Hero Internet Privacy Policy

Last updated 27 August, 2026

This Privacy Policy explains how Hero Internet Limited ("Hero Internet", "we", "our" or "us") collects, uses, stores, processes and protects information when you visit our websites or use our telecommunications, cloud communications, artificial intelligence and related services.

Hero Internet Limited is a company registered in New Zealand, with company number 6906473.

We take the protection, privacy and sovereignty of customer data seriously. In particular, our AI services have been designed to allow customer data to be processed within infrastructure operated and controlled by Hero Internet rather than being sent to third-party AI providers.

A. Information we collect and how we use it

Website visitors

When you visit our website, we may collect:

cookies and session information;
IP address;
browser and device information;
general location information derived from your connection; and
information about how our website is used.

We use this information to operate and secure our website, maintain user sessions, understand how our website is used and improve our services.

Customer accounts

When you register for or purchase our services, we may collect information including:

your name;
email address;
telephone number;
billing and physical address;
IP address;
GST or tax identification details;
payment information; and
identification or proof of address where required.

We use this information to establish and administer your account, provide services, process payments, prevent fraud, provide customer support and meet our legal and regulatory obligations.

Payment card information may be processed by our payment service providers. Hero Internet does not store complete credit card information where payment processing is performed by those providers.

Telecommunications services

When you use our telecommunications services, we may process information including:

telephone numbers and service identifiers;
call and message routing information;
call detail records, including time, duration, origin and destination;
SIP and network addressing information;
voicemail, call recordings or transcripts where the relevant service provides these functions; and
other information necessary to establish, route, manage and support communications.

This information is processed to provide the telecommunications services requested by our customers, for billing, service management, security, troubleshooting and to meet applicable legal obligations.

Smartphone applications

Our applications may request access to device functions such as:

microphone access for audio calls;
camera access for video calls;
location information for location-based calling features; and
contacts where required to allow users to call contacts stored on their device.

These permissions are used only to provide the relevant application functionality.

B. Artificial Intelligence and AI-Enabled Services

Hero Internet provides AI-enabled telecommunications and business communication services, including Answer Hero.

Our self-hosted AI infrastructure

Data sovereignty is a fundamental principle of Hero Internet's AI products and services.

Hero Internet operates its AI processing infrastructure on systems under our control, including our own GPU compute infrastructure. We use self-hosted artificial intelligence and large language models, including open-source models such as Llama models.

These models are operated within Hero Internet-controlled infrastructure. Customer information processed by our self-hosted AI systems is not sent to the developers or providers of those models for AI processing.

We do not use third-party hosted generative AI or LLM services to process Google Workspace data used by Answer Hero.

How customer information is used by AI services

Our AI systems may process information necessary to perform functions requested by our customers. Depending on the service configured by the customer, this may include:

the content of telephone conversations;
instructions and information supplied by the customer to their AI Agent;
call metadata;
appointment and availability information;
information required to answer enquiries or perform actions configured by the customer; and
information retrieved from systems connected to the AI Agent with the customer's authorisation.

This information is processed to provide the requested service and functionality.

AI model training

Customer data is not used to train, develop or improve foundational or general-purpose artificial intelligence or machine-learning models.

Information processed during operation of our AI services is used for inference and to provide the service requested by the customer. We do not use customer Google Workspace data, whether raw, aggregated, anonymised or derived, to train or improve general-purpose AI or machine-learning models.

Customer data processed by our self-hosted models is not transmitted back to the model developer or another AI provider for training, model improvement or other secondary purposes.

C. Google Workspace and Google Calendar Data

Certain Hero Internet services, including Answer Hero, may integrate with Google Workspace services such as Google Calendar when explicitly authorised by the customer.

Information accessed

Depending on the permissions granted by the customer and functionality being used, Answer Hero may access Google Calendar information for purposes such as:

checking calendar availability;
identifying available appointment times;
creating appointments or calendar events;
modifying or managing appointments where authorised; and
performing other calendar functions explicitly configured or requested by the customer.

We request access only to Google Workspace information necessary to provide the functionality selected by the customer.

How Google Workspace data is used

Google Workspace data is used solely to provide and operate the customer-requested functionality.

For example, an Answer Hero AI Agent may use calendar availability to respond to a caller asking for an appointment and may create an appointment in the customer's Google Calendar when instructed or authorised to do so.

Google Workspace information may be processed by Hero Internet's self-hosted AI systems where necessary to perform these functions.

Google Workspace data and AI

Google Workspace user data processed by our AI systems remains within Hero Internet-controlled processing infrastructure and is not provided to third-party AI/ML service providers for AI processing or model training.

We do not:

use Google Workspace data to train or improve generalized AI or ML models;
allow our self-hosted models to learn from or train on individual customers' Google Workspace data;
send Google Workspace data to external LLM or generative AI APIs;
send Google Workspace data back to the developers or providers of the open-source models we operate;
sell Google Workspace data; or
transfer Google Workspace data to third parties for advertising, AI model training or other unrelated purposes.

This applies to raw Google Workspace data as well as aggregated, anonymised and derived data.

Google API Services User Data Policy - Limited Use

Answer Hero's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, information obtained through Google Workspace APIs is used only to provide or improve the user-facing functionality that is prominent in the requesting application's user interface and is not used to develop, improve or train generalized or foundational AI/ML models.

Customers may revoke Answer Hero's access to their Google account through their Google account security settings. Customers may also contact Hero Internet for assistance with disconnecting their Google integration.

