Privacy Policy

HostPilot provides managed hosting, domain registration and a console for your team. This policy explains how we handle personal information when you visit our website, create an account, use our services or get in touch with us.

It covers information we handle to run HostPilot. If you use our services to host your own website or application, you are responsible for telling your users how you handle their information. Questions about a website hosted with us should first go to its operator.

The information we collect depends on which services you use. It may include:

• Account details, such as your name, email address, sign-in credentials, workspace membership and role.
• Billing and contact details, including your organisation, billing address, invoices, payment status and payment method references. Card details are collected by Stripe through its payment pages.
• Domain registration details, including registrant, administrative and technical contact names, addresses, email addresses and phone numbers.
• Hosting and service information, such as resource names, configuration, usage, deployment records and activity history.
• Messages you send us, information you enter into AI features, and technical records such as IP addresses, browser details, session information and error logs.

We collect information directly from you, from people managing your workspace, and from service providers that process hosting, domain or payment activity for your account.

We use personal information to create and secure accounts, provide hosting and domain services, manage team access, process payments and send service or billing messages. We also use it to respond to support requests, investigate problems, prevent misuse and meet our legal obligations.

Activity records help your team and our support staff understand changes to your services. Technical and usage information helps us monitor reliability and improve HostPilot.

You can choose not to provide information, but we may be unable to create your account or deliver a service if required details are missing. For example, domain registrations require valid contact information.

We share information where needed to deliver the services you use. This includes SiteHost for hosting and domains, relevant domain registries, Stripe for payments, and providers that run our application, store account records, deliver email or monitor service reliability, including Vercel, Convex, Resend and Better Stack.

People in your workspace can see information according to their role. Authorised HostPilot staff can access account information to provide support and operate the service. If your organisation connects Xero, relevant contact and invoice details are shared with Xero when that integration is used.

Domain registries may make registration information available under their rules. We may also disclose information when required or permitted by law, or when you authorise us to do so.

HostPilot uses cookies to keep you signed in and maintain your session. We also use your browser’s local storage to remember preferences, such as your choice of light or dark mode.

You can clear or block cookies and local storage through your browser settings. Doing so may sign you out, reset your preferences or prevent parts of the console from working. Services you open from HostPilot, such as payment pages, have their own privacy and cookie policies.

When AI features are enabled, assistant messages and selected service information may be processed by AI providers through Vercel’s AI Gateway. These features help answer questions, explain failures, suggest actions and prepare summaries about your hosting.

We limit the account context supplied to these features, but anything you type into an assistant message may be sent to the AI provider. Please avoid including passwords, payment details or other sensitive information. Conversation history and usage records may be stored as part of providing these features.

Our hosting services use SiteHost’s New Zealand infrastructure. Providers supporting the HostPilot platform may store or process account information in other countries. Hosting a site in New Zealand does not mean all information used to operate your account stays in New Zealand.

We use access controls, authentication and activity logging to help protect information. Where information is handled overseas, we are responsible for meeting the applicable requirements of New Zealand’s Privacy Act 2020.

We keep personal information for as long as it is needed to provide services and for legitimate billing, security, dispute-resolution or legal purposes. Closing an account does not necessarily remove every record immediately. Contact us to discuss a deletion request and any records we need to retain.

Under New Zealand’s Privacy Act 2020, you can request access to the personal information we hold about you and ask us to correct it. If we decline a correction, you can ask for a statement of the correction you sought to be attached to the information.

To make a request or raise a privacy concern, email support@hostpilot.co.nz. We may need to verify your identity before releasing or changing information. You can also update available profile and workspace details in the console.

If you are unhappy with how we handle a privacy concern, you can contact the Office of the Privacy Commissioner.

We may update this policy as our services or privacy obligations change. The latest version will be available on this page.