Privacy Policy

1. Who this policy covers

This policy explains how BuildIt Builder Limited trading as Oscar, a company registered in New Zealand under company number 9359240, NZBN 9429053006561, with its registered office at 9b Atkin Avenue, Mission Bay, Auckland 1071, New Zealand, collects and uses information through this website and the Oscar program. We follow the New Zealand Privacy Act 2020.

2. What stays on your computer

Oscar works on your computer. Your conversations, the things Oscar remembers about how you work, your contacts, notes, calendar, tasks, settings and your vault are kept on your computer and are not sent to us. Your passwords and other secrets are kept in the Windows credential store.

When you ask Oscar something that needs a cloud AI service, the words of that request, and any file, page text, picture or screenshot the request uses, are sent from your computer to our servers and on to the AI company that answers it. When you dictate, the recording of your voice is sent the same way to OpenAI, which turns it into text. Oscar speaks his answers aloud, so the words of an answer are also sent to the company that makes his voice. When a request needs a web search, a place, an address, a route or the weather, the words of that lookup are sent to the search or map company. When Oscar checks whether a web address, a download or a software package is dangerous, the address or package name is sent to the companies that keep lists of known dangers. Nothing else from your computer is sent. Section 5 names those companies and section 6 says where they work.

3. Information we collect

• Account information. Your email address and a password that only Amazon Cognito holds, in a form nobody can read back.
• Profile and computers. Your display name, and a name and identifier for each computer you sign in to Oscar on, so you can see them and remove them.
• Billing information. If you pay for a plan, Stripe collects your card details and billing address. We receive your plan, your subscription status and a Stripe customer reference. We never receive your full card number.
• Your requests to cloud AI. As described in section 2. We do not keep the words of your requests, your voice recordings, your pictures or the answers on our servers. They stay in your conversation history on your computer. The companies that answer a request may keep it for a short time, up to about two months, to find misuse. Under the terms we have with them today they do not use it to train their AI.
• Usage records. For each cloud request we record who made it, when, which AI company answered, how large it was and what it cost. We use this to apply your allowance, to bill you and to watch our costs.
• Messages to us. The name, email address and message you send through the contact form.
• Bug reports. Oscar shows you exactly what a bug report contains and sends nothing until you say yes. A report holds a short summary, identifiers for the conversation, and the most recent lines of Oscar's own event log.
• Crash reports. Oscar does not send these unless you agree, and you can change your mind in Oscar's settings at any time. A crash report says what went wrong, which part of Oscar, when, and which version of Windows. Folder names on your computer are removed before it is sent.
• Website and update records. Our hosting provider records the internet address and the pages or files requested when you visit the website, download Oscar or when Oscar checks for an update.

4. How we use your information

We use it only to:

• create your account and let you sign in;
• answer your requests to Oscar and apply your usage allowance;
• take payment for your plan and manage your subscription;
• reply to your messages and fix problems you report;
• send you emails about your account, such as receipts and security notices;
• keep our services secure and watch their cost;
• meet our legal and accounting duties.

We do not sell your personal information. We do not send marketing email unless you ask for it.

5. Who handles your information for us

• Amazon Web Services runs our accounts, our servers, our email sending and the place Oscar downloads from.
• Stripe takes payments.
• OpenAI, Google and Amazon Bedrock answer requests that need a cloud AI service. Oscar tries them in that order, and you are not asked to choose.
• OpenAI also turns your dictation into text from the recording of your voice.
• xAI makes Oscar's spoken voice from the words of his answers.
• Brave and Google answer web searches, and place, address, route and weather lookups, when a request needs one.
• Google and Sectigo check web addresses, downloads and software packages against lists of known dangers. Google gets the address or package name. Sectigo, which runs the public certificate search crt.sh, gets the domain name.

We share your information with no one else, except where the law requires it or you ask us to.

6. Information that leaves New Zealand

Your account, usage records and requests are handled outside New Zealand. Amazon Web Services runs our accounts and servers in the United States. OpenAI, Google, xAI and Brave work from the United States. Amazon Bedrock answers from Australia. Stripe handles payments, and Sectigo handles domain name checks, on their own systems. These companies may not be required to protect your information in a way that, overall, provides comparable safeguards to the New Zealand Privacy Act 2020. By registering, and by sending a request that needs a cloud service, you authorise us to send your information to them after being told this. Each of them has its own terms about what it keeps. If you do not want a request to leave your computer, do not send it to a cloud AI service.

7. How long we keep it

• Your account information is kept while your account is open.
• When you delete your account, we remove your sign-in, your profile and your registered computers within 30 days.
• We keep billing records and usage records for seven years, because the law requires us to keep business records. After you delete your account they no longer show your email address.
• Bug reports and crash reports are kept for 12 months after we have dealt with them.
• Messages you send us are kept only as long as needed to help you.
• Stripe keeps its own payment records under its own terms.

8. Your rights and choices

You can ask to see the information we hold about you and to correct it. You can ask Oscar to export the information kept on your computer, and to delete it. When you uninstall Oscar you are offered the same choice. You can ask Oscar to delete your account. You can also ask us through the contact form on our home page, and we will answer within 20 working days. If you are not happy with our answer you can complain to the Office of the Privacy Commissioner at privacy.org.nz. If you live in the United States, you have the same rights to see, correct and delete your information, and we will not treat you differently for using them.

9. Keeping it safe

Amazon Web Services encrypts account data while it is stored and while it travels. Oscar keeps the secrets on your computer in the Windows credential store. Every key for an AI company is held on our servers, never on your computer. If there is a privacy breach that could seriously harm you, we will tell you and the Privacy Commissioner as the law requires, and we will tell people in the United States as the law of their state requires. To report a weakness in our security, see our contact form.

10. Cookies and tracking

We use only the cookies and browser storage that signing in, paying and remembering your language and currency need. We do not use advertising or analytics cookies, and we do not track you across other websites. Because we do not track you, we have nothing to change when your browser sends a Do Not Track signal. The cookie notice lists them.

11. Children

Oscar is not for anyone under 18, and we do not knowingly collect information from anyone under 18. If you believe a child has given us information, contact us and we will delete it. This applies in particular to any child under 13.

12. Changes to this policy

When we change this policy we will post the new version here with a new date. For a change that matters to you we will tell you by email or in Oscar before it starts.

13. Contact

Questions about this policy and requests about your information go to our contact form. You can also write to BuildIt Builder Limited trading as Oscar at 9b Atkin Avenue, Mission Bay, Auckland 1071, New Zealand. Our privacy officer is Lloyd Mason, who can be reached at the same address.