Privacy policy

1. Scope

This policy explains personal information handled by the AlarmForgeX website, customer portal, licensing and evaluation services. Core CCTV/VMS monitoring runs on the customer’s Windows installation; normal website licensing does not require us to receive camera video, camera passwords or VMS credentials.

2. Information we collect

Depending on how you use the service, we may hold account email, optional business name, password hash, verification status, session/security records, order and payment references, licence requests, Computer ID, hardware-binding hashes, signed licence records, installer/download records, support correspondence, evaluation activation records and administrative audit history, and any name, email, organisation, equipment details and project description submitted via the custom monitoring enquiry form. These enquiry details are reviewed for feasibility and follow-up, not treated as an order.

Private discount records include the intended customer email, discount conditions and a one-way hash of the token. The raw private discount token is designed to be shown to the administrator once and is not stored for later retrieval.

3. Payments and indirect collection

Stripe provides hosted payment processing. Card details are entered into Stripe’s payment environment rather than stored in the AlarmForgeX D1 database. We receive and retain the order state, payment/customer references, refund state and related transaction metadata needed to reconcile payment, fulfil licensing, administer refunds and maintain accounting/audit records.

Some information can therefore reach us indirectly through Stripe or infrastructure/security providers rather than being typed directly into an AlarmForgeX form. This policy explains that collection, its purposes and intended use. Where New Zealand Information Privacy Principle 3A applies to indirect collection, we take reasonable steps to provide the required notice unless a lawful exception applies.

4. Evaluation and licence-status checks

Commercial Evaluation activation can start without requiring a customer account and can store Computer ID, one-way machine identifiers/binding hashes, activation and expiry dates, application version, anonymous installation identifier where supplied, recovery history and rate-limit/security records. Once activated, the evaluation is designed to run locally without continuous website checks.

Compatible commercial software may make an occasional licence-status request when internet is available. The check may send the Computer ID and the signed licence identifier/signature needed to find the issued licence. The service returns only a minimal status such as active, revoked or unknown. Unknown, unavailable or failed checks are designed to fail open and do not by themselves revoke a licence.

5. Why we use information

We use information to create and secure accounts, process orders, verify payment, issue and recover licences, provide downloads, administer discounts and refunds, prevent abuse, respond to support requests, maintain audit trails, meet legal/accounting obligations, evaluate custom-monitoring requests and improve operational reliability.

6. Cookies and security logging

A session cookie supports authenticated access. Security controls may process connection information to rate-limit abuse and investigate suspicious activity. Download analytics distinguish request/stream states and internal traffic; a completed stream is not proof that software was installed.

7. Service providers and overseas processing

We use service providers including Cloudflare for website/database/file infrastructure and Stripe for payments. These providers may process information outside New Zealand. We assess disclosures and processing arrangements under the New Zealand Privacy Act 2020, including Information Privacy Principle 12 where it applies. Where a provider acts only as our agent for storage or processing, New Zealand privacy law may treat that differently from a disclosure to an independent overseas recipient.

8. Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, security and fraud prevention, licence/account administration, accounting/tax records, dispute handling and other lawful requirements. Different records can have different retention periods. We may retain audit records needed to demonstrate a purchase, refund, licence issuance or revocation after an account is no longer active.

9. Access, correction and deletion requests

You may ask what personal information we hold about you and request correction of inaccurate information, subject to the Privacy Act 2020 and other applicable law. Some information cannot be deleted immediately where we have a lawful need to retain it, for example accounting, fraud-prevention, security or dispute records. Contact support@alarmforgex.com.

10. Security and incidents

We use access controls, one-way hashes for passwords/tokens where appropriate, server-side validation and audit records to reduce risk. No internet service can guarantee absolute security. If a privacy breach creates a legal notification obligation, we will handle notification in accordance with applicable law.

11. International customers

This policy is written primarily for New Zealand privacy requirements. Customers in other jurisdictions may have additional mandatory privacy rights. Contact us if you need to exercise a right that applies to you.