Personal Assistant Privacy Policy.

This privacy policy covers the Personal Assistant AI functionality, including the version accessed via Anthropic's Claude apps as a connector. It supplements, and should be read alongside, our Privacy Policy. We vehemently believe in an individuals right to privacy and retain data only where necessary and for the shortest period of time possible which is governed by our legal and contractual obligations. Customers should be aware that domain name registries impose varying rules on the retention of their data and you are encouraged to review the applicable registry registrant agreement. 

1. Who this policy covers

This policy applies to:

• Customers using our in-app chat ("Personal Assistant") service
• Customers who connect their domain.co.nz account to Claude (the AI app from Anthropic) as a custom connector
• Anyone whose data is incidentally processed when our customers ask the assistant to take actions on their behalf

The Personal Assistant is operated by The Domain Name Company Limited ("we", "us", "our").

2. Data we collect

When you use the Personal Assistant, we collect and process:

2a. Information you provide

• Authentication credentials — when you sign in to authorise the assistant, you provide your existing domain.co.nz email and password. These are validated against our existing customer database; they are not seen by the AI assistant.
• Messages and instructions — the natural-language requests you make to the assistant (e.g. "register example.co.nz for me", "set up an out-of-office reply").
• Confirmations — when the assistant asks you to confirm a destructive action (e.g. deleting a DNS record), your confirmation is recorded as part of the action log.

2b. Information generated by your use of the service

• Action logs — a record of each action the assistant takes on your behalf (e.g. "added DNS record A for example.co.nz", "created mailbox info@example.co.nz"), including the timestamp and the parameters used.
• Support tickets raised on your behalf — when the assistant escalates a request to our human support team, the ticket subject and body are stored in our normal support system.
• Capability gap notes — when you request something the assistant cannot yet do, the assistant logs the request so we can prioritise improvements. This log includes a description of what was requested and which broad category it falls into (e.g. "domains", "email"). It does not include the surrounding conversation.
• Conversation history (in-app chat only) — if you use the in-app chat, your conversation history is stored against your client account so the chat can reference earlier messages within the same session.

2c. Information NOT collected by us

• Your password — never seen, processed, or stored by the AI assistant.
• Your conversations with Claude (the connector channel) — when you use the Claude connector, your conversation history is held in your Claude account, not by us. We only see the specific tool calls Claude makes on your behalf.
• Claude's responses to you — we don't see what Claude writes back to you in conversation.
• Card or banking details — payment processing uses your existing payment method on file at domain.co.nz; the assistant cannot collect new payment details.

3. How we use your data

We use the data described above to:

• Provide the service — authenticate you, execute the actions you request, and verify the actions belong to your account.
• Operate the platform — maintain audit trails of changes to your domains, hosting, and email so we can investigate and reverse mistakes.
• Provide customer support — review tickets and action logs when you contact support to resolve an issue.
• Improve the service — review capability gap notes to plan new features. Aggregate usage statistics inform our product roadmap.
• Comply with legal obligations — for example, when a domain registry requires us to provide registrant information.

We do not use your data to train AI models. The Personal Assistant uses commercial AI services (such as Anthropic's Claude API) but does not contribute your data to model training.

4. How we store your data

• All data is stored on our servers in Amazon Web Services regions, with industry-standard encryption at rest and in transit.
• All transport is over HTTPS (TLS 1.2 or higher).
• Authentication tokens are short-lived (8-hour access tokens, 7-day refresh tokens) and signed with cryptographic secrets only our servers know.
• Access to internal logs is restricted to authorised domain.co.nz staff.

5. Third-party sharing

We share data with third parties only in the following limited circumstances:

5a. Anthropic (operator of Claude)

When you use the Claude connector, your messages are sent to Anthropic's Claude API for processing. Anthropic's handling of your data is governed by their own privacy policy: https://www.anthropic.com/legal/privacy. We have no control over what Anthropic does with the message content; we only see the specific tool calls Claude decides to make on your behalf and forward to our MCP server.

When you use the in-app chat, messages are also processed via the Anthropic Claude API. The same Anthropic privacy policy applies.

5b. Domain registries

When you register, renew, or transfer a domain, we are contractually required to share registrant data with the relevant registry - this is usually contact data, and exact details can be found in the respective registry registrant agreement. This is required regardless of whether the action was initiated via the Personal Assistant or any other channel.

5c. Payment processors

Payment captures use your existing payment method on file. We do not share your payment details with or via the Personal Assistant.

5d. Legal compliance

We may share data where required by law, by valid court order, or to protect the rights of you, our customers and the public.

We do not sell your data to advertisers or other third parties.

6. Data retention

• Action logs, support tickets, and capability gap notes — retained for the lifetime of your account, in line with rentention policies laid down by the domain registries.
• Conversation history (in-app chat) — retained until you clear it manually using the "Clear conversation" button or close your account.
• Authentication tokens — automatically expire (8 hours for access tokens, 7 days for refresh tokens). You can revoke them at any time by disconnecting the Claude connector.
• Logs required for legal or regulatory purposes (e.g. registry-mandated registrant records) — retained as required by the relevant law or contract, which may extend beyond account closure.

You can request deletion of specific records at any time by sending a ticket, subject to any legal retention requirements.

7. Your rights

Depending on your jurisdiction, you may have rights to:

• Access the data we hold about you
• Correct inaccurate data
• Delete data, subject to legal retention requirements
• Object to certain processing activities
• Port your data to another service

8. Security incidents

If a security incident affects your data, we will notify you in accordance with applicable law. To report a suspected security issue with the Personal Assistant, please send a ticket.

9. Children

The Personal Assistant is intended for use by customers aged 18 or over. We do not knowingly collect data from children.

10. Changes to this policy

We may update this policy as the service evolves. The "Last updated" date reflects the most recent change. Material changes will be communicated to active users via email.

11. Contact

For privacy questions or requests please send a support ticket.

Last Updated: 10-May-26.