Privacy Policy

1.1 Entity: Eek Mechanical Ltd, a company registered in England and Wales, trading as EEK Mechanical. We operate misfuel recovery and roadside assistance services across New Zealand.

1.2 Contact: For all privacy inquiries, requests, or complaints:

2.1 Information You Provide:

• Full name and contact details (phone number, email address)
• Physical address and location data (for service dispatch)
• Vehicle information (registration, make, model, year, colour, fuel type)
• Details about the issue or service required
• Payment information (processed securely via Stripe — we do not store full card details)
• Insurance information (where you request an insurance report)
• Any other information you provide during service or communications

2.2 Information Collected Automatically:

• IP address, browser type, device information, and operating system
• Pages visited, time spent, and interactions on our website
• Referring URLs and search terms
• Location data derived from your IP address or provided during booking

2.3 Information from Third Parties:

• Referral information from insurers, roadside assistance providers (e.g., AA), or other partners
• Payment confirmation data from Stripe
• Vehicle data from the NZTA Motor Vehicle Register (where required for service delivery)

2.4 Call Recordings and Transcripts:

• All phone calls to and from EEK may be recorded for quality assurance, training, dispute resolution, and legal compliance
• Voicemail messages are recorded and transcribed
• Call recordings and transcripts are stored securely and retained in accordance with Section 8

2.5 AI-Processed Communications:

• SMS, email, WhatsApp, and portal messages sent to or from our AI agents (SquEEK, Laura, Whitey, and any other) are collected and stored
• AI voice calls conducted through our automated phone system are recorded and transcribed
• AI-generated summaries and analysis of communications are retained as part of job records

We use your personal information for the following purposes:

3.1 Service Delivery: Dispatching misfuel recovery and roadside assistance, coordinating with contractors, processing bookings, and communicating about your service.

3.2 AI Communication: Our AI agents (including SquEEK for text, Laura and Whitey for voice calls, and any other AI agents) process your messages and calls to provide automated status updates, answer questions, relay information between parties, and facilitate service delivery.

3.3 Payments: Processing payments, issuing invoices, managing refunds, and debt recovery.

3.4 Insurance Reports: Generating insurance reports at your request, including vehicle condition assessments and service records.

3.5 Quality Assurance: Monitoring and improving service quality, training staff and AI systems, and resolving complaints.

3.6 Legal Compliance: Complying with legal obligations, responding to legal process, and protecting our legal rights.

3.7 Safety and Security: Protecting against fraud, misuse, and unauthorized access to our systems.

3.8 Business Operations: Internal record-keeping, analytics, reporting, and improving our services and systems.

Under the Privacy Act 2020, we process your personal information on the following bases:

4.1 Consent: By booking our services, making payment, or communicating with us (including via our AI agents), you consent to the collection and use of your information as described in this policy.

4.2 Contractual Necessity: Processing is necessary to perform our services as set out in our Terms of Service.

4.3 Legitimate Interest: We have a legitimate interest in improving our services, preventing fraud, and protecting our legal rights.

4.4 Legal Obligation: We are required to retain certain records for tax, financial, and regulatory purposes.

We share your personal information only as follows:

5.1 Service Contractors: We share relevant job details (name, phone, location, vehicle, issue) with our network of independent misfuel recovery and roadside assistance operators to fulfil your service request. Contractors are bound by confidentiality obligations under our Supplier Terms.

5.2 Payment Processors: Stripe Inc. processes payments on our behalf. Stripe's privacy policy governs their handling of your payment data.

5.3 Technology Providers: We use the following third-party service providers who may process your data:

• Vercel Inc. (USA) — Website hosting and application infrastructure
• Upstash (USA) — Database services (Vercel KV / Redis)
• Retell AI Inc. (USA) — AI voice call processing and transcription
• OpenAI (USA) — AI language processing for SquEEK and other AI agents
• Microsoft Corporation (USA) — SharePoint document storage and email services
• Stripe Inc. (USA) — Payment processing
• Twilio Inc. (USA) — SMS messaging

5.4 Insurers: Where you request an insurance report, or where an insurer has referred you to us, relevant service and vehicle information may be shared with the insurer.

5.5 Legal Authorities: We may disclose information where required by law, regulation, court order, or governmental request, or where necessary to protect our legal rights.

5.6 Professional Advisors: Accountants, lawyers, and auditors engaged by EEK, bound by professional confidentiality obligations.

5.7 Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the business.

6.1 International Processing: As outlined in Section 5.3, several of our technology providers are based in the United States. Your personal information may be transferred to and processed in countries outside New Zealand, including the United States and the United Kingdom.

6.2 Safeguards: Where your data is transferred overseas, we take reasonable steps to ensure that the receiving party provides comparable privacy protections to those under the Privacy Act 2020 (Information Privacy Principle 12). Our service providers are contractually bound to protect your information.

6.3 Consent: By using our services, you consent to the transfer of your personal information to countries outside New Zealand as described in this policy.

7.1 Security Measures: We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, or alteration. These include:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Access controls limiting who can view personal information
• Secure authentication for all platform access
• Regular security monitoring and updates

7.2 No Guarantee: While we take reasonable steps to protect your information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.

7.3 Breach Notification: In the event of a data breach that poses a risk of serious harm, we will notify affected individuals and the Office of the Privacy Commissioner as required under Part 6A of the Privacy Act 2020, as soon as practicable after becoming aware of the breach.

