FNA Manager Privacy Policy
Version 3.0 — Effective 15 October 2026
This Privacy Policy explains how FNA Manager Limited (Company Number 9348543, NZBN 9429052913075), trading as FNA Manager, collects, uses, stores, and protects personal information when you use our services. We are committed to complying with the New Zealand Privacy Act 2020 and the Information Privacy Principles (IPPs).
We process your information on the basis of our contract with you (our Terms and Conditions), our legitimate business interests, and our legal obligations — not solely on the basis of consent.
Privacy Officer
Our Privacy Officer is responsible for ensuring compliance with the Privacy Act 2020. You can contact them at:
- Email: william@fnamanager.com
- Post: FNA Manager Limited, 59a Jack Boyd Drive, RD 2, Mangawhai 0573, New Zealand
What personal information we collect
We collect the following categories of personal information:
Information you provide directly
- Account information: Your name and email address, provided via Xero single sign-on (SSO) when you register.
- Billing information: Payment method details (processed and stored by Stripe — we do not store your credit card numbers).
- Support and communications: Any information you provide when you contact us, submit a contact form, or send us feedback.
Information synced from Xero (indirect collection)
When you connect your Xero account, we sync the following data from your Xero organisation:
- Contacts: Names, email addresses, phone numbers, and addresses of your customers and suppliers.
- Employees: Names, pay rates, wages, and employment details from Xero Payroll NZ.
- Financial data: Invoices, bills, chart of accounts, assets, and financial reports (P&L, balance sheet).
Important: Employee and contact data is collected indirectly — these individuals may not have interacted with FNA Manager directly. We rely on you, as the Xero account holder, to have appropriate authority to share this data with us for the purposes of providing the Services. If you employ staff whose data is synced via Xero Payroll, you should inform them that their employment data is processed by FNA Manager.
Information collected automatically
- Usage data: IP address, browser type, pages visited, and interaction patterns — collected via Google Analytics to help us understand how the Services are used.
- Session data: Authentication tokens and session identifiers necessary to keep you logged in.
Why we collect your information
We collect and use personal information for the following purposes:
| Purpose | Legal basis |
|---|---|
| Providing the Services (syncing data, displaying dashboards, job costing, etc.) | Contract |
| Processing payments and managing your subscription | Contract |
| Sending service-related communications (billing, security alerts, legal notices) | Contract |
| Verifying your identity for security purposes | Contract / Legitimate interest |
| Improving the Services and fixing bugs | Legitimate interest |
| Understanding how the Services are used (analytics) | Legitimate interest |
| Preventing fraud and ensuring security | Legitimate interest / Legal obligation |
| Retaining financial records as required by law | Legal obligation (Tax Administration Act 1994) |
| Sending marketing communications (optional — you can unsubscribe at any time) | Consent |
We do not use your personal information for advertising, profiling, or automated decision-making.
Who we share your information with
We share personal information only with the service providers necessary to operate FNA Manager. We never sell your data.
| Service provider | Purpose | Data shared | Location |
|---|---|---|---|
| Xero | Accounting data sync (bidirectional) | Contacts, invoices, employees, financial data | Australia / Global |
| Stripe | Payment processing | Billing details, email address | United States |
| Digital Ocean | Cloud hosting and data storage | All application data (encrypted) | Australia |
| Resend | Transactional email delivery | Email addresses, email content | United States |
| Sentry | Error monitoring and debugging | Error context (may include user IDs, request data) | United States |
| Analytics (Google Tag Manager) and bot prevention (reCAPTCHA) | IP address, browser data, usage patterns | United States | |
| Bunny Fonts | Serving the website's typeface | IP address, browser data | European Union / Global |
| jsDelivr | Serving charting libraries used in the app | IP address, browser data | Global |
We may also disclose personal information if required by law, court order, or to protect our rights, property, or safety.
In the event of a merger, acquisition, or sale of our business, your information may be transferred to the successor entity, who will be bound by this Privacy Policy.
