1. Who we are.
Infraxus provides fixed fee bookkeeping to owner run businesses in New Zealand, inside the client's own Xero or QuickBooks Online file. All of the work is done by the founder, Liam Collier.
Legal entity: Infraxus LLC, a Wyoming limited liability company in the United States. Mailing address: 167 Madison Avenue, Suite 205 #1088, New York, NY 10016.
Infraxus carries on business in New Zealand, so the Privacy Act 2020 applies to the personal information it handles, wherever that information is stored. This policy is written to the Act's 13 information privacy principles: collect only what is needed, for a stated purpose, from the person where possible; tell them what it is for; keep it secure; let them see and correct it; keep it no longer than needed; use and disclose it only for that purpose; and protect it when it leaves New Zealand.
For anything in this policy, including a request to see or correct your information, write to security@infraxus.com. That address reaches the founder directly.
2. What this covers.
This policy covers personal information of the people who contact us through infraxus.co.nz, who book a call, who start bookkeeping with us, and who run the businesses we work for.
Personal information means information about an identifiable individual, which is how the Act defines it. In this business that is almost always business contact information rather than anything about private life.
It does not cover the bookkeeping ledger itself. Your accounting file is your own record of your business, held in your own Xero or QuickBooks Online subscription, and it is dealt with in section 6. The records inside that file name your own customers, staff and suppliers. For those, Infraxus works on your instructions and only to do the bookkeeping; you remain the business responsible for that information under the Act, and we handle it only as the work needs.
3. What we collect and why.
We collect the smallest set of information the work needs, and we collect it from you.
| What | Why we have it |
|---|---|
| Your name and the way you asked to be contacted: a mobile number or an email address | To get back to you about your enquiry, by text, call or email as you chose. Section 4 covers phone numbers and texts. |
| Your business name, which accounting platform your books are on, and your turnover band | To know which file the work happens in, which set of access instructions to send you, and which fixed monthly fee applies, which is set by turnover. |
| The page you were on, the search that brought you here and the advertising click identifier | When you arrive from a Google ad and later contact us, the record of your enquiry carries the page, the search term and Google's click identifier, so we can tell which advertising produced a real enquiry and stop paying for advertising that does not. Nothing in this identifies you to Google beyond what Google already knows about the click. |
| Your work email address, once you are a client | To send the access instructions, the monthly note, and anything about your subscription. It is also the address we use to verify a request under section 8. |
| The business details that go on your invoice, once you are a client | To bill the monthly fee and keep the records New Zealand tax law requires us to keep. |
| Website analytics | To see which pages and which parts of the forms work and which confuse people, so we can fix them. |
How the analytics work
Analytics run through PostHog, behind a first party proxy on our own domain, so the requests go to infraxus.co.nz rather than to a third party analytics domain. We record a set of explicit events, such as page views, taps on the call and text buttons, and the steps of the forms, and we enable PostHog's autocapture, which records interactions with links, buttons and form controls by the text the element shows rather than by anything you type. The value of every input is stripped before the event leaves your browser.
Session replay runs on this site. A replay is an anonymous reconstruction of a page session that shows where a form or a price list trips people up. Every form input is masked at capture, so what you type into a name, phone, email or business name field is never recorded and never leaves your browser as part of a replay.
We also use Google's advertising tag to measure whether a visit that came from a Google ad led to a call, a text, a booking or a form. No email address or phone number you enter is sent to Google. If your browser sends a Do Not Track or Global Privacy Control signal, the tag does not run. Google's handling of the visit data it does receive is governed by Google's own terms.
You can keep your activity out of analytics entirely: see section 8.
4. Phone numbers and texting.
Infraxus texts and calls from one New Zealand number, 0XX XXX XXXX, and Liam sends every message himself. We use your phone number in three ways only:
- To reply when you text us. If you text 0XX XXX XXXX, Liam replies by text. Your text is your consent to that conversation.
- To call or text you back when you ask us to. If you leave your details on this website and choose to be texted or called, the form says beside the number field: by sending this you agree to be called or texted about your enquiry. That is what we do with the number, and nothing else.
- To talk with you about the bookkeeping, once you are a client. Questions about a transaction, a receipt or a month end, from Liam himself.
Messages are conversational and come from one person. We do not send marketing texts, bulk texts or texts to numbers that have not contacted us or asked to be contacted. If you would rather not be texted, say so by text or email and that is the end of it; Liam reaches you by email instead, and the bookkeeping carries on.
Your mobile number and the content of your messages are not shared with anyone for marketing, and leave our systems only to the carriers that deliver the messages.
5. What we do not collect.
We never ask for, and never hold, your online banking credentials. Not a username, not a password, not a one time code. Nobody at Infraxus needs them and nobody will ever ask you for them. If you are ever sent a message that appears to come from us asking for banking credentials, it did not come from us: tell us at security@infraxus.com.
Your bank data stays in your own accounting file and in your bank's own connection to that file. The bank feed is a link between your bank and your Xero or QuickBooks Online account. It is set up by you, it belongs to you, and it does not pass through Infraxus.
Through this website we also do not collect, and have no use for, IRD numbers, health information, precise location or biometric information. Where the bookkeeping later needs your business's IRD number, for a GST return or payday filing under the payroll and GST add on, it is used inside your own accounting file and with Inland Revenue, and nowhere else.
6. Where the data lives, outside New Zealand.
Infraxus LLC is a United States company, and the services that hold information for it, other than the carriers that deliver calls and texts, are outside New Zealand. Under the Act, a provider that stores or processes information for us without using it for its own purposes is treated as part of us, and we stay responsible for it. Where sending information overseas counts as a disclosure, principle 12 of the Act allows it only where the information stays protected to a comparable standard. These are the protections:
- Each provider below is bound by its own data processing terms, under which it may use the information only to provide its service to us and must protect it with safeguards comparable to the Act's.