8.1 Retention Periods: We retain personal information only for as long as necessary for the purposes described in this policy, or as required by law. Specific retention periods include:

• Financial records and invoices: 7 years (Tax Administration Act 1994)
• Service records and job data: 7 years from job completion
• Call recordings and transcripts: 7 years from date of recording
• Communications (SMS, email, portal messages): 7 years from date of message
• Insurance reports: 7 years from date of report
• Website analytics data: 26 months

8.2 Deletion: After the applicable retention period, personal information is securely deleted or anonymised.

8.3 Active Disputes: Where there is an active dispute, complaint, or legal proceeding, relevant data will be retained until the matter is fully resolved, regardless of the standard retention period.

9.1 Cookies: Our website uses cookies and similar technologies to:

• Maintain your session and preferences
• Analyse website usage and performance
• Facilitate payment processing

9.2 Essential Cookies: Some cookies are essential for our website to function (e.g., session management, security). These cannot be disabled.

9.3 Analytics: We may use analytics services to understand how visitors use our website. This data is aggregated and does not identify individuals.

9.4 Managing Cookies: You can control cookies through your browser settings. Disabling cookies may affect the functionality of our website.

Under the Privacy Act 2020, you have the following rights in relation to your personal information:

10.1 Right of Access (IPP 6): You have the right to request access to your personal information held by us. We will respond to access requests within 20 working days.

10.2 Right of Correction (IPP 7): You have the right to request correction of any inaccurate, incomplete, or misleading personal information. We will action correction requests promptly.

10.3 Right to Request Deletion: You may request deletion of your personal information. We will comply where the information is no longer needed for the purposes it was collected, subject to our legal obligations to retain certain records (see Section 8).

10.4 Right to Complain: If you believe we have breached the Privacy Act 2020, you may lodge a complaint with the Office of the Privacy Commissioner:

10.5 How to Exercise Your Rights: To make an access, correction, or deletion request, contact us using the details in Section 1.2. We may require verification of your identity before processing any request.

To request deletion of your personal information:

1. Contact us by phone at 0800 769 000
2. Or email us via the contact details on our website
3. Provide your name, phone number, and booking reference (if available)
4. Specify which data you wish to have deleted

We will process your deletion request within 20 working days, subject to:

• Legal requirements to retain certain records (e.g., financial transactions, tax records — see Section 8)
• Active disputes, complaints, or legal proceedings
• Outstanding payments or obligations

Where full deletion is not possible due to legal obligations, data may be anonymised rather than deleted.

12.1 AI Agent Systems: We operate multiple AI agents to facilitate service delivery, including SquEEK (text-based communications via SMS, email, WhatsApp, and portal), Laura (AI voice calls for job coordination and payment), Whitey (AI voice calls for sales and bookings), and any additional AI agents introduced from time to time. These agents process your messages and calls to provide automated responses, status updates, and coordination between customers, contractors, and EEK staff.

12.2 AI Voice Calls: Our AI voice agents (including Laura, Whitey, and any future voice agents) make and receive phone calls via Retell AI. These calls are recorded and transcribed. You will be informed when speaking with an AI system.

12.3 Automated Dispatch: Our system uses automated algorithms to match your job with the most suitable available contractor based on location, availability, and performance. This does not involve decisions with significant legal effects on you.

12.4 Human Oversight: Complex issues, complaints, and disputed decisions are escalated to human staff for review. You may request human review of any AI-generated communication or decision by contacting us.

Program Name: EEK Mechanical Service Notifications

13.1 Description: EEK Mechanical sends SMS and messaging notifications to customers and suppliers (service technicians) in connection with vehicle repair and misfuel recovery services. Messages include booking confirmations, service status updates, job dispatch notifications, payment notifications, and operational communications.

13.2 Consent: By booking a service with EEK Mechanical (whether by phone, online, or through a referral), you consent to receive transactional SMS messages related to your service. Suppliers consent to receive SMS messages related to job dispatch and operations during onboarding. For full consent details, see our Customer Terms of Service (Section 5.2) and Supplier Terms of Service (Section 11).

13.3 Message Frequency: Message frequency varies based on service activity. Customers typically receive 3-10 messages per service booking. Suppliers may receive multiple messages per day during active job periods.

13.4 Message & Data Rates: Message and data rates may apply. Standard carrier messaging rates apply to all SMS messages sent and received. EEK does not charge for SMS messages, but your mobile carrier may.

13.5 Opt-Out: You may opt out of non-essential SMS messages at any time:

13.6 Help: For assistance with SMS messaging:

13.7 Supported Carriers: SMS messages are supported on all major US and NZ mobile carriers. Carriers are not responsible for delayed or undelivered messages.

13.8 SMS Providers: SMS messages are sent via Twilio Inc. (US) and The New Zealand Telecom Group / TNZ (NZ). These providers may process your phone number and message metadata in accordance with their own privacy policies.

13.9 Privacy: Your phone number and messaging data are handled in accordance with this Privacy Policy. We do not sell, share, or rent your phone number to third parties for marketing purposes. Phone numbers are used solely for service-related communications.

Our services are not directed at individuals under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected information from a child, we will delete it promptly.

14.1 Updates: We may update this Privacy Policy from time to time. The updated version will be posted on our website with a revised "Last Updated" date.

14.2 Notification: For material changes that significantly affect how we handle your personal information, we will make reasonable efforts to notify you (e.g., via email or a prominent notice on our website).

14.3 Continued Use: Your continued use of our services after any changes to this policy constitutes acceptance of the updated terms.