Cross-border data transfers
Your data may be transferred to and stored in countries outside New Zealand, specifically Australia (Digital Ocean hosting) and the United States (Stripe, Resend, Sentry, Google). We take the following steps to protect your data:
- All data is encrypted in transit using TLS and at rest where supported by our hosting provider.
- Our service providers are bound by their own privacy policies and, where applicable, contractual obligations to protect your data.
- We only transfer data to providers that maintain security practices comparable to those required under New Zealand law.
Cookies and tracking
FNA Manager uses the following types of cookies:
Essential cookies (required)
- Session cookie: Keeps you logged in while you use the Services. Expires when you close your browser or after inactivity.
- CSRF token: Protects against cross-site request forgery attacks. Expires with your session.
Analytics cookies
- Google Analytics / Google Tag Manager: Collects anonymous usage data (pages visited, time on site, browser type) to help us understand how the Services are used. We rely on our legitimate interest in understanding and improving the Services, not on your consent, so these load without a prompt. You can opt out by using a browser extension such as Google's Analytics opt-out add-on or by adjusting your browser cookie settings.
reCAPTCHA
- Google reCAPTCHA: Used on our contact form to prevent automated abuse. This may set cookies and collect usage data. Google's Privacy Policy and Terms of Service apply.
Data retention
We keep personal information for the following periods. "The organisation" means a Xero organisation connected to FNA Manager and everything synced into or entered against it.
| What | How long | Why |
|---|---|---|
| An organisation on trial or subscribed | For as long as the trial or subscription lasts | Providing the Services |
| An organisation whose free trial ended without a subscription | 90 days after the trial ends, then permanently deleted | So you can subscribe and carry on; a stated limit so data is not held indefinitely |
| An organisation whose subscription has ended, or that nobody belongs to any more | Six months after the subscription ends, then permanently deleted | As above |
| An organisation you asked us to delete | Locked for 30 days, during which anyone in it can export the data or cancel; then permanently deleted | Protection against a mistaken or unauthorised deletion |
| A Xero demo company you delete | Deleted immediately | It is sample data, visible only to you, and can be reconnected |
| Our own billing records for an organisation | 7 years, including after the organisation is deleted | Tax Administration Act 1994 |
| Your login (name and email) and your acceptance of our Terms | For as long as you have a login; deleting an organisation does not delete the people in it | So you can use any other organisation you belong to, and so we can show which Terms you agreed to |
| A record that an organisation was deleted (its name, when, and why) | Kept | So a deletion can be re-applied if we ever restore from a backup, and so we can answer questions about it |
| A data export you requested | The download link works for 7 days | Providing the export |
| Error logs (Sentry) | Up to 90 days, then automatically purged | Fixing faults |
| Analytics data (Google) | Subject to Google's own retention policies | Understanding how the Services are used |
Before a paused organisation is deleted we email everyone in it 30 days and 7 days beforehand, and after 30 days paused we disconnect from its Xero organisation so nothing further is synced. Copies in our backups are removed in the ordinary course of our backup cycle. We may delay a deletion, and tell you so, where a dispute, legal claim, chargeback, insolvency process or legal obligation requires the data to be kept.
Deleting your data
You can delete an organisation yourself, from the Accounts and users page in the Services. Only the subscriber or a financial adviser user of the organisation in Xero, or the last person left in it in FNA Manager, can do this. The organisation is locked for everyone straight away and everyone in it is emailed; for 30 days anyone in it can export its data or cancel the deletion; then it is permanently deleted and we disconnect from it in Xero. This is available even while the organisation is paused for non-payment, and does not depend on paying any outstanding amount.
Deleting an organisation removes everything synced into or entered against it — including contacts' and employees' details synced from Xero — from FNA Manager. It changes nothing in Xero, which remains your accounting record. Leaving an organisation removes only your own login from it and deletes nothing.
Data security
We take the security of your personal information seriously. Our measures include:
- Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS.