- The information is encrypted in transit and at rest, as the security page describes.
- It is the minimum the work needs, as section 3 lists, and none of it is sold or shared for anyone else's purposes.
- You can ask at any time for the current list of providers, the exact region your record is held in, and for your record to be deleted, as section 8 describes.
These are the services, what each one holds, and where. Your accounting file is not on this list because it is not ours: it sits in your own Xero or QuickBooks Online subscription, we work inside it as a user you invited, and it stays with you in full if you leave. Where Xero or Intuit store that file is governed by your own subscription with them.
| Service | What it holds | Where |
|---|---|---|
| Vercel | Hosting for infraxus.co.nz and the form endpoint, and the ordinary request logs a host keeps for security and performance. | Outside New Zealand |
| Supabase | The record of your enquiry: what you gave us on a form, when, the page and search you came from, and the advertising click identifier. | Outside New Zealand. On request we will tell you the exact region in writing. |
| Dropbox | Working files you send Liam for the bookkeeping, such as a statement or a receipt, in access controlled, multi factor gated storage on the founder's account. | Outside New Zealand |
| Resend | Transactional email delivery: the alert to Liam when you leave your details, and the messages we send you, with the delivery records for them. | United States |
| Calendly | The name, email, phone number and time you give when you book a call, and the answers to Calendly's own questions. | United States |
| Stripe | Payment processing once you continue past the free month: the card you add on Stripe's own page and the billing record. Card details never touch our systems. | United States |
| PostHog | Website analytics and the session replays described in section 3, with every form input masked at capture. | United States |
| Advertising measurement as described in section 3. | United States | |
| Telecommunications carriers | The delivery of calls and text messages to and from 0XX XXX XXXX. | New Zealand |
If a privacy breach affecting your information is likely to cause serious harm, the Act requires us to notify the Office of the Privacy Commissioner and the people affected, and we do. Clients are told within 24 hours of a breach being confirmed in any case: what happened, what was affected and what was done about it.
7. How long we keep it.
Invoices and payment records: seven years, the period New Zealand tax law requires business records to be kept. They are outside a deletion request for that reason.
Enquiry records: kept while they are useful for answering you and for the advertising measurement in section 3, and deleted on request.
Text message history: on the phone for the length of the relationship, and deleted on request.
Website analytics: for PostHog's retention period, after which they age out of the analytics system. Session replays are retained for 30 days and then deleted.
Your accounting file: not ours to keep or to delete. It stays in your own Xero or QuickBooks Online subscription throughout and after. Our access to it is removed within 30 days of the work ending, and you can remove it yourself at any time.
8. Seeing and correcting what we hold.
Principles 6 and 7 of the Privacy Act 2020 give you the right to ask whether we hold personal information about you, to see it, and to ask for it to be corrected. We extend the same to anyone who contacts us, wherever they are. You may ask us to:
- Access: tell you what personal information we hold about you, where it came from, and who it has been disclosed to.
- Correct: fix personal information that is wrong or incomplete. If we do not agree that it is wrong, you can ask us to attach your statement of the correction you sought, and we will.
- Delete: delete what we hold, other than the records section 7 says we are required to keep.
- Port: give you a copy in a portable, machine readable format.
We do not sell your information
Infraxus does not sell personal information, and does not share it for anyone's advertising.
You can keep your activity out of our analytics at any time. Set the "Do Not Track" or Global Privacy Control signal in your browser, use a tracker blocking extension, or ask us at security@infraxus.com and we will exclude you.
How to make a request
Email security@infraxus.com and say what you want. There is no form and no portal.
Identity is verified by the email address or phone number we hold for you. Send the request from the address or number we have and that is enough; we will not ask you for identity documents. If you write from another address, we will ask you to confirm from the one on the account, because sending someone else's records to a stranger is the greater risk.
We answer as soon as we can, and in any case within 20 working days, which is the time the Act allows. In practice it is usually the same week, because there is one person to ask. If a request is genuinely complex we may need longer, and if so we will tell you within the 20 working days why, and when to expect the answer.
You will not be charged for a request, and we will not treat you differently for making one.
Someone else may make a request for you. We will ask for written proof that you gave them permission, and we may still confirm with you directly from the address on the account.
If we refuse a request, in whole or in part, we will tell you why and that you can complain to the Privacy Commissioner, as section 9 describes. You may also reply to the decision at the same address and ask us to look again.
9. Complaints.
If you believe we have handled your information in a way that breaches this policy or the Privacy Act 2020, write to security@infraxus.com first. We acknowledge a complaint within five working days and answer it within 30 days.
If you are not satisfied with the answer, you can complain to the Office of the Privacy Commissioner, the independent body that handles privacy complaints in New Zealand, at privacy.org.nz.
10. Children.
Infraxus is a service for businesses. It is not directed to anyone under 18, we do not market to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, write to security@infraxus.com and we will delete it.
11. Changes to this policy.
Last updated 15 October 2026.
This policy will be updated when what we do changes, and the date above will change with it. Where a change materially affects how we handle personal information, active clients are told by email rather than left to notice the new date.
12. Contact.
For any privacy question or request:
| Firm | Infraxus |
|---|---|
| Entity | Infraxus LLC, a Wyoming limited liability company in the United States |
| Mailing address | 167 Madison Avenue, Suite 205 #1088, New York, NY 10016 |
| security@infraxus.com | |
| Phone | 0XX XXX XXXX |
Related pages: the terms of use, and security and your data.