Privacy Policy

1. Scope

This privacy policy describes how Gyre Limited collects, uses, and protects personal information in connection with gyre.world (the "Site"), including the public marketing pages and the authenticated Gyre platform.

Specific activities on the platform — such as investment or project engagement — may be subject to additional agreements or notices presented to you at the time of that activity.

2. Who we are

Gyre Limited (NZBN 9429051520809) ("we", "us", or "our") is a New Zealand limited company. We are the agency responsible for personal information collected through the Site under the Privacy Act 2020 (NZ).

You can contact us using the form on our contact page.

3. Information we collect

When you visit or interact with the Site, we may collect:

• Contact and enquiry data: your first name, last name, email address, organisation, and any message you submit through forms on the Site.
• Account data: name, email address, account preferences, and role, collected when you create an account on the platform.
• Platform data: project information, investment activity, and related data you provide or generate through the Gyre platform.
• Technical and usage data: IP address, device and browser type, general location derived from IP, pages viewed, referring URL, and timestamps. Our error monitoring tool (Sentry) may also capture session replay data — recordings of user interactions at the time of an error — with personal data masked. We collect this through cookies and similar technologies as described in our Cookie Policy.
• Communications: records of correspondence when you email us.

Where we collect personal information directly from you (for example, through a form), we will provide notice of the matters required under Information Privacy Principle 3 at the point of collection.

4. How we use information

We use the information described above to:

• Respond to your enquiries and communicate with you about Gyre;
• Create and manage your account;
• Provide, manage, and improve the Gyre platform and your experience on it;
• Facilitate project and investment activities on the platform;
• Operate, maintain, and secure the Site;
• Analyse Site usage in aggregate to improve performance and content;
• Detect and prevent fraud, abuse, and security incidents; and
• Comply with legal obligations.

Under the Privacy Act 2020, we collect personal information directly from you where practicable (IPP 2) and only for lawful purposes connected with the functions described above (IPP 1).

5. Sharing of information

We may share personal information with:

• Service providers who assist us with hosting and infrastructure (Vercel, Supabase), analytics (Google Analytics, Vercel Analytics), error monitoring (Sentry), bot and spam protection (Cloudflare Turnstile), email delivery, and security, subject to contractual confidentiality obligations;
• Professional advisers where reasonably necessary (for example, lawyers or accountants); and
• Authorised Gyre staff who may access your account data to operate and support the platform. In limited circumstances, authorised staff may access the platform on your behalf to diagnose technical issues. Such access is restricted to what is necessary.
• Authorities when required by law or to protect rights, safety, and security.

We do not sell personal information.

6. International transfers

Some of the service providers described above process data outside New Zealand, including in the United States. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the information will be subject to protections comparable to those under the Privacy Act 2020, consistent with Information Privacy Principle 12.

7. Retention

We retain personal information only for as long as needed for the purposes described in this policy or as required by law. Contact form submissions are retained for up to two years after your last interaction with us, unless you ask us to delete them sooner. Account data is retained for as long as your account is active or as needed to provide you with services; you may request deletion of your account by contacting us using the details in Section 2. Analytics data is retained in aggregate form.

8. Your rights under the Privacy Act 2020

Under the Privacy Act 2020 (NZ), you have the right to:

• Access the personal information we hold about you (IPP 6);
• Request correction of personal information that is inaccurate, incomplete, or misleading (IPP 7); and
• Complain to the New Zealand Office of the Privacy Commissioner if you believe your privacy has been interfered with. You can contact the Privacy Commissioner at privacy.org.nz.

If you are located in another jurisdiction, you may have additional rights under local privacy or data protection law. To exercise any of your rights, contact us using the details in Section 2. We may need to verify your identity before responding.

9. Data breaches

If we become aware of a data breach that is likely to cause serious harm, we will notify affected individuals and the Privacy Commissioner as required under Part 6 of the Privacy Act 2020.

10. Security

We implement technical and organisational measures designed to protect personal information, including encryption in transit (HTTPS), access controls, and secure hosting. No method of transmission over the Internet is completely secure, and we cannot guarantee absolute security.

11. Children

The Site is not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us and we will take appropriate steps.

12. Changes

We may update this policy from time to time. We will post the updated version on this page and revise the "Last updated" date. Where changes are material, we will provide additional notice where required by law.