Wild Software Ltd. trading as Chreos ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Chreos Accounting dashboard application ("the Service").
This policy applies to users in New Zealand, Australia, and the United Kingdom. We comply with the applicable privacy and data protection laws of each jurisdiction, including:
New Zealand: Privacy Act 2020 and the Information Privacy Principles.
Australia: Privacy Act 1988 (Cth) and the Australian Privacy Principles.
United Kingdom: UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Data Controller
For the purposes of applicable data protection law, Wild Software Ltd. is the data controller responsible for your personal information processed through the Service. If you are a staff member accessing the Service through your employer's organisation, your employer may also act as a data controller for information they manage within the Service.
3. Information We Collect
3.1 Account Information
When your account is created (by an administrator), we collect:
Full name
Email address
Role assignment (root, administrator, or staff)
Password (stored as a one-way bcrypt hash — we never store plaintext passwords)
3.2 Authentication and Session Data
When you log in and use the Service, we collect:
IP address (for rate limiting and security auditing)
Login timestamps and session activity
Browser user agent (for session management)
Login success and failure records (for account lockout protection)
3.3 CWFA Credentials
If you connect to a Chreos desktop or server installation, you may provide Chreos login credentials. These are:
Encrypted at rest using AES-256-CBC encryption with a server-side key.
Used exclusively to authenticate with your Chreos system via CWFA.
Never stored in plaintext, never logged, and never transmitted to any third party.
3.4 AI Assistant Data
When you use the AI assistant, we store:
Conversation history (messages you send and responses received) — scoped to your user account and organisation.
Tool execution audit logs (which tools were called, parameters used, and results) — for security and compliance.
Token usage counts — for analytics and potential billing.
Your AI conversations are transmitted to a third-party AI model provider (e.g. Google Gemini, OpenAI) using an API key supplied by your organisation. We do not control how the AI provider processes this data. Please refer to your AI provider's privacy policy for their data handling practices.
3.5 Business Data from CWFA
Data retrieved from your Chreos system via CWFA (customer records, invoices, inventory, etc.) is displayed in the Service but is not permanently stored by us. CWFA session data may be temporarily cached on the server for performance, with automatic expiry.
4. How We Use Your Information
We use the information we collect to:
Provide, maintain, and improve the Service.
Authenticate your identity and manage your account.
Enforce security measures including rate limiting, account lockout, and CSRF protection.
Audit tool executions and AI interactions for security and compliance.
Diagnose technical problems and monitor system health.
Communicate with you about the Service (e.g. security notices, updates).
We do not use your personal information for marketing purposes. We do not sell, rent, or trade your personal information to third parties.
5. Data Security
We take the security of your data seriously and employ the following measures:
Encryption at rest: All sensitive credentials (CWFA passwords, AI API keys) are encrypted using AES-256-CBC with a server-side encryption key.
Password hashing: User passwords are stored as bcrypt hashes and cannot be reversed.
CSRF protection: All form submissions and API requests are protected against cross-site request forgery attacks.
Rate limiting: Login attempts are rate-limited by IP address to prevent brute-force attacks.
Account lockout: Accounts are temporarily locked after repeated failed login attempts.
Session security: Session IDs are regenerated on login. Cookies are set with HttpOnly, Secure, and SameSite attributes.
Prepared statements: All database queries use parameterised prepared statements to prevent SQL injection.
Output escaping: All user-supplied content is escaped before rendering to prevent cross-site scripting (XSS).
Security headers: HTTP security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, etc.) are enforced via server configuration.
Organisation isolation: All data access is scoped to your organisation. Users in one organisation cannot access data belonging to another.
6. Data Retention
Account data is retained for as long as your account is active. If your administrator removes your account, your personal data is deleted.
Login logs are retained for security auditing purposes and may be periodically purged.
AI conversation history is retained until you or your administrator deletes it.
AI audit logs are retained for compliance and security review.
CWFA session caches expire automatically (typically within 1–2 hours) and are not backed up.
7. Third-Party Services
The Service may interact with the following categories of third-party services:
AI model providers (e.g. Google, OpenAI) — when you use the AI assistant. Data sent to these providers is subject to their respective privacy policies.
Hosting provider (AWS) — the Service is hosted on infrastructure provided by Amazon Web Services. AWS processes data in accordance with their data processing agreement.
We do not use third-party analytics, advertising, or tracking services within the application.
8. International Data Transfers
Your data may be processed on servers located outside your country of residence. Specifically:
The Service is hosted on AWS infrastructure. Data may be stored in the AWS region configured by your administrator.
AI queries are transmitted to the AI provider's servers, which may be located internationally.
Where personal data is transferred internationally, we ensure appropriate safeguards are in place in accordance with applicable data protection laws.
UK users
For transfers of personal data outside the United Kingdom, we rely on appropriate safeguards as permitted under the UK GDPR, including adequacy decisions, standard contractual clauses, or other approved mechanisms.
9. Your Rights
Depending on your jurisdiction, you may have the following rights in relation to your personal information:
All users
Access: Request a copy of the personal information we hold about you.
Correction: Request correction of inaccurate or incomplete personal information.
Deletion: Request deletion of your personal information, subject to legal retention requirements.
UK users (additional rights under UK GDPR)
Restriction of processing: Request that we restrict the processing of your personal data in certain circumstances.
Data portability: Request a copy of your data in a structured, commonly used, and machine-readable format.
Objection: Object to the processing of your personal data where we rely on legitimate interests as the legal basis.
Complaint: Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
Australian users
You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
New Zealand users
You may lodge a complaint with the Office of the Privacy Commissioner at privacy.org.nz.
To exercise any of these rights, please contact us using the details in Section 13.
10. Cookies and Local Storage
The Service uses the following browser storage mechanisms:
Session cookie: A single session cookie is used to maintain your authenticated session. It is HttpOnly, Secure, and SameSite=Lax. It is deleted when your session ends or expires.
Service worker cache: Static assets (CSS, JavaScript, images) are cached locally by the service worker for performance. No personal data is stored in the service worker cache.
We do not use third-party cookies, analytics cookies, or advertising cookies.
11. Children
The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will take steps to delete it.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the Service. The "Last updated" date at the top of this page indicates when the policy was last revised.
13. Contact
If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us: