us, we hold your documents, the knowledge base built from them, and your conversations, on servers we rent. We can technically access that data because we have to be able to serve it back to you. We do not read it, we do not train on it, and access is limited to the few people who need it to keep the service running.
What we collect
Things you give us
- Your name, email address and profile image, when you sign in with Google.
- Whatever you type into our contact form or the waitlist.
- Documents you upload to build a knowledge base.
- What you say to the onboarding agent while you are building your AI.
- Your computer's specifications, if you let us detect them, so we can recommend a model that will actually run well on it.
- Payment details — which go straight to Stripe. We never see or store your card number.
Things we collect automatically
- Server logs: your IP address, the pages you asked for, and when.
- Your browser and operating system.
- Which features you use, and your credit ledger — what you spent and on what.
Things we collect from somewhere else
Sometimes we end up holding information that did not come from you. That has its own section below, because a new part of the Privacy Act now governs it.
Information about other people
If you ask the onboarding agent to gather knowledge from the web — public recipes, product manuals, industry guides — it fetches that material and puts it in your knowledge base. Sometimes that material contains personal information about people who have never heard of Ngaro.
Since 1 May 2026, information privacy principle 3A of the Privacy Act 2020 has required agencies that collect personal information indirectly to take reasonable steps to make the person concerned aware of it. Much of what the agent gathers is already publicly available, which is one of the exceptions. Not all of it is. So here is how we handle it.
- The agent prefers publicly available sources.
- Before your build finishes, you are shown every source in the knowledge base editor and have to approve the list. Nothing is gathered invisibly.
- You can remove any source at any time, during the build or years later.
- You are responsible for what you direct the agent to collect, and for having a proper basis to hold information about other people.
If you think we hold information about you that arrived this way, email ngaro.help@gmail.com and we will tell you what we have and remove it.
Cookies and tracking
We run no analytics. We set no tracking cookies. There is no advertising pixel on this site and no third party watching you move around it.
The only cookies we set are the session and authentication cookies that make signing in work. Without them you could not stay signed in.
One honest caveat: this site loads the Geist typeface from Google Fonts, so Google receives your IP address when a page loads. We intend to serve the fonts ourselves and remove that.
Why we use it
- To give you what you asked for — building your AI, running it if you host with us, keeping your knowledge base intact.
- To bill you — subscriptions, credits, invoices, and the tax records we are required to keep.
- To keep the service working — diagnosing faults, preventing abuse, enforcing rate limits.
- To answer you — when you email us or fill in the form.
- To email you about Ngaro — only if you asked us to, and you can stop it at any time.
Where the law asks us to name a legal basis, the first four are performing our contract with you or our legitimate interest in running a functioning business, and the last is your consent.
Who else touches it
We use other companies to run parts of the service. Here is the complete list, what each one does, and where it is.
| Who | What for | Where |
|---|---|---|
| Sign-in, and the typeface on this site | United States | |
| Stripe | Payments and invoices | United States / Australia |
| Hetzner | Our servers, hosted AI instances, hosted knowledge bases | Germany / Finland |
| Supabase | Contact form and waitlist entries | Sydney, Australia |
| Anthropic or OpenAI | The onboarding agent, during your build session only | United States |
| Brave Search | Web search on the hosted tier, only when you turn the internet toggle on | United States |
| Our own search instance | Web search on the download tier, only when you turn the toggle on | Germany / Finland |
The onboarding agent row deserves saying out loud. While you are building your AI, the agent that interviews you is a commercial AI model run by Anthropic or OpenAI, so what you type during the build is processed by them under their terms. That is the one moment in the whole product where a third-party AI is involved. The AI you end up with does not work that way — it runs on an open-weight model, on your machine or on ours, and it does not call anybody.
We do not sell, rent, trade or licence personal information to anyone. There are no advertising networks, no data brokers, and no analytics companies in this list. If that ever changed we would have to tell you, and we would rather not have to.
Sending information overseas
Information privacy principle 12 of the Privacy Act governs sending personal information to someone outside New Zealand. Several of the companies in the table above are outside New Zealand, so this applies to us and it is worth being direct about it.
That table is the complete list — there is no longer one hiding elsewhere. Each of those companies is contractually required to protect what we send them to a standard comparable to the Privacy Act. Where a country's own law is weaker than New Zealand's, the contract carries the obligation instead.
If you host with us, your documents and knowledge base sit on Hetzner servers in Germany or Finland. If you downloaded your AI, none of this touches you — nothing of yours goes anywhere.
The internet toggle
Every AI built on Ngaro has a switch that decides whether it can reach the internet during a conversation. It is off when you get it, and we never turn it on for you.
Off means no outbound calls at all while you are talking to it. Your questions and its answers stay where they are. On the downloaded app this is enforced by the application itself, which blocks any network request that is not headed for your own machine — the model is not asked politely to behave, it is given no way to search.
On means your questions can reach a search provider, so they leave your machine. That is the trade, it is yours to make, and you can change it back at any time from the settings panel.
Your API key
Your finished AI can issue an API key so your other software can talk to it. We log requests made with that key — timestamps, volume, and whether they succeeded — so we can apply rate limits and spot abuse. We do not log the contents of your prompts or the answers.
Once you give that key to another tool, whatever that tool does with your data is between you and them. We cannot see it and we cannot control it. There is more on this in the terms of service.
What we never do
- We do not train any model on your documents, your conversations, or anything else of yours.
- We do not read your documents for any purpose other than answering your own questions with them.
- We do not sell, rent or trade your information.
- We do not use your content to improve our product, benchmark it, or demonstrate it.
This is not a promise we are making reluctantly to satisfy a regulator. It is the reason the product exists. A version of Ngaro that mined your documents would have no reason to be built.
How long we keep things
| What | How long |
|---|---|
| Account details | While your account is open, then 30 days |
| Hosted documents, knowledge bases and conversations | 30 days after you cancel, then permanently deleted |
| Backups | Purged on their own rolling cycle, which runs behind live data |
| Billing and tax records | 7 years — New Zealand tax law requires it |
| Server and API logs | 90 days |
| Waitlist entries | Until we launch, or until you unsubscribe |
| Contact form messages | 24 months |
The backup row is the honest one. When you delete something it goes from the live service immediately, but backups are taken on a schedule and a copy can survive in one until that backup rolls over. Any service that claims instant and total erasure either does not take backups or is not telling you the truth.
You can ask us to delete your information sooner. See your rights.
Security
Everything travels over encrypted connections. Data we hold for you is encrypted at rest. Access is limited to the people who need it to keep the service running, and we keep that number small.
The download tier has an advantage no amount of security engineering can match: data that never reaches our servers cannot be taken from our servers. If a breach of Ngaro would be catastrophic for you, download your AI rather than hosting it. We would rather tell you that than sell you the hosted tier.
And the limit. No system is perfectly secure, ours included. Anyone who tells you their service cannot be breached is selling something. What we can promise is that we hold as little as possible, that we encrypt what we hold, and that if something goes wrong you will hear it from us.
If something goes wrong
If there is a privacy breach and it is likely to cause serious harm, the Privacy Act 2020 requires us to notify the Office of the Privacy Commissioner and the people affected as soon as we reasonably can. We will do that, and we will tell you what happened rather than what our lawyers would prefer we said.
For users covered by the GDPR, the equivalent notification is made within 72 hours of us becoming aware of the breach.
Your rights
The Privacy Act gives New Zealanders the right to see what we hold about them and to have it corrected. Other countries give people more. Rather than sorting you by passport, we give everyone the same set, wherever you live:
- See it — ask what we hold about you and get a copy.
- Correct it — tell us when it is wrong and we will fix it.
- Delete it — ask us to erase it, subject to records we are legally required to keep.
- Take it — get your documents and knowledge base in a portable format.
- Object — tell us to stop a particular use.
- Withdraw consent — for anything you consented to, at any time.
- Complain — to us, and to a regulator.
Email ngaro.help@gmail.com. We reply within 20 working days, which is the limit the Privacy Act sets. Usually much sooner. We may need to check you are who you say you are first — handing your documents to somebody who asked nicely would be its own privacy breach.
One thing we will not claim: Ngaro is a New Zealand company and we have not appointed a representative in the EU or the UK. We give you the rights above because they are the right rights, not because we have certified anything. If that changes we will say so here.
Complaints
Come to us first — ngaro.help@gmail.com. Most things are a misunderstanding and take one email to sort out.
If we cannot resolve it, you can complain to the Office of the Privacy Commissioner at privacy.org.nz, or on 0800 803 909. You do not need our permission and you do not need to tell us first, though it usually helps.
If you live somewhere with its own privacy regulator, you can complain to them instead.
Children
Ngaro is for people aged 16 and over. We do not knowingly collect information from anyone younger. If we find out we have, we delete it. If you think a child has given us their information, email us and we will deal with it.
Emails from us
We only send marketing email to people who asked for it. Every one of those emails has a working unsubscribe link, and we action unsubscribes within five working days — which is what the Unsolicited Electronic Messages Act 2007 requires, and also just basic manners.
Service messages are different: invoices, security notices, a warning that your free hosting period is about to end. Those are part of the service and you cannot opt out of them while your account is open.
Changes to this policy
We will update this page as the product grows. The date at the top always tells you when it last changed.
If a change materially affects how we handle your information, we will email account holders before it takes effect rather than quietly editing the page and hoping nobody notices.
Contact us
Questions, requests, complaints, or a correction to something on this page: ngaro.help@gmail.com.
Ngaro is based in Auckland, Aotearoa New Zealand.