D. Data Sovereignty and Location of Processing

New Zealand-hosted products and services

Data sovereignty is an important part of the way Hero Internet designs and operates its services.

Hero Internet's New Zealand customer infrastructure and customer data are primarily hosted within New Zealand, including infrastructure in our Auckland data centres. Our core databases, web services, AI processing infrastructure and backups for New Zealand-hosted services are operated within New Zealand.

Our self-hosted AI models used for New Zealand-hosted AI services operate on Hero Internet-controlled infrastructure. Customer information is therefore not routinely exported to overseas AI providers simply for the purpose of AI inference.

Hero Internet also operates telecommunications infrastructure in other locations, including voice proxy infrastructure in Sydney, Australia. Limited technical information necessary for telecommunications connectivity, routing and authentication may pass through such infrastructure where required to provide the service.

International products and services

Some services inherently require information to be processed outside New Zealand.

For example, where a customer purchases an international telephone number or uses a telecommunications service in another country, information necessary to provide that service may need to be exchanged with telecommunications carriers, suppliers, regulators or authorities in the relevant jurisdiction.

Where international processing or transfer is necessary, we limit the information transferred to what is reasonably required to provide the service or comply with applicable legal obligations.

E. Sharing Information

Hero Internet does not sell customer personal information.

Telecommunications providers

Hero Internet provides telecommunications services that interconnect with other communications service providers. Information necessary to route and connect calls and messages may therefore be exchanged with telecommunications carriers and network operators.

Service providers

We may use third-party providers for specific supporting functions, such as payment processing. These providers are given only the information reasonably necessary to perform the relevant service and are required to appropriately safeguard that information.

This does not mean that Google Workspace data used by Answer Hero is provided to third-party AI providers. As described above, our AI processing of that information is self-hosted.

Legal requirements

We may disclose information where required by applicable law, regulation, court order, warrant or other lawful government request, or where reasonably necessary to protect the security and integrity of our services, customers or the public.

Affiliates

We may share information with Hero Internet affiliates where necessary to provide or administer our services. Such information remains subject to the protections described in this Privacy Policy.

Aggregated or de-identified information

We may use aggregated or de-identified information for legitimate business purposes where individuals cannot reasonably be identified.

This provision does not permit Google Workspace API data, including aggregated, anonymised or derived Google Workspace data, to be provided to third parties for the purpose of training, developing or improving generalized AI or machine-learning models.

F. Legal Basis for Processing

We process personal information where necessary:

to provide products or services under our agreement with you;
with your consent;
for legitimate business purposes where those interests do not override your privacy rights;
to comply with legal or regulatory obligations; or
where otherwise permitted or required by applicable law.

Where processing relies upon consent, you may withdraw that consent, although doing so may prevent us from continuing to provide functionality that requires the relevant information.

G. Retention of Information

We retain personal information only for as long as reasonably necessary to:

provide the services requested by our customers;
maintain appropriate business and accounting records;
meet legal, regulatory and taxation obligations;
investigate security or service issues; and
establish, exercise or defend legal claims.

Different categories of telecommunications and service data may have different retention periods according to their purpose and applicable legal requirements.

Where a customer disconnects an integration such as Google Calendar, we cease accessing new information through that authorisation. Information already held will be deleted or retained in accordance with our normal retention obligations and applicable law.

H. Security

We use technical and organisational measures designed to protect customer information from unauthorised access, alteration, disclosure or loss.

Our approach includes controlling access to production infrastructure and limiting access to customer information to systems and personnel that require it to provide, operate, secure or support our services.

Our use of self-hosted AI infrastructure is also part of our approach to data sovereignty and security by reducing the need to transmit customer information to external AI platforms.

I. Cookies and Website Information

Our website may use cookies and similar technologies to:

maintain authenticated sessions;
remember preferences;
understand how our website is used;
improve website performance and usability; and
provide functionality such as customer support.

Your browser allows you to control or delete cookies. Disabling cookies may prevent some website functions from operating correctly.

Web server logs may record information including IP addresses, browser information, requested pages and other technical information. We use this information for service operation, security, troubleshooting and aggregate analysis.

J. Communications

We may send customers communications necessary to operate their accounts and services, including:

invoices and payment receipts;
service and technical notifications;
security notifications;
account notices; and
other operational communications.

We may also send information about our products and services where permitted. Marketing communications will include an appropriate method of opting out.

When you contact our sales or support teams, we may retain your communication and associated contact details so that we can respond to your request and maintain appropriate customer service records.

K. Third-Party Websites

Our websites may contain links to third-party websites. Hero Internet does not control those websites, and their handling of information is governed by their own privacy policies.

L. Children

Our products and services are not marketed for purchase by children. Persons under 18 should use our website or services only with the appropriate consent of a parent or guardian where required.

M. Access, Correction and Deletion

You may request access to personal information we hold about you and request correction of information that is inaccurate.

Where applicable, you may also request deletion of personal information. Some information may need to be retained where required for legal, regulatory, accounting, fraud-prevention or legitimate business purposes.

We may take reasonable steps to verify your identity before fulfilling a request involving personal information.

Requests can be sent to support@hero.co.nz.

N. Complaints

If you have concerns about this Privacy Policy or the way Hero Internet handles your personal information, please contact support@hero.co.nz.

We will investigate and respond to privacy concerns in accordance with applicable New Zealand privacy law.

You may also have the right to make a complaint to the New Zealand Office of the Privacy Commissioner.

O. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our products, technology, legal obligations or privacy practices.

The date at the top of this policy indicates when it was most recently updated.