- Encryption at rest: Data stored on Digital Ocean is encrypted using server-side encryption.
- Access controls: Access to personal information is restricted to authorised personnel who need it to provide the Services.
- Authentication: We use Xero OAuth2 for authentication — we do not store passwords.
- Regular updates: We keep our software dependencies up to date and monitor for security vulnerabilities.
No system is 100% secure. While we use reasonable measures to protect your data, we cannot guarantee absolute security against all threats.
Privacy breach notification
In accordance with Part 6 of the Privacy Act 2020, if we become aware of a notifiable privacy breach — a breach that it is reasonable to believe has caused, or is likely to cause, serious harm to any affected individual — we will:
- Notify the Office of the Privacy Commissioner as soon as practicable;
- Notify affected individuals as soon as practicable, including details of the breach, what information was involved, and steps they can take; and
- Take reasonable steps to contain the breach and prevent recurrence.
Your rights
Under the New Zealand Privacy Act 2020, you have the following rights:
- Access (IPP 6): You can request a copy of the personal information we hold about you. We will respond within 20 working days.
- Correction (IPP 7): You can request that we correct any inaccurate or incomplete personal information.
- Deletion: You can delete an organisation yourself as described under Deleting your data, and you can ask us to delete your login and any other personal information we hold about you, except where we are required by law to retain it (such as our billing records).
- Data export: You can export an organisation's data yourself, free of charge, at any time — including while it is paused for non-payment or scheduled for deletion — from the Accounts and users page. It comes as CSV files with a data dictionary. You can also ask us for a copy.
- Withdraw from marketing: You can unsubscribe from marketing communications at any time using the unsubscribe link in our emails.
To exercise any of these rights, contact our Privacy Officer at william@fnamanager.com.
Children
FNA Manager is a business service intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected information from a person under 18, we will take steps to delete it.
Anonymised and aggregated data
We may collect and use anonymised and aggregated data (from which you cannot reasonably be identified) to improve the Services and develop industry benchmarks. This data is not personal information and is not subject to this Privacy Policy.
Third-party services
The Services integrate with third-party services (principally Xero). Each third-party service has its own terms and privacy policy that govern your use of that service. We are not responsible for the privacy practices of third-party services.
International users
FNA Manager is a New Zealand company primarily serving New Zealand businesses. This Privacy Policy is governed by New Zealand law, including the Privacy Act 2020. If you are located outside New Zealand and have questions about how your local privacy laws may apply, please contact us at william@fnamanager.com.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email. The updated policy will be posted on the Site with a new version number and effective date.
If someone sent you an estimate through FNA Manager
A business that uses our software sent you an estimate. This section is for you, not for them.
- What we received, and from whom: that business gave us your name and email address so we could deliver their estimate to you. We did not get your details from anywhere else.
- What we record: that the estimate was sent to you, and when. If you open the estimate page we host, we record that too.
- Who we share it with: the business that sent you the estimate. Nobody else, unless we are required by law.
- What we do not do: we do not use your details for marketing, and we do not sell them.
- Who you are actually dealing with: the estimate, its pricing and any agreement you reach are between you and the business that sent it. We provide the software they used. We are not a party to it, and we do not check prices, scope, or whether they hold the licences and insurance for the work.
- How long we keep it: for as long as the business that sent it uses our service, and then in line with the retention periods above.
- Your rights: you can ask us for a copy of what we hold about you, or ask us to correct it. Email william@fnamanager.com. If you would rather not receive estimates this way, ask the business that sent it to contact you another way — they control who they send to.
Complaints
If you are not satisfied with how we have handled your personal information, you can:
- Contact our Privacy Officer at william@fnamanager.com.
- If we cannot resolve your concern, you may lodge a complaint with the Office of the Privacy Commissioner.
Contact
For any questions about this Privacy Policy or our privacy practices, contact us at william@fnamanager.com.
Version 3.0 — Last updated: 15 October 2026
Previous versions: 2.0 (30 March 2026), 1.0 (24 June 